joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4acd70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
dec ecx
jne 0x4acd80
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi]
lea esi, [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
dec edi
jne 0x4acdc0
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x4ace30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
lea esp, [esp]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
dec esi
jne 0x4ace40
pop esi
ret
Function at 0x4ba74c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push edi
mov edi, ecx
push edi
mov ecx, dword [edi + 0x18]
call fcn.0049f510
mov ecx, dword [edi + 0x18]
mov esi, dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QTabWidget::setCurrentIndex_int_]
push 2
mov ecx, dword [ecx + 0xc]
call esi
mov ecx, dword [edi + 0x18]
push 1
mov ecx, dword [ecx + 0xc]
call esi
mov ecx, dword [edi + 0x18]
push 0
mov ecx, dword [ecx + 0xc]
call esi
mov ecx, dword [edi + 0x18]
push dword [edi + 0x20]
mov ecx, dword [ecx + 8]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QListWidget::setCurrentRow_int_]
pop edi
pop esi
ret
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4ba7e1
mov eax, dword [ebp + 0x10]
cmp eax, 0xb
ja case.default.0x4ba70a
jmp dword [eax*4 + 0x4ba80c]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.004ba5e0
mov ecx, dword [ebp + 8]
pop ebp
jmp 0x49dfa0
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, esp
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
call fcn.0049df90
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.004a3020
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0049e6d0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.0049f430
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.0049f500
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.0049ef30
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.0049f070
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.0049f2f0
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.0049f1b0
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
call fcn.0049e510
pop ebp
ret
cmp eax, 0xa
jne case.default.0x4ba70a
mov eax, dword [ebp + 0x14]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [eax]
cmp ecx, fcn.004ba5e0
jne case.default.0x4ba70a
test ecx, ecx
je 0x4ba802
cmp dword [eax + 4], 0
jne case.default.0x4ba70a
mov dword [edx], 0
pop ebp
ret
Function at 0x4dc760
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
cld
dec eax
neg esi
sub esi, dword [0x5c3ec8]
inc esi
mov dword [0x5c3ea0], edx
mov dword [0x5c3d98], 0xb7cd899
sub ebx, dword [0x5c3f1a]
xor ebx, edx
not esi
xchg ecx, esi
ror eax, 1
mov dword [0x5c3e42], esi
xor ecx, edi
ror eax, 0xb
add ecx, ebx
sub ecx, ebx
rol eax, 0xb
xor ecx, edi
sub dword [0x5c3e93], ebx
rol eax, 1
xchg ecx, esi
not esi
xor ebx, edx
mov dword [0x5c3dc7], edi
cmp eax, 0xf74e005c
fiadd word [eax + 0x33]
cld

Function at 0x4dc7b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
cmp eax, 0xf74e005c
fiadd word [eax + 0x33]
cld
rol eax, 0x1c
xor edi, esi
call 0x4dc7c3
ror eax, 0x13
xor dword [0x5c3e3c], ebx
xor dword [0x5c3e9e], ecx
mov dword [0x5c3ddc], ecx
mov dword [0x5c3e42], edi
neg eax
xchg esi, eax
sub dword [0x5c3dce], edi
inc edx
mov dword [0x5c3e2a], 0x98ec98c
rol esi, 7
xor edi, dword [0x5c3edd]
ror esi, 7
or dword [0x5c3e24], 0x12b1b443
dec edx
and dword [0x5c3db5], ecx

Function at 0x4dc810
Capabilities:
Hash data using murmur3

Disassembly:
xchg esi, eax
neg eax
or dword [0x5c3e64], ecx
xor dword [0x5c3d96], ecx
rol eax, 0x13
pop edx
neg esi
mov dword [0x5c3d9a], esi
ror esi, 0x1a
not edx
mov dword [0x5c3e71], ebx
dec ebx
sub edi, dword [0x5c3f06]
dec esi
xor ecx, dword [0x5c3f3e]
sub eax, ecx
dec eax
xor eax, esp
rol esi, 0x1d
xor esi, eax
or dword [0x5c3e0e], 0x30e8104d
or eax, 0x5c3e0e
dec ebp
adc al, ch
xor byte [ebx], ch
xor eax, 0x5c3fb0
add eax, 0x32caddca
sub esi, eax
add esi, eax
sub eax, 0x32caddca
xor esi, eax
ror esi, 0x1d
xor eax, esp
inc eax
add eax, ecx
inc esi
inc ebx
xor dword [0x5c3eb6], ecx
not edx
rol esi, 0x1a
sub dword [0x5c3dc6], esi
neg esi
add edx, 0x6b1

Function at 0x4dc850
Capabilities:
Hash data using murmur3

Disassembly:
xchg esi, eax
neg eax
or dword [0x5c3e64], ecx
xor dword [0x5c3d96], ecx
rol eax, 0x13
pop edx
neg esi
mov dword [0x5c3d9a], esi
ror esi, 0x1a
not edx
mov dword [0x5c3e71], ebx
dec ebx
sub edi, dword [0x5c3f06]
dec esi
xor ecx, dword [0x5c3f3e]
sub eax, ecx
dec eax
xor eax, esp
rol esi, 0x1d
xor esi, eax
or dword [0x5c3e0e], 0x30e8104d
or eax, 0x5c3e0e
dec ebp
adc al, ch
xor byte [ebx], ch
xor eax, 0x5c3fb0
add eax, 0x32caddca
sub esi, eax
add esi, eax
sub eax, 0x32caddca
xor esi, eax
ror esi, 0x1d
xor eax, esp
inc eax
add eax, ecx
inc esi
inc ebx
xor dword [0x5c3eb6], ecx
not edx
rol esi, 0x1a
sub dword [0x5c3dc6], esi
neg esi
add edx, 0x6b1

Function at 0x4dc8c0
Capabilities:
Hash data using murmur3

Disassembly:
aas
pop esp
add byte [ebx], al
sbb eax, 0x5c3f50
Function at 0x4dc940
Capabilities:
Hash data using murmur3

Disassembly:
sbb eax, 0x5c3de0
and ah, bl
xor ebx, edx
jns 0x4dced2
in al, dx
adc esp, ebx
setbe dh
and ecx, dword [ebp - 0xe]
das
arpl si, cx
leave
dec ebp
pop eax
bound esi, qword [ecx + 0x145a463b]
sub dword [esi], edx
pop ebp
pop ecx
cmp dword [edi + 0x5c], eax
pop eax
jbe 0x4dce28
cmp byte [edi + 0x2ff10223], cl
push edi
into
mov cl, 0x29
fcom qword [ebx]
push edi
std
xchg ebx, eax
mov dl, 0x47
xchg esp, eax
test al, 0x6e
in al, 0x67
popfd
xor byte [esi + 0x44], dh
test al, 0x40
sbb eax, 0xc6970617
or eax, 0x1fae47f5
into
jae 0x4dceef
fadd qword [edi]
and byte [ebx - 0x30], 0x5b
pop ebx
invalid
Function at 0x4dca10
Capabilities:
Hash data using murmur3

Disassembly:
or dword [0x5c3dbe], 0x1761f43a
add edx, dword [0x5c3f6e]
xor eax, esi
add esi, eax
sub ecx, 0x18c3725
xor edi, dword [0x5c3eed]
ror eax, 8
dec eax
ror eax, 0xb
neg esi
xor edi, dword [0x5c3f87]
aas
pop esp
add byte [ebx], al
sbb eax, 0x5c3f50
xor edx, eax
rol ebx, 0xe
sub edi, dword [0x5c3f9c]
mov dword [0x5c3ea2], edi
sub ecx, dword [0x5c3f50]
ror esi, 0x15
sub ecx, dword [0x5c3fd0]
ror esi, 0xf
rol esi, 0xf
rol esi, 0x15
or dword [0x5c3e0e], esi
ror ebx, 0xe
xor edx, eax
neg esi
rol eax, 0xb
ror byte [ebx], 0x40
rol eax, 8
add ecx, 0x18c3725
sub esi, eax
xor eax, esi
mov dword [0x5c3e80], 0x1003ba14
xor dword [edx], 0x77a2888a
sub edx, dword [0x5c3fa0]
neg eax
or dword [0x5c3e38], edx
sub edx, eax
dec edx
xchg edx, eax
neg eax
xor ebx, 0x917b8b8
add edi, ebp
not eax
mov dword [0x5c3de0], ebx
sbb eax, 0x5c3de0
xor esi, eax
ror edx, 0x1d
xor esi, edx
dec esi
neg edx
xor edx, 0x3424f726
xor ebx, esp
ror ebx, 5
rol ebx, 5
xor ebx, esp
xor edx, 0x3424f726
neg edx
inc esi
xor esi, edx
rol edx, 0x1d
xor esi, eax
mov dword [0x5c3dbc], ecx
not eax
sub edi, ebp
xor ebx, 0x917b8b8
neg eax
xchg edx, eax
inc edx
add edx, eax
neg eax
add dword [edx], 0x77a2888a
add edx, 0x25721a3
xor edi, dword [0x5c3f84]
or dword [0x5c3eaa], esi
neg eax
inc edx
sub edx, dword [0x5c3f30]
add ebx, esi
mov dword [0x5c3e87], esi
or dword [0x5c3e58], edi
sub esi, eax
add esi, eax
or dword [0x5c3d90], esi
add byte [ecx + 0x5c3d9c3d], cl
add byte [ebx], ch
fimul word [edx - 9]
fadd dword [ecx + 0x5721a3ea]
add dh, bh
adc al, byte [ecx + 0x5c3d942d]
add byte [ebp + edi*8 + 0x37], bl
or bh, dh
fidiv word [ebx]
ror byte [ecx + 0x5c3e683d], 1
add byte [ecx - 0x4f38e711], al
and byte [ebx], al
enter 0xffffffffffffc2c1, 0x19
neg ecx
inc ecx
xor esi, 0x1ccec38
add edi, 0x8e6fac0
xchg esi, esi
or dword [0x5c3e62], 0xd13792a
mov dword [0x5c3dfa], edi
cli
cmp eax, 0xd833005c
add ebx, edi
inc edx
not ecx
xor dword [0x5c3e98], 0xc565e0
xor eax, 0x7ca85e0
sub ebx, dword [0x5c3f0f]
xor edi, dword [0x5c3fda]
xor eax, 0x7ca85e0
mov dword [0x5c3e00], 0x199146
not ecx
dec edx
sub ebx, edi
xor ebx, eax
mov dword [0x5c3de8], 0xdbb05c6
xchg esi, esi
sub edi, 0x8e6fac0
xor esi, 0x1ccec38
dec ecx
neg ecx
ror edx, 0x19
sub ecx, eax
add edi, 0x20b0c718
mov dword [0x5c3e80], esi
xor edx, eax
neg esi
mov dword [0x5c3e9c], 0x41bb796
xor dword [edx], 0x77a2888a
ror edx, 0x1b
xchg esi, eax
sub dword [0x5c3e14], edi
rol edx, 0x12
neg eax
xor edx, edi
neg edx
xchg eax, edx
mov dword [0x5c3e5c], ebx
neg eax
xor edx, dword [0x5c3ed8]
neg esi
inc esi
xor edi, dword [0x5c3ee2]
add dword [0x5c3df5], ecx
neg edx
rol eax, 9
xchg esi, esi
ror eax, 0xe
rol eax, 0xe
xchg esi, esi
mov dword [0x5c3dc4], 0x5304f1c
neg esi
mov dword [0x5c3dfb], ecx
pop esp
add byte [eax + 0x29], cl
sbb eax, 0x5c3e2c
not eax
neg esi
ror ebx, 0xd
add ebx, eax
mov dword [0x5c3e74], edi
not esi
add edx, 4
not esi
sub esi, dword [0x5c3ee4]
xor esi, esp
ror edx, 0x17
inc edx
xor esi, eax
mov dword [0x5c3eb1], ecx
ror eax, 0x10
or dword [0x5c3ea8], ecx
xor ecx, dword [0x5c3f11]
xor dword [0x5c3e43], ecx
rol eax, 0x10
invalid
invalid
nop
invalid
pop esp
Function at 0x4dcad0
Capabilities:
Hash data using murmur3

Disassembly:
ror eax, 9
neg edx
xor dword [0x5c3dea], edx
dec esi
neg esi
neg eax
mov dword [0x5c3dd8], edx
xchg eax, edx
neg edx
xor edx, edi
neg eax
ror edx, 0x12
or dword [0x5c3df8], ecx
xchg esi, eax
rol edx, 0x1b
not dword [edx]
sub esi, 0x2f57e305
xor edx, dword [0x5c3ef2]
or dword [0x5c3dc8], edi
neg esi
rol ecx, 0xd
add ecx, dword [0x5c3fbc]
add ebx, dword [0x5c3f98]
and dword [0x5c3e04], ebx
rol esi, 0x16
not eax
not eax
ror esi, 0x16
add dword [0x5c3e7e], esi
ror ecx, 0xd
neg esi
xor dword [0x5c3dc4], ecx
add esi, 0x2f57e305
xor dword [edx], 0x77a2888a
sub ebx, dword [0x5c3ed9]
xor ecx, esi
xor esi, dword [0x5c3fb0]
mov dword [0x5c3dc8], ecx
add ecx, dword [0x5c3f78]
ror edi, 0xe
or dword [0x5c3e50], edx
xor ebx, esp
xor ecx, dword [0x5c3f20]
dec esi
sub dword [0x5c3eb6], esi
inc esi
not edx
rol esi, 0xf
xchg esi, eax
or dword [0x5c3e86], edx
xor esi, eax

Function at 0x4dcb90
Capabilities:
Hash data using murmur3

Disassembly:
sub ebx, eax
inc eax
dec eax
add ebx, eax
xor esi, eax
mov dword [0x5c3e12], ecx
xchg esi, eax
ror esi, 0xf
not edx
dec esi
inc esi
xor ebx, esp
rol edi, 0xe
xor ecx, esi
add dword [edx], 0x77a2888a
sub edi, dword [0x5c3fce]
ror eax, 0x1c
xor esi, edi
rol ebx, 0x19
xor dword [0x5c3e14], ecx
neg ebx
sub edi, dword [0x5c3ee0]
neg esi
mov dword [0x5c3d92], 0x1252036e
inc eax
neg esi
rol eax, 0x17
xchg ebx, edx
inc edx
xor eax, esp
dec esi
xor edx, esp
xchg esi, eax
not edx
rol eax, 2
ror eax, 2
not edx
xchg esi, eax
xor edx, esp
inc esi
xor eax, esp
dec edx
xchg ebx, edx
ror eax, 0x17
neg esi
dec eax
sub dword [0x5c3e66], 0x1fcb6a8c
neg esi
neg ebx
mov dword [0x5c3df2], ecx
ror ebx, 0x19
xor esi, edi
rol eax, 0x1c
xor dword [edx], 0x77a2888a
xor eax, 0x57c7593
dec eax
ror esi, 0xb
mov dword [0x5c3dba], 0x225cb12
xor edx, ebx
neg edx
xor ebx, ebp
dec esi
or dword [0x5c3e06], ecx
add ebx, esp
not eax
sub dword [0x5c3e72], edi
sub esi, eax
neg ebx
ror ecx, 1
xor edi, esp
xor dword [0x5c3e06], esi
sub ecx, dword [0x5c3f03]
add esi, eax
inc eax
dec eax
sub esi, eax
xor edi, esp
rol ecx, 1
neg ebx
add esi, eax
mov dword [0x5c3e68], ebx
not eax
sub ebx, esp
mov dword [0x5c3dac], edi
inc esi
xor ebx, ebp
neg edx
xor edx, ebx
invalid
invalid
Function at 0x4dcd00
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, eax
xor esi, eax
add ecx, edi
xor dword [edx], 0x77a2888a
inc edi
not eax
sub esi, eax
lock xor dword [0x5c3de6], 0x1197feb8
mov dword [0x5c3dee], ecx
sub esi, 0x1bc1ebd
inc eax
ror edx, 0x1a
add esi, 0x10a53e84
xor ecx, dword [0x5c3f0a]
neg esi
xor eax, 0x14d8b44
not esi
or dword [0x5c3e96], ecx
not edx
xor esi, 0x1be2dae
add edi, esi
sub dword [0x5c3e8f], ebx
xor edx, dword [0x5c3ec8]
sub edi, esi
xor esi, 0x1be2dae
not edx
xor dword [0x5c3d96], ecx
not esi
xor eax, 0x14d8b44
neg esi
sub esi, 0x10a53e84
rol edx, 0x1a
dec eax
add esi, 0x1bc1ebd
mov dword [0x5c3e90], esi
add esi, eax
not eax
dec edi
sub dword [edx], 0x77a2888a
not esi
mov dword [0x5c3ea0], edx
or dword [0x5c3dc6], ebx
sub ebx, eax
rol ebx, 0xd
add edx, dword [0x5c3fda]
neg esi
sub edx, dword [0x5c3f80]
not eax
xor dword [0x5c3e54], ecx
xor edi, dword [0x5c3efa]
inc eax
mov dword [0x5c3e16], ecx
neg esi
mov dword [0x5c3dda], 0x57456fc
add esi, eax
xor dword [0x5c3ea4], 0x26048a18
mov dword [0x5c3e58], esi
dec esi
inc esi
mov dword [0x5c3e30], esi
sub dword [0x5c3e49], 0x22e0b934
sub esi, eax
Function at 0x4dd230
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x57af80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
push edi
mov edi, ecx
test ebx, ebx
jne 0x4dd26b
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 8
call fcn.004dd5c0
test eax, eax
je 0x4dd257
push esi
mov esi, dword [edi + 4]
test esi, esi
je 0x4dd355
cmp dword [ebp - 0x40c], 0
je 0x4dd29d
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp - 0x40c]
mov word [ecx], ax
push 0x400
lea eax, [ebp - 0x407]
mov byte [ebp - 0x408], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x408]
push 2
push 0
push 0
push 0x401
push eax
push dword [edi]
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x4dd36a
cmp word [esi], 0x17
jne 0x4dd355
push 0
push 0
push 6
call fcn.004dd5e0
add esp, 0xc
test al, al
jne 0x4dd355
movzx eax, byte [esi + 0x17]
push eax
movzx eax, byte [esi + 0x16]
push eax
movzx eax, byte [esi + 0x15]
push eax
movzx eax, byte [esi + 0x14]
push eax
movzx eax, byte [esi + 0x13]
push eax
movzx eax, byte [esi + 0x12]
push eax
movzx eax, byte [esi + 0x11]
push eax
movzx eax, byte [esi + 0x10]
push eax
movzx eax, byte [esi + 0xf]
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
push str._02X_02X:_02X_02X:_02X_02X:_02X_02X:_02X_02X:_02X_02X:_02X_02X:_02X_02X
push ebx
call fcn.004dd180
add esp, 0x48
jmp 0x4dd378
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004df262
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x408]
mov ecx, ebx
push eax
call fcn.004ddaf0
mov ecx, dword [ebp - 4]
neg eax
pop esi
sbb eax, eax
xor ecx, ebp
pop edi
neg eax
pop ebx
call fcn.004df262
mov esp, ebp
pop ebp
ret 8
Function at 0x4e0470
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x4e049b
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
push ebx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004defbe
mov edx, dword [ebp - 4]
add esp, 4
mov dword [ebp - 8], 0
mov ebx, eax
mov dword [ebp - 0x14], ebx
test edx, edx
jle 0x4e0538
mov ecx, esi
mov dword [ebp - 0xc], ebx
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub ecx, ebx
mov dword [ebp - 0x10], ecx
lea ecx, [ecx]
mov ebx, dword [ecx + eax]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call esi
mov esi, eax
push esi
call fcn.004defbe
add esp, 4
mov edi, eax
push 0
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
mov dword [eax], edi
add eax, 4
mov edx, dword [ebp - 4]
cmp ecx, edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jl 0x4e04e0
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
push esi
mov dword [ebx + edx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push dword [ebp - 4]
call fcn.00499f00
xor esi, esi
add esp, 8
mov edi, eax
cmp dword [ebp - 4], esi
jle 0x4e0576
jmp 0x4e0560
mov ecx, dword [ebx + esi*4]
test ecx, ecx
je 0x4e0576
push ecx
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
inc esi
add esp, 4
cmp esi, dword [ebp - 4]
jl 0x4e0560
push ebx
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401070
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x5c6b7
mov dword [ebp - 4], 0xf8c9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4010e8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0x4010c1
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0x4010c1
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
lea eax, [eax + edx + 0x20]
mov dword [ebp - 0xc], eax
jmp 0x4010d3
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x40108b
mov eax, dword [ebp - 0xc]
and eax, 0x7fffffff
mov esp, ebp
pop ebp
ret

Function at 0x401100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
jmp 0x401136
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x401194
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
call fcn.00401070
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0x401192
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov cx, word [edx + eax*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0x401196
jmp 0x40112d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4011a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret
Function at 0x401670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push 0x214c6981
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x104
lea eax, [ebp - 0x2b8]
push eax
call dword [ebp - 0x1c]
push 0x1c368da0
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x158]
push ecx
call section..text
add esp, 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x144], 0x2e
mov byte [ebp - 0x143], 0x64
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x141], 0x6c
mov byte [ebp - 0x140], 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2b8]
push eax
call fcn.00401ab0
add esp, 8
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00401ab0
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00401ab0
add esp, 8
push 0x4e1e0843
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1a4], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea edx, [ebp - 0x2b8]
push edx
call dword [ebp - 0x1a4]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
je 0x4017c5
mov dword [ebp - 0x2bc], 0
push 0x7463a627
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x2c4], eax
push 0
lea eax, [ebp - 0x2bc]
push eax
push 0xd400
push section..data
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [ebp - 0x2c4]
push 0x70ebfb28
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x2c0], eax
mov edx, dword [ebp - 0x13c]
push edx
call dword [ebp - 0x2c0]
mov byte [ebp - 0x1b0], 0x60
mov byte [ebp - 0x1af], 0x47
mov byte [ebp - 0x1ae], 0x5c
mov byte [ebp - 0x1ad], 0x56
mov byte [ebp - 0x1ac], 0x5e
mov byte [ebp - 0x1ab], 0x5e
mov byte [ebp - 0x1aa], 1
mov byte [ebp - 0x1a9], 0
mov byte [ebp - 0x1a8], 0x12
mov byte [ebp - 0x1a7], 0x32
push 0x32
push 0xa
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.00401240
add esp, 0x10
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0
push 0x44
push 0
lea edx, [ebp - 0x1a0]
push edx
call fcn.00401220
add esp, 0xc
mov dword [ebp - 0x1a0], 0x44
push 0x10
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00401220
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00401ab0
add esp, 8
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00401aa0
add esp, 8
lea edx, [ebp - 0x2b8]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00401ab0
add esp, 8
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00401a10
add esp, 4
push 0xe621d6
call fcn.004011f0
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x1a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call dword [ebp - 4]
push 0xea60
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret