joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b08d4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b0ace
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x4b0ae0
push 0x4b0af4
call sub.user32.dll_FindWindowA
mov edi, eax
cmp byte [ebp - 9], 0
je 0x4b0aa6
test edi, edi
je 0x4b0aa6
call fcn.004b0670
test eax, eax
jne 0x4b0aa6
push 0x4b0b08
mov al, byte [0x4b0b0c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea edx, [ebp - 0x70]
xor eax, eax
call fcn.00402ff8
mov eax, dword [ebp - 0x70]
xor ecx, ecx
mov edx, 0x4b0b08
call fcn.0040ef54
push dword [ebp - 0x6c]
push 0x4b0b08
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404f34
call fcn.00402f90
mov ebx, eax
test ebx, ebx
jle 0x4b09d4
mov esi, 1
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00402ff8
mov edx, dword [ebp - 0x14]
mov eax, 0x4b0b18
call fcn.004051b8
test eax, eax
jne 0x4b09d0
mov edx, dword [ebp - 0x14]
mov eax, 0x4b0b24
call fcn.004051b8
test eax, eax
jne 0x4b09d0
push dword [ebp - 0x10]
push 0x4b0b30
push dword [ebp - 0x14]
push 0x4b0b08
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404f34
inc esi
dec ebx
jne 0x4b0987
push dword [ebp - 0x10]
push 0x4b0b3c
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
call fcn.004098e4
push dword [ebp - 0x74]
push 0x4b0b08
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404f34
cmp dword [ebp - 8], 0x270f
je 0x4b0a2d
push dword [ebp - 0x10]
push 0x4b0b4c
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 8]
call fcn.004098e4
push dword [ebp - 0x78]
push 0x4b0b08
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404f34
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.00407ebc
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 4
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x40
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00405074
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4b0aa6
push 0
mov eax, dword [ebp - 0x60]
push eax
push 0x52d
push edi
call sub.user32.dll_SendMessageA
cmp byte [ebp - 9], 0
je 0x4b0a94
mov eax, dword [ebp - 0x60]
call fcn.004b05a4
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0ad5
lea eax, [ebp - 0x78]
mov edx, 4
call fcn.00404bd8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404bd8
ret
Function at 0x4b0d20
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x102c], ebx
mov dword [ebp - 0x1028], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00405064
mov eax, dword [ebp - 8]
call fcn.00405064
xor eax, eax
push ebp
push 0x4b0f5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b0ef4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.004b111c
test al, al
jne 0x4b0dac
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004b0fa8
test al, al
jne 0x4b0db7
mov ebx, 0xffffff9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0f2a
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404c4c
mov word [ebp - 0x24], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x14]
call fcn.00405074
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x20], eax
push 0xea60
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, dword [ebp - 0x14]
call fcn.004b123c
test eax, eax
je 0x4b0e0d
mov ebx, 2
mov eax, dword [ebp + 8]
mov edx, 0x4b0f78
call fcn.00404c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0f2a
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00405074
mov dword [ebp - 0x10], eax
cmp edi, esi
jle 0x4b0e7d
lea eax, [ebp - 0x1024]
xor ecx, ecx
mov edx, 0x1001
call fcn.0040362c
mov eax, edi
sub eax, esi
cmp eax, 0x1000
jle 0x4b0e42
mov ebx, 0x1000
jmp 0x4b0e46
mov ebx, edi
sub ebx, esi
lea eax, [ebp - 0x1024]
mov ecx, ebx
mov edx, dword [ebp - 0x10]
call fcn.00407eb4
push 0
lea eax, [ebp - 0x1024]
call fcn.0040a224
push eax
lea eax, [ebp - 0x1024]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_send
add dword [ebp - 0x10], ebx
add esi, ebx
cmp edi, esi
jg 0x4b0e1e
mov eax, dword [ebp + 8]
call fcn.00404bb4
lea eax, [ebp - 0x1024]
xor ecx, ecx
mov edx, 0x1000
call fcn.0040362c
push 0
push 0x1000
lea eax, [ebp - 0x1024]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x4b0edb
lea eax, [ebp - 0x1028]
lea edx, [ebp - 0x1024]
mov ecx, 0x1000
call fcn.00404e24
mov edx, dword [ebp - 0x1028]
mov eax, dword [ebp + 8]
call fcn.00404e7c
mov eax, dword [ebp + 8]
test ebx, ebx
jg 0x4b0e85
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0f2a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0f64
lea eax, [ebp - 0x102c]
mov edx, 2
call fcn.00404bd8
lea eax, [ebp - 0x14]
call fcn.00404bb4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404bd8
ret
Function at 0x4b0fa8
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405064
xor eax, eax
push ebp
push 0x4b10f8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4b10d0
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.0040a2bc
lea eax, [ebp - 0x110]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b10be
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4b10b8
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4b10b2
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x124], eax
mov byte [ebp - 0x120], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x118], 0
lea edx, [ebp - 0x134]
mov ecx, 3
mov eax, 0x4b1110
call fcn.0040a964
mov edx, dword [ebp - 0x114]
mov eax, ebx
call fcn.00404c08
mov byte [ebp - 5], 1
jmp 0x4b10c2
mov byte [ebp - 5], 0
jmp 0x4b10c2
mov byte [ebp - 5], 0
jmp 0x4b10c2
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b10d7
ret
Function at 0x4b123c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1354
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004b111c
test al, al
jne 0x4b1281
lea edx, [ebp - 4]
mov eax, esi
call fcn.004b0fa8
test al, al
jne 0x4b128b
mov ebx, 1
jmp 0x4b133e
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404c4c
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x4b12a7
mov ebx, 2
jmp 0x4b133e
mov word [ebp - 0x14], 2
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
call fcn.00405074
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x4b12e8
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_closesocket
mov ebx, 3
jmp 0x4b133e
push 4
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x4b1312
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_closesocket
mov ebx, 4
jmp 0x4b133e
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x4b133c
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_closesocket
mov ebx, 5
jmp 0x4b133e
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b135b
lea eax, [ebp - 4]
call fcn.00404bb4
ret

Function at 0x4b1368
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4b1381
mov al, 1
jmp 0x4b1383
xor eax, eax
add esp, 0x190
ret
Function at 0x4b1aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1c59
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
mov ecx, 0x104
xor edx, edx
call fcn.0040362c
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x4b1c33
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040a44c
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004b16c0
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 4]
call fcn.00404c4c
mov eax, dword [ebp - 4]
call fcn.00404e74
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4b1b41
lea eax, [ebp - 4]
mov edx, 0x4b1c70
call fcn.00404e7c
lea eax, [ebp - 4]
mov edx, dword [0x4bca8c]
call fcn.00404e7c
lea eax, [ebp - 0x209]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.0040362c
mov edx, 0x4b1c74
lea eax, [ebp - 0x209]
call fcn.0040a260
lea edx, [ebp - 0x214]
mov eax, ebx
call fcn.004098e4
mov eax, dword [ebp - 0x214]
call fcn.00405074
mov edx, eax
lea eax, [ebp - 0x209]
call fcn.0040a310
mov edx, 0x4b1c74
lea eax, [ebp - 0x209]
call fcn.0040a310
mov eax, dword [0x4bcaa8]
call fcn.00405074
mov edx, eax
lea eax, [ebp - 0x209]
call fcn.0040a310
mov edx, 0x4b1c74
lea eax, [ebp - 0x209]
call fcn.0040a310
lea eax, [ebp - 0x209]
call fcn.0040a224
mov esi, eax
xor eax, eax
push ebp
push 0x4b1c29
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41bb24]
call fcn.004203c4
mov ebx, eax
push 0
push 0
mov eax, ebx
call fcn.0041ff30
lea edx, [ebp - 0x209]
mov ecx, esi
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, ebx
call fcn.00403e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1c33
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1c60
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00404bd8
lea eax, [ebp - 4]
call fcn.00404bb4
ret
Function at 0x4b1c78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b1e74
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x11d]
mov ecx, 0x104
xor edx, edx
call fcn.0040362c
push 0x104
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x4b1e4e
lea edx, [ebp - 8]
lea eax, [ebp - 0x11d]
call fcn.0040a44c
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.004b16c0
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 8]
call fcn.00404c4c
mov eax, dword [ebp - 8]
call fcn.00404e74
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x4b1d28
lea eax, [ebp - 8]
mov edx, 0x4b1e90
call fcn.00404e7c
lea eax, [ebp - 8]
mov edx, dword [0x4bca8c]
call fcn.00404e7c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004b176c
test al, al
je 0x4b1e4e
call sub.kernel32.dll_GetTickCount_1
mov ecx, 0x3e8
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x4b1d74
cmp eax, dword [ebp - 0x10]
jae 0x4b1d7a
jmp 0x4b1e4e
jl 0x4b1e4e
xor eax, eax
push ebp
push 0x4b1e44
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b924]
call fcn.00403ddc
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4b1e33
mov dl, 1
mov eax, dword [0x4254f4]
call fcn.00425568
mov esi, eax
mov dl, 0x7c
mov eax, esi
call fcn.00425798
lea ecx, [ebp - 0x128]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x128]
mov eax, esi
call fcn.004257a8
cmp dword [esi + 0x10], 3
jl 0x4b1e2c
lea ecx, [ebp - 0x12c]
mov edx, 1
mov eax, esi
call fcn.00425720
mov eax, dword [ebp - 0x12c]
xor edx, edx
call fcn.00409a5c
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x130]
mov edx, 2
mov eax, esi
call fcn.00425720
mov edx, dword [ebp - 0x130]
mov eax, 0x4bcaa8
call fcn.00404c08
mov eax, esi
call fcn.00403e0c
mov eax, ebx
call fcn.00403e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1e4e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1e7b
lea eax, [ebp - 0x130]
mov edx, 4
call fcn.00404bd8
lea eax, [ebp - 8]
call fcn.00404bb4
ret

Function at 0x4b25f0
Capabilities:
Create thread

Disassembly:
push ecx
push esp
push 0
push 0
push 0x4b214c
push 0
push 0
call sub.kernel32.dll_CreateThread
test eax, eax
je 0x4b260e
push eax
call sub.kernel32.dll_CloseHandle_1
pop edx
ret
Function at 0x4b2618
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov byte [esp], dl
push eax
push 0
push 2
call dword [0x4bcab0]
mov esi, eax
test esi, esi
seta bl
test bl, bl
je 0x4b2659
cmp byte [esp], 0
jne 0x4b2645
push esi
call sub.kernel32.dll_SuspendThread
jmp 0x4b264b
push esi
call sub.kernel32.dll_ResumeThread
test edi, edi
je 0x4b2653
mov dword [edi], esi
jmp 0x4b2659
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4b46a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4bcf84]
mov eax, dword [eax]
call fcn.00443834
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, esi
imul eax, edi, 0x3e8
cmp ebx, eax
jbe 0x4b46b4
pop edi
pop esi
pop ebx
ret
Function at 0x4134ca
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0041367a
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4135c8
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x41356b
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4135ae
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x413582
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x41359d
test al, 0x40
je 0x413594
mov ecx, dword [edi + 0x20]
jmp 0x41359b
test al, 0x80
je 0x4135ae
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4135ae
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x41353a
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x489a10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x724758]
xor edx, edx
cmp eax, edx
jne 0x489a36
xor eax, eax
mov byte [eax + 0x724658], al
inc eax
cmp eax, 0x100
jl 0x489a1e
mov dword [0x724758], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x724658
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x489ac7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x489a9a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x489a68
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x489b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x489b93
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x489b7a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490e60
Capabilities:
Encode data using xor

Disassembly:
aaa
arpl bp, bp
dec eax
fcmovnb st(0), st(2)
mov ebx, 0xbd6cc1fa
inc esi
fnstsw word [ebx + 0x488ece41]
or dl, bl
aam 0x85
mov bl, 0x54
push edx
fcomp dword [eax + 0x45]
xchg dword [edx], ebx
and ebp, dword [edi]
mov ebx, 0x3791a454
stosb byte es:[edi], al
push esp
mov bh, 0xee
cmpsb byte [esi], byte es:[edi]
xor esp, dword [esp + eax*4]
jp 0x490eb8
push ds
in eax, dx
jo 0x490e5a
mov cl, 0xf6
mov ecx, 0x9b13db6e
inc ebp
or ebx, dword [edx*4 - 0x6ace4c09]
das
nop
in eax, dx
outsb dx, byte [esi]
lea edx, [ebx + 0x60]
push 0xffffffffffffffc2
xor eax, 0x3b06748d
dec ebp
add eax, 0xaee1012d
mov al, byte [0x33d21531]
sub al, 0x38
xor ebp, dword [eax + edi]
cmp byte [edi], bh
aas
xchg edi, eax
jge 0x490eb6
sbb dword [ebx - 0x63ac61e8], ebx
and dl, byte [ebp + eax*8 - 0x5a]
mov ss, word [ebp - 0x3c]
dec esi
movsb byte es:[edi], byte [esi]
jo 0x490e85
or ebp, ecx
push es
insd dword es:[edi], dx
mov cl, 0x7b
leave
invalid

Function at 0x53e2ea
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
mov cl, ah
sbb ebx, esp
sbb edx, edx
xor cl, byte [eax + 0xc]
jl 0x53e2ee
rol cl, 0xdf
ficom word [eax - 0x269c5a6c]
out dx, al
cld
sub eax, 0x579eb9b6
push ebx
and eax, 0x664cd06a
jl 0x53e2b5
xor bl, byte [ebx + 0x73]
and ebp, dword ds:[ebp - 0x3ea9ca2a]
rol byte [esi + eax*8], 1

Function at 0x5406d1
Capabilities:
Encode data using xor

Disassembly:
xor bh, byte [esi - 0x12]
out dx, al
out dx, al
out dx, al
xchg ebx, eax
popal
sub dword [esi + 0x60], 0xe267b01a
pop ds
jbe 0x5406cd
sbb dh, byte [edx + 0x5ba55569]
adc si, si
Function at 0x54071d
Capabilities:
Encode data using xor

Disassembly:
xor ebx, dword [edx + 0x2d]
xchg esi, eax
inc ecx
test al, 0xf6
je 0x5406e5
invalid
fcom dword [edx - 0x5e]
outsd dx, dword [esi]
sub edi, esi
lcall 0xc6ac, 0x58eb859f
sub al, 0x32
jge 0x5406b6
dec ebx
adc edx, dword [edi - 0x19]
lea eax, [ecx - 0x7b9aaf5b]
mov ebx, 0x23936b5a
push edi
out 0x8d, eax
and dword [ebp - 0x447b9ab0], 0x23936b5a
mov esi, 0xa0d2bc71
retf 0xf9e4
adc esi, esi
fild dword [esi - 0x579882f8]
imul edx, dword [ebp + 3], 0xffffff8f
jge 0x5406b8
cmp al, bh
sahf
and dword [eax + ebp*2], 0x68
test al, 0xc2
mov esi, eax
movsb byte es:[edi], byte [esi]
xchg ebx, eax
jnp 0x5406a4
xchg esi, eax
aas
mov ecx, 0x20c11fa6
fdiv dword [edx]
push es
fcomp dword [esi - 0x1d]
mov ebx, 0x9fbb1695
mov ebp, 0xe8911628
xor ecx, dword [esi + 0xae42d4a]
sub eax, 0x91bd0ae4
mov al, byte [0x16364a90]
dec esp
and bh, byte [esp + ebx*4]
jne 0x54070c
or bl, byte [ecx]
inc esp
outsb dx, byte [esi]
popal
jb 0x54078b
push ebx
jns 0x540738
jmp [esi - 0x44cd4263]
scasb al, byte es:[edi]
popfd
mov ebp, 0x3f61bb32
add eax, 0xc0ec51b3
push edi
test eax, 0xcd34142c
pop eax
xlatb
cdq
test eax, 0x29331b38
sub ebx, edx
movsb byte es:[edi], byte [esi]
in eax, dx
popfd
invalid
dec dword [ebx - 0x5bc7bf69]
js 0x5406e8
push ds
cwde
pop esi
xchg byte [edx + 0x7809dc7d], ch
cmp ecx, dword [edx + 0x7a9a7a61]
xor byte [esi], ah
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
arpl word [eax + 0x2d], bp
dec edi
inc ebp
push ds
pop ds
push esp
sbb eax, 0x937f71e5
jb 0x5407df
fnstenv [eax + edx]
cmc
adc ebx, dword [ecx - 0x2dd3de65]
mov ecx, 0xb9247ade
jp 0x5407b4
invalid
sar byte [ecx - 0x46db8522], cl
xchg byte [eax - 0x21], ch
pop es
xor byte [esi - 0x239e78fb], al
dec esi
add dl, byte [ebx - 0x16f99a58]
jae 0x5407fd
invalid
std
mov dh, 0x74
cmp eax, 0x75ab0eb4
push ds
fist dword [ecx]
pop ds
mov word [esi], cs
test ch, 0x76
mov eax, dword [0xdc87110d]
jnp 0x540857
adc cl, byte [edi - 0x423e6d21]
test byte [edi], ah
mov byte [ebx + 0xb16a8b8], ah
jmp 0x6368e540
mov cl, 0x10
xchg byte [esi + 0x7b], cl
std
xor byte [0xb1e463d6], bh
cwde
ret
Function at 0x541856
Capabilities:
Encode data using xor

Disassembly:
sti
in al, 0x28
aam 0xc9
adc byte [esi + 0x2e], dh
stosb byte es:[edi], al
dec edi
jae 0x5417af
mov cl, 0xca
or dword [ecx + 0x26], ebp
mov cl, 0x27
aas
mov dword [0x2f5fb788], eax
pop ebp
int 0x7c
fdivp st(6)
je 0x5417fe
inc ecx
lds esp, [edx + 0x48]
fadd qword [edi]
adc dword [eax - 0x44dccf42], eax
pop ds
pop edx
iretd
sar dword [ebx - 0x78], 1
pop esi
loopne 0x5417a1
fadd st(1), st(0)
invalid
pop es
xor al, 0xa
iretd
outsd dx, dword [esi]
fidiv dword [eax - 0x17]
cld
fsub qword [edx + edx*2]
mov dh, 0x2a
adc eax, dword [edx]
push 0xffffffffffffff94
cmpsd dword [esi], dword es:[edi]
popal
lodsd eax, dword [esi]
and byte [ebp + 0x22], dl
mov ah, 0xb3
adc dh, dl
salc
jl 0x5417f2
imul ecx, dword [edi - 0x56], 0x15
xor esp, edi
cwde
in al, dx
xor al, cl
sub al, 0x4a
adc edx, dword [ecx]
xor dword [edx + 0x3d], edx
pushfd
sahf
jno 0x5418e7
and ebp, eax
push edi
jl 0x54186d
mov dl, 0x2f
cmp al, byte [eax - 0x1b01347d]
xchg edi, eax
xchg ebx, eax
nop
xor eax, 0x2f87da23
push es
out 0x88, eax
lea esp, [edx]
adc dword [esi + edx*2], edi
mov dword [0x30f9c92c], esp
add bl, byte [ecx - 0x37b8958e]
sti
invalid
mov eax, 0x823465d7
clc
pop ebp
cmpsd dword [esi], dword es:[edi]
mov bl, 0x80
xchg dword [eax - 0x73a0b3e4], edx
fsub qword [edi]
daa
fmul qword [edx]
xor ch, byte [eax]
mov dl, 0x81
adc ah, dh
push ebp
loopne 0x5418d6
mov byte [0x5baecc8e], al
call 0x3585142
inc eax
mov al, 0x3a
sbb ch, byte [0x820e0481]
cmpsb byte [esi], byte es:[edi]
sti
scasd eax, dword es:[edi]
push 0xffffffffffffff9f
adc al, 0x84
push edi
and ch, byte [edi]
sub dword [esp + eax*2 - 0x193db2e6], esp
iretd