joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0c5f
Capabilities:
Encode data using xor

Disassembly:
pop ds
xor dword [ebx + 0x320af34c], ebx
add dword [edx + 0xc], ecx
sbb al, 0xbe
je 0x4a0be5
dec esp
in al, 0x57
sbb al, 0x78
mov ah, 0xfc
mov edi, 0x66f06ed5
jno 0x4a0c71
cmp dword [edx + 0x121ad103], 0x68
mov esi, 0x7f6936d8
invalid
loopne 0x4a0ccd
mov bl, 0xc5
lea ebx, [ecx + 0x7c51b47d]
jb 0x4a0c06
jle 0x4a0c35
mov ecx, 0x9547ed9e
inc edi
xchg ebp, eax
xchg byte [edx], bl
or al, 0x5b
salc
rcl byte [eax + 0x4d2cee41], cl
or al, 0x64
push edx
and eax, 0xa23aea15
cmp al, byte [edi]
lcall 0x793c, 0xe1a95cd2
leave
push esp
mov word [edi + 0x72], cs
sbb eax, 0x7ff8ffa1
sbb byte [edi + esi], ch
mov bl, 0x4a
dec esp
jae 0x4a0cdb
mul ah
mov bl, 0xa9
test al, 0xba
adc byte [edi - 0x4c3f982c], 0x7b
adc al, 0xbd
frstor dword [ebp + 0x222fb79b]
pop ds
xchg edi, eax
aam 0x67
sal byte [ebx - 0x2242eb85], 0xa5
wait
mov bh, 0x2f
and bl, byte [edi]
out dx, eax
mov ch, 0x6f
xor ch, dl
mov ah, byte [ebx + 0x25986345]
rol dword [esp + esi*8], 1
les esi, [eax - 0x6ad245b]
jg 0x4a0ca8
cmc
push esp
jno 0x4a0d39
dec esp
popfd
ljmp 0xb782
xor al, 0x9d
adc al, 0xf3
jmp 0x1c5e1d57
int 0x96
pushal
rol dword [edx - 0x7e], cl
mov cl, 0x22
imul ecx, dword [ebp + 0x32d94754], 0xffffff8e
invalid

Function at 0x60886b
Capabilities:
Encode data using xor

Disassembly:
daa
stc
pop ecx
cmp al, 0xe4
les ebx, [edx + 0x3c]
sub ecx, ebx
fchs
push cs
sbb edi, eax
cwde
pop ss
in al, dx
mov edi, 0xc98cb1f4
mov ecx, cs
xchg edx, eax
inc ebp
mov ecx, 0x47883120
aad 0xa
out 0xe9, al
xor al, ch
dec esi
mov dword [0x35f657f], eax
sbb al, 0xc5
mov byte [0xd2f6382f], al
loop 0x608876
xor dword [eax - 0x19f52ab9], ecx
jmp 0xa3af70b7
das
int 0x3c
invalid
invalid
Function at 0x6294a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632378
cmp edx, dword [eax]
je 0x6294c7
add eax, 8
inc ecx
cmp eax, 0x632408
jl 0x6294b8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x632378]
jne 0x6295f5
mov eax, dword [0x63bd00]
cmp eax, 1
je 0x6295cf
test eax, eax
jne 0x6294f8
cmp dword [0x6322a4], 1
je 0x6295cf
cmp edx, 0xfc
je 0x6295f5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62952f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629e90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a2c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629572
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a2c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ec1c
push edi
call fcn.0062be60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629e90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629ea0
lea eax, [ebp - 0xa0]
push 0x62ebfc
push eax
call fcn.00629ea0
push dword [esi + 0x63237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629ea0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062bdd4
add esp, 0x2c
pop edi
jmp 0x6295f5
lea eax, [ebp + 8]
lea esi, [esi + 0x63237c]
push 0
push eax
push dword [esi]
call fcn.0062a2c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x41712b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x435726
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.004171c5
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.0040d4f9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4196f4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x435aa2
call fcn.004339e0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.004028e9
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041974e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4196ff
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x435aa2
call fcn.004339e0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.004028e9
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041974e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4197a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x435aed
call fcn.004339e0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0042214a
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.004197f6
push dword [esi + 0x24]
call fcn.00401abd
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00418b2e
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00419d33
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41add3
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x435cee
call fcn.004339e0
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x43987c
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.004028e9
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.0041a6a2
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41adde
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x435cee
call fcn.004339e0
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x43987c
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.004028e9
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.0041a6a2
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41baeb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x435e42
call fcn.004339e0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 1
call fcn.00418b2e
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0041c873
push dword [esi + 0xc]
call fcn.00401abd
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4281f2
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x436de3
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43a908
mov dword [esi + 4], 0x43a8f4
mov dword [esi + 8], 0x438e70
mov dword [esi + 0xc], 0x43a8d8
mov dword [esi + 0x10], 0x43a8c4
mov dword [esi + 0x14], 0x43a8b4
mov dword [esi + 0x18], 0x438e60
mov dword [esi + 0x1c], 0x438e50
mov dword [esi + 0x20], 0x43a8ac
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.004028e9
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004028e9
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
or dword [esi + 0x9c], 0xffffffff
mov byte [ebp - 4], 7
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa0], ebx
mov byte [esi + 0xa4], bl
mov byte [esi + 0xa5], bl
mov byte [esi + 0xa6], bl
mov byte [esi + 0xa7], bl
mov byte [esi + 0xa8], bl
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], bl
mov dword [esi + 0xac], ebx
mov dword [esi], 0x43a880
mov dword [esi + 4], 0x43a86c
mov dword [esi + 8], 0x43a854
mov dword [esi + 0xc], 0x43a838
mov dword [esi + 0x10], 0x43a824
mov dword [esi + 0x14], 0x43a814
mov dword [esi + 0x18], 0x43a804
mov dword [esi + 0x1c], 0x43a7f4
mov dword [esi + 0x20], 0x43a7ec
call fcn.0040d4f9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x28], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42fb7d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44b769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x44f190
cmp edx, dword [eax]
je 0x44b78b
add eax, 8
inc ecx
cmp eax, 0x44f220
jl 0x44b77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x44f190]
jne 0x44b8b9
mov eax, dword [0x44fbb0]
cmp eax, 1
je 0x44b893
test eax, eax
jne 0x44b7bc
cmp dword [0x44f0e4], 1
je 0x44b893
cmp edx, 0xfc
je 0x44b8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44b7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0044c670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0044c490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x44b836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0044c490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x44e45c
push edi
call fcn.0044cf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0044c670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0044c680
lea eax, [ebp - 0xa0]
push 0x44e43c
push eax
call fcn.0044c680
push dword [esi + 0x44f194]
lea eax, [ebp - 0xa0]
push eax
jmp 0x454714
lea eax, [ebp + 8]
lea esi, [esi + 0x44f194]
push 0
push eax
push dword [esi]
call fcn.0044c490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474004]
jne 0x40100a
repz ret
jmp fcn.004018f4

Function at 0x4067a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040261d
and dword [ebp - 4], 0
cmp dword [0x475cdc], 0
mov ebx, eax
jne 0x406859
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40690a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40690a
push eax
call fcn.004025ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x475cdc], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x475ce0], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x475ce4], eax
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x475cec], eax
test eax, eax
je 0x406859
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x475ce8], eax
mov eax, dword [0x475ce8]
cmp eax, ebx
je 0x4068b1
cmp dword [0x475cec], ebx
je 0x4068b1
push eax
call fcn.00402626
push dword [0x475cec]
mov esi, eax
call fcn.00402626
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4068b1
test edi, edi
je 0x4068b1
call esi
test eax, eax
je 0x4068a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4068a8
test byte [ebp - 0xc], 1
jne 0x4068b1
or dword [ebp + 0x10], 0x200000
jmp 0x4068ea
mov eax, dword [0x475ce0]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4068ea
mov eax, dword [0x475ce4]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x475cdc]
call fcn.00402626
pop ecx
test eax, eax
je 0x40690a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40690c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x470670
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp edi, 0x19f
jne 0x47068b
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
test edi, edi
jle 0x4706d2
lea ecx, [esp + 8]
mov dword [esp], 5
mov dword [esp + 8], 0
call fcn.00470660
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp], eax
sub dword [esp], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor dword [esp + 4], eax
mov cl, byte [esp + 4]
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x470691
cmp edi, 0x2d
jne 0x4706eb
mov dword [0x2b73ef8], 0xa62e7790
mov dword [0x2b73efc], 0xffffffff
add esp, 0xc
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x3bb477f5
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xf13e81
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4115e3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x429e01
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x43637c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xc]
add esi, 4
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
mov ebx, 0x42ea84
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
call fcn.004010c3
mov dword [esp + 0x14], eax
and dword [esp + 0x38], 0
xor bl, bl
mov ecx, dword [esp + 0x24]
xor al, al
cmp dword [esp + 0x20], ecx
je 0x411649
inc al
cmp esi, esi
je 0x41164f
mov al, 1
test al, al
je 0x4116b9
lea esi, [esp + 0x18]
mov eax, ecx
call fcn.004119fa
mov edi, eax
lea esi, [esp + 0x14]
mov byte [esp + 0x38], 1
call fcn.00405117
mov byte [esp + 0x38], 0
cmp dword [esp + 0x18], 0
je 0x411684
push dword [esp + 0x18]
call fcn.00412f89
pop ecx
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 8]
call fcn.00411330
test al, al
je 0x4116a6
mov esi, dword [esp + 0x24]
mov edi, dword [ebp + 0xc]
add esi, 4
call fcn.00405117
mov bl, 1
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 8]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
test bl, bl
je 0x41163b
test bl, bl
jne 0x4116f9
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
push ecx
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004010c3
mov dword [edi], eax
mov eax, dword [ebp + 8]
push ecx
mov byte [esp + 0x40], 2
mov ebx, dword [eax]
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004010c3
mov dword [edi], eax
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov byte [esp + 0x44], 0
call fcn.004118a5
cmp dword [esp + 0x14], 0
je 0x41170a
push dword [esp + 0x14]
call fcn.00412f89
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x412c50
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43637c]
jne 0x412c5a
repz ret
jmp fcn.00418cbc

Function at 0x415042
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 8], 1
add byte [eax], al
add byte [eax + 0xd], bh
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x34], 0xc
mov eax, 0x6c
mov ecx, 0xc
mov edx, 0x2aaaaaab
push ecx
mov ecx, eax
imul edx
sar edx, 1
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x54], 0x232d
mov dword [ebp - 0x44], 0x5a86b19a
mov eax, 0x1ef
mul dword [ebp - 0x54]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x798b
add dword [ebp - 0x1c], 0x7cc0
add dword [ebp - 0x1c], 0x293b5
mov dword [ebp - 0x48], 0x26fb
dec dword [ebp - 0x44]
add dword [ebp - 0x18], 0x12ff
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0xc]
sub eax, 0xf
Function at 0x415050
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 8], 1
add byte [eax], al
add byte [eax + 0xd], bh
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x34], 0xc
mov eax, 0x6c
mov ecx, 0xc
mov edx, 0x2aaaaaab
push ecx
mov ecx, eax
imul edx
sar edx, 1
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x54], 0x232d
mov dword [ebp - 0x44], 0x5a86b19a
mov eax, 0x1ef
mul dword [ebp - 0x54]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x798b
add dword [ebp - 0x1c], 0x7cc0
add dword [ebp - 0x1c], 0x293b5
mov dword [ebp - 0x48], 0x26fb
dec dword [ebp - 0x44]
add dword [ebp - 0x18], 0x12ff
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0xc]
sub eax, 0xf

Function at 0x4150db
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x18], eax

Function at 0x415127
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov al, byte [edx + eax]
mov byte [ebp - 0x1d], al
movzx eax, byte [ebp - 0x1d]
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x58]
and edx, 0xff
xor eax, edx
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov cl, byte [ebp - 0x1d]
mov byte [edx + eax], cl
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
in al, 3
inc ebp
invalid
cmp dword [ebp - 0x24], eax

Function at 0x415159
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
in al, 3
inc ebp
mov eax, 0x72dc4539
jb fcn.00415127