joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487ae0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5057f6
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x559680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0x24c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x244], edi
cmp edi, 0xffffffff
jne 0x487b34
xor eax, eax
jmp 0x487ccd
push 0x22c
xor ebx, ebx
lea eax, [ebp - 0x23c]
push ebx
push eax
call fcn.004e0ad0
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push edi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x487cc0
lea edi, [ebp - 0x218]
shr edi, 0x10
mov dword [ebp - 0x248], edi
lea esp, [esp]
mov eax, dword [0x5591b8]
mov ecx, 0x5591b8
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x240], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
test edi, edi
jne 0x487bc8
movzx edi, ax
push 0
push edi
call fcn.00402e50
add esp, 8
test eax, eax
je 0x487bf8
push edi
push eax
lea ecx, [ebp - 0x240]
call fcn.00406a90
jmp 0x487bf2
lea edx, [eax + 2]
jmp 0x487bd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x487bd0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.00409230
mov esi, dword [ebp - 0x240]
mov edi, dword [esi - 0xc]
mov dword [ebp - 4], 1
test edi, edi
js 0x487cb6
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x487c2d
push edi
lea ecx, [ebp - 0x240]
call fcn.00406c80
mov esi, dword [ebp - 0x240]
lea eax, [edi + 1]
push eax
push esi
call fcn.004e17d5
add esp, 8
cmp edi, dword [esi - 8]
jg 0x487cb6
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
mov edi, dword [ebp - 0x24c]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jl 0x487c6f
push esi
push eax
call fcn.004e01b2
add esp, 8
test eax, eax
je 0x487c6f
sub eax, dword [edi]
sar eax, 1
cmovns ebx, dword [ebp - 0x234]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x487c90
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x244]
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x487cc0
test ebx, ebx
jne 0x487cc0
mov edi, dword [ebp - 0x248]
jmp 0x487b80
push 0x80070057
call fcn.00402ec0
test edi, edi
je 0x487ccb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004df4f4
mov esp, ebp
pop ebp
ret
Function at 0x48c8b0
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004e0aa0
mov eax, dword [0x559680]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x48c915
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x48c915
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004e3cbd
add eax, 0x40
push eax
call fcn.004e64c7
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004df4f4
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004e6402
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x48c9a4
call fcn.0048c770
test eax, eax
jle 0x48c9a4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004df4f4
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004df4f4
add esp, 0x108
ret
Function at 0x49e990
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.004e0aa0
mov eax, dword [0x559680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x49e9c0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x49e9c0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x49ea38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x49ea1a
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x49ea38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x49eaca
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x49eab8
lea eax, [esi + esi]
call fcn.004e5a40
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x49eaca
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49ea63
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x49eaca
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.004e1b0d
mov esi, eax
add esp, 8
test esi, esi
jne 0x49eb6e
call fcn.004e79cf
cmp dword [eax], 2
je 0x49eab0
call fcn.004e79cf
cmp dword [eax], 9
jne 0x49eac2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.004e544b
mov esi, eax
add esp, 8
test esi, esi
jne 0x49eb6e
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0048b420
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x524894
push eax
push 0x524890
push ecx
push str.fopen_
push 5
call fcn.0048b000
add esp, 0x2c
call fcn.004e79cf
cmp dword [eax], 2
jne 0x49eb40
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.0048b420
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df4f4
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0048b420
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df4f4
mov esp, ebp
pop ebp
ret
push 0x558678
call fcn.00489a80
mov edi, eax
add esp, 4
test edi, edi
jne 0x49eba0
push esi
call fcn.004e1c9d
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df4f4
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00489510
push esi
push 1
push 0x6a
push edi
call fcn.00489870
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df4f4
mov esp, ebp
pop ebp
ret
Function at 0x4bd860
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4bd879
mov esi, edi
mov edi, eax
jmp 0x4bd87b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4bd88b
mov eax, ebx
jmp 0x4bd895
push eax
push ebx
call fcn.0048eb20
add esp, 8
test eax, eax
jne 0x4bd89d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4bd8b9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4bd8a4
cmp eax, dword [esi + 4]
jge 0x4bd8d0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4bd8c0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4bd8f1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4bd8ee
dec eax
test eax, eax
jg 0x4bd8e0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4f90d8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x559680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004eb1f1
mov dword [ebp - 0x14], eax
cmp dword [0x55e714], edi
jne 0x4f91c9
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4f9156
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4f92a9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4f92a9
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4f92a9
push eax
call ebx
push 0x548af8
push esi
mov dword [0x55e714], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x55e718], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x548b1c
push esi
mov dword [0x55e71c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x55e724], eax
test eax, eax
je 0x4f91c6
push 0x548b38
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x55e720], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4f91ee
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4f91e1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4f9203
push 4
pop eax
jmp 0x4f92ab
cmp dword [ebp - 0x14], edi
je 0x4f9203
push dword [0x55e714]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4f91e8
mov eax, dword [0x55e720]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4f9261
cmp dword [0x55e724], esi
je 0x4f9261
push eax
call ebx
push dword [0x55e724]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4f9261
test eax, eax
je 0x4f9261
call ecx
test eax, eax
je 0x4f9256
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4f9256
test byte [ebp - 8], 1
jne 0x4f9261
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4f9291
mov eax, dword [0x55e718]
cmp eax, esi
je 0x4f928e
push eax
call ebx
test eax, eax
je 0x4f928e
call eax
mov edi, eax
test edi, edi
je 0x4f928e
mov eax, dword [0x55e71c]
cmp eax, esi
je 0x4f928e
push eax
call ebx
test eax, eax
je 0x4f928e
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x55e714]
call ebx
test eax, eax
je 0x4f92a9
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4f92ab
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004df4f4
leave
ret
Function at 0x4fb721
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004ec055
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4fb759
xor eax, eax
jmp 0x4fb785
cmp esi, dword [ebp - 4]
je 0x4fb782
cmp dword [ebp + 0xc], 0
je 0x4fb782
push dword [edi + 0x9c]
call fcn.004fb32f
push dword [edi + 0x9c]
mov esi, eax
call fcn.004eb509
pop ecx
pop ecx
cmp esi, eax
je 0x4fb755
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x10450058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104501a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1045007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045006a
add dl, dl
jne 0x10450089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104500dc
xor eax, eax
add dl, dl
jne 0x10450096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045017d
add dl, dl
jne 0x104500a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104500b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104500bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104500c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104500d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10450075
mov eax, 1
add dl, dl
jne 0x104500ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104500f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104500e1
sub eax, ebx
mov ebx, 1
jne 0x10450128
mov ecx, 1
add dl, dl
jne 0x1045010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10450119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10450105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10450075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1045013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10450136
cmp eax, 0x7d00
jae 0x1045016d
cmp eax, 0x500
jb 0x10450168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10450075
cmp eax, 0x7f
ja 0x10450170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10450075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1045019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10450075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x44a5c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0044a620

Function at 0x44a620
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x48d0d4]
test eax, eax
jle 0x44a723
mov edx, dword [0x48d0d8]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x44a651
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x44a6c6
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x44a640
mov dword [esp], esi
call fcn.0044af60
test eax, eax
mov edi, eax
je 0x44a74a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x48d0d8]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.0044b050
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x48d0d8]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x44a72a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x44a6d0
add dword [0x48d0d4], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x44a6bf
cmp eax, 0x80
je 0x44a6bf
cmp eax, 8
je 0x44a6bf
mov eax, dword [ebp - 0x28]
add esi, dword [0x48d0d8]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x44a6bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0044a5c0
xor ebx, ebx
jmp 0x44a65b
mov eax, dword [0x48d0d8]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0044a5c0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0044a5c0
lea esi, [esi]

Function at 0x44ae80
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x44aeb8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x44aeae
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x44aeba
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x44aea0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x44b180
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x44b2f0
mov eax, dword [esp + 0x3c]
add eax, 1
lea edx, [eax*4]
cmp eax, 0x1fc00000
mov eax, 0xffffffff
cmovbe eax, edx
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov edi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x44b28b
xor ebx, ebx
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [esp], eax
mov dword [esp + 0x28], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov ecx, dword [esp + 0x28]
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [edi + ebx*4], esi
add ebx, 1
mov eax, dword [esp + 0x3c]
cmp eax, ebx
jg 0x44b1e0
mov dword [edi + eax*4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00402520
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x44b2dc
mov edx, dword [edi]
test edx, edx
je 0x44b2dc
xor ebx, ebx
mov dword [esp], edx
add ebx, 1
call sub.libstdc_6.dll_operator_delete___void_
cmp dword [esp + 0x3c], ebx
jle 0x44b2dc
mov edx, dword [edi + ebx*4]
test edx, edx
jne 0x44b2c4
mov dword [esp], edi
call sub.libstdc_6.dll_operator_delete___void_
mov eax, esi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, 0xffffffff
jmp 0x44b2e6
Function at 0x456fd0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 4
movzx ecx, byte [edx + edi*4]
mov byte [eax + edi*4], cl
movzx ecx, byte [edx + edi*4 + 1]
mov byte [eax + edi*4 + 1], cl
movzx ecx, byte [edx + edi*4 + 2]
mov byte [eax + edi*4 + 2], cl
movzx ecx, byte [edx + edi*4 + 3]
mov byte [eax + edi*4 + 3], cl
add edi, 1
cmp edi, 4
jne 0x456fd9
add eax, 0xc
lea esi, [esi]
lea edi, [edi]
movzx edx, byte [eax + 3]
test edi, 3
movzx esi, byte [eax]
movzx ebx, byte [eax + 1]
movzx ecx, byte [eax + 2]
mov byte [esp + 3], dl
jne 0x45705e
movzx ebp, byte [ebx + 0x484d00]
movzx ebx, byte [ecx + 0x484d00]
movzx ecx, byte [edx + 0x484d00]
mov edx, esi
movzx esi, dl
movzx edx, byte [esi + 0x484d00]
mov esi, edi
shr esi, 2
movzx esi, byte [esi + 0x484bc0]
mov byte [esp + 3], dl
xor esi, ebp
movzx edx, byte [eax - 0xc]
xor bl, byte [eax - 0xb]
add edi, 1
xor cl, byte [eax - 0xa]
add eax, 4
xor esi, edx
mov byte [eax + 1], bl
mov edx, esi
mov byte [eax + 2], cl
mov byte [eax], dl
movzx edx, byte [esp + 3]
xor dl, byte [eax - 0xd]
mov byte [eax + 3], dl
cmp edi, 0x2c
jne 0x457010
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4577c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
lea eax, [esi + 0xb0]
test edi, edi
mov ebx, ebp
mov dword [esp], eax
je 0x45780d
xor ecx, ecx
movzx edx, byte [eax + ecx]
xor byte [ebx + ecx], dl
add ecx, 1
cmp ecx, 0x10
jne 0x4577e4
mov edx, esi
mov eax, ebx
call fcn.004570a0
lea edx, [ebx + 0x10]
mov eax, ebx
mov ecx, edx
sub ecx, ebp
cmp edi, ecx
jbe 0x45780f
mov ebx, edx
jmp 0x4577e2
mov ebx, eax
mov eax, dword [ebx]
mov edi, dword [esp]
mov dword [esi + 0xb0], eax
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x457840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
test edi, edi
lea esi, [ebp + 0xb0]
je 0x4578c8
lea esi, [esi]
mov eax, dword [ebx]
mov edx, ebp
mov dword [esp], eax
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
mov eax, ebx
call fcn.00457320
xor eax, eax
movzx edx, byte [esi + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x457885
mov eax, dword [esp]
add ebx, 0x10
mov dword [ebp + 0xb0], eax
mov eax, dword [esp + 4]
mov dword [ebp + 0xb4], eax
mov eax, dword [esp + 8]
mov dword [ebp + 0xb8], eax
mov eax, dword [esp + 0xc]
mov dword [ebp + 0xbc], eax
mov eax, ebx
sub eax, dword [esp + 0x28]
cmp edi, eax
ja 0x457860
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret