joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477c16
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0046cf20
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x477cb1
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x497af0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x477cb1
cmp eax, 1
je 0x477cd2
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x477cb1
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x477c7e
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x477cad
xor eax, eax
inc eax
jmp 0x477cf1
cmp edi, eax
jae 0x477cb5
xor eax, eax
jmp 0x477cf1
cmp eax, esi
jae 0x477cbc
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x497af0]
jmp 0x477cd5
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4794e8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x496300]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x496310]
je 0x47951d
inc eax
cmp eax, 0x13
jb 0x47950e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x496310]
jne 0x479643
mov eax, dword [0x497ae8]
cmp eax, 1
je 0x47961b
cmp eax, edx
jne 0x47954d
cmp dword [0x495b4c], 1
je 0x47961b
cmp ecx, 0xfc
je 0x479643
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x479583
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0046c610
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00471740
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4795b7
mov eax, edi
push eax
call fcn.00471740
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x48fec8
push edi
call fcn.0047bae0
add esp, 0x10
push edi
call fcn.00471740
push dword [esi + 0x496314]
mov ebx, eax
call fcn.00471740
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0046cf20
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0046c610
push edi
push ebx
call fcn.0046c620
push 0x48fea8
push ebx
call fcn.0046c620
push dword [esi + 0x496314]
push ebx
call fcn.0046c620
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0047d2f4
add esp, 0x2c
jmp 0x479643
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x496314]
push dword [esi]
call fcn.00471740
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0047a11b
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x479b0b
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x497ffc]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x479b54
call ebp
mov esi, eax
cmp esi, ebx
je 0x479b3a
mov dword [0x497ffc], 1
jmp 0x479b59
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x479b4f
push 2
pop eax
mov dword [0x497ffc], eax
jmp 0x479b54
mov eax, dword [0x497ffc]
cmp eax, 1
jne 0x479bb1
cmp esi, ebx
jne 0x479b6c
call ebp
mov esi, eax
cmp esi, ebx
jne 0x479b6c
xor eax, eax
jmp 0x479c58
cmp word [esi], bx
mov eax, esi
je 0x479b81
inc eax
inc eax
cmp word [eax], bx
jne 0x479b73
inc eax
inc eax
cmp word [eax], bx
jne 0x479b73
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.0046f179
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x479ba4
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x479c58
push ebp
push esi
push edi
call fcn.0046c720
add esp, 0xc
jmp 0x479b96
cmp eax, 2
je 0x479bba
cmp eax, ebx
jne 0x479b65
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x479b65
cmp byte [ebp], bl
mov esi, ebp
je 0x479bf0
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x479b65
push esi
add edi, eax
call fcn.00471740
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x479bcd
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.0046f179
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x479c69
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x479c4a
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x479c5f
push edi
call fcn.00471740
push esi
lea edi, [edi + eax + 1]
call fcn.0046f041
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x479c10
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.0046f057
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x479b65
Function at 0x479c75
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x498000]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x479cb5
call esi
test eax, eax
je 0x479c9a
mov dword [0x498000], 1
jmp 0x479cba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x479cb1
mov dword [0x498000], 2
jmp 0x479cc3
xor eax, eax
jmp 0x479d11
cmp eax, 1
jne 0x479cbe
call esi
jmp 0x479d11
cmp eax, 2
jne 0x479cb1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x479d09
lea eax, [esi + esi]
push eax
call fcn.0046f179
mov ebp, eax
test ebp, ebp
pop ecx
je 0x479d09
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x479d0d
push ebp
call fcn.0046f057
pop ecx
xor eax, eax
jmp 0x479d0f
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x47d2f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x49808c], ebx
push esi
push edi
jne 0x47d374
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x47d3af
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x491974
push edi
call esi
test eax, eax
mov dword [0x49808c], eax
je 0x47d3af
push 0x491964
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x498090], eax
call esi
cmp dword [0x497af0], 2
mov dword [0x498094], eax
jne 0x47d374
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x49809c], eax
je 0x47d374
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x498098], eax
mov eax, dword [0x498098]
test eax, eax
je 0x47d3b9
call eax
test eax, eax
je 0x47d3a0
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x49809c]
test eax, eax
je 0x47d3a0
test byte [ebp - 8], 1
jne 0x47d3b9
cmp dword [0x497afc], 4
jb 0x47d3b3
or byte [ebp + 0x12], 0x20
jmp 0x47d3d8
xor eax, eax
jmp 0x47d3e8
or byte [ebp + 0x12], 4
jmp 0x47d3d8
mov eax, dword [0x498090]
test eax, eax
je 0x47d3d8
call eax
mov ebx, eax
test ebx, ebx
je 0x47d3d8
mov eax, dword [0x498094]
test eax, eax
je 0x47d3d8
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x49808c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47e87c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x47ea50
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x4983a0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x47ea50
test cl, 0x48
je 0x47e8e7
cmp byte [eax + 5], 0xa
je 0x47e8e7
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47e939
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x47e921
call fcn.0047194d
mov dword [eax], 9
call fcn.00471956
mov dword [eax], esi
jmp 0x47e931
cmp eax, 0x6d
je 0x47ea50
push eax
call fcn.0047195f
pop ecx
or eax, 0xffffffff
jmp 0x47ea52
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x47ea4b
test eax, eax
je 0x47e960
cmp byte [ebx], 0xa
jne 0x47e960
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x47e969
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x47ea45
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x47ea35
cmp al, 0xd
je 0x47e99b
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x47ea27
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x47e9b5
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x47e9b0
add dword [ebp + 0x10], 2
jmp 0x47ea09
mov dword [ebp + 0x10], eax
jmp 0x47ea23
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47e9dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47ea23
cmp dword [ebp - 0xc], 0
je 0x47ea23
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x47e9fe
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x47ea09
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x47ea26
cmp ebx, dword [ebp + 0xc]
jne 0x47ea0e
cmp byte [ebp - 1], 0xa
jne 0x47ea0e
mov byte [ebx], 0xa
jmp 0x47ea26
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00479d9c
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x47ea27
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x47e97f
jmp 0x47ea45
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x47ea45
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x47ea52
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47f26f
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x47f288
or eax, 0xffffffff
jmp 0x47f2e9
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x47f2e5
push 0x3d
push esi
call fcn.0047f46f
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x47f2e5
cmp esi, eax
je 0x47f2e5
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x497b10]
sete cl
cmp eax, dword [0x497b14]
mov dword [ebp - 8], ecx
jne 0x47f2cb
mov edi, eax
call fcn.0047f20e
mov dword [0x497b10], eax
cmp eax, ebx
jne 0x47f324
cmp dword [ebp + 0xc], ebx
je 0x47f2ed
cmp dword [0x497b18], ebx
je 0x47f2ed
call fcn.0047e7ec
test eax, eax
je 0x47f324
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x47f2f6
xor eax, eax
jmp 0x47f2e8
push 4
call fcn.0046f179
cmp eax, ebx
pop ecx
mov dword [0x497b10], eax
je 0x47f2e5
mov dword [eax], ebx
cmp dword [0x497b18], ebx
jne 0x47f324
push 4
call fcn.0046f179
cmp eax, ebx
pop ecx
mov dword [0x497b18], eax
je 0x47f2e5
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x497b10]
call fcn.0047f1c1
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x47f385
cmp dword [esi], ebx
je 0x47f385
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0046f057
cmp dword [ebp - 8], ebx
pop ecx
jne 0x47f368
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x47f3c6
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x47f35f
mov eax, edi
shl eax, 2
push eax
push dword [0x497b10]
call fcn.0046f8f6
cmp eax, ebx
pop ecx
pop ecx
je 0x47f3c6
jmp 0x47f3c1
cmp dword [ebp - 8], ebx
jne 0x47f431
cmp edi, ebx
jge 0x47f394
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x497b10]
call fcn.0046f8f6
cmp eax, ebx
pop ecx
pop ecx
je 0x47f2e5
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x497b10], eax
cmp dword [ebp + 0xc], ebx
je 0x47f41b
push dword [ebp - 4]
call fcn.00471740
inc eax
inc eax
push eax
call fcn.0046f179
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x47f41b
push dword [ebp - 4]
push esi
call fcn.0046c610
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x47f414
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0046f057
pop ecx
cmp dword [ebp - 8], ebx
je 0x47f429
push dword [ebp - 4]
call fcn.0046f057
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x47f2e8
push dword [ebp - 4]
call fcn.0046f057
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x47f2f2
Function at 0x41b6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
sete dl
test eax, eax
sete dh
or dh, dl
jne 0x41b705
mov dh, byte [ecx]
test dh, dh
je 0x41b710
inc ecx
nop
movzx esi, byte [eax]
test esi, esi
setne dl
je 0x41b712
movzx edi, dh
mov dh, byte [edi + 0x9ba7a8]
cmp dh, byte [esi + 0x9ba7a8]
jne 0x41b720
inc eax
mov dh, byte [ecx]
inc ecx
test dh, dh
jne 0x41b6e0
jmp 0x41b712
or ecx, eax
sete al
movzx eax, al
pop esi
pop edi
ret
mov dl, 1
cmp byte [eax], 0
setne al
xor al, dl
movzx eax, al
pop esi
pop edi
ret
xor eax, eax
movzx eax, al
pop esi
pop edi
ret
Function at 0x47ad40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c0
mov ebp, edx
mov ebx, ecx
mov edi, dword [esp + 0x1d8]
mov eax, dword [ecx + 8]
mov dword [esp], eax
lea esi, [esp + 0x5c]
push 0x100
push 0x9cae8c
push esi
call fcn.00786d70
add esp, 0xc
mov dword [esp + 4], ebp
push ebp
push ebx
call fcn.0042b8f0
add esp, 8
mov dword [esp + 8], eax
call fcn.005b4c90
mov ebp, eax
and eax, 0xff800000
cmp eax, 0xa000000
jne 0x47ae28
mov eax, ebp
and eax, 0x7fffff
cmp eax, 0x414
jg 0x47adcb
cmp eax, 0x86
je 0x47addd
cmp eax, 0xcf
jne 0x47ae28
mov eax, dword [esp]
or byte [eax + 0x2d8], 8
mov esi, 0x9cafcc
jmp 0x47af77
cmp eax, 0x45c
je 0x47af2d
cmp eax, 0x415
jne 0x47ae28
mov eax, dword [esp]
push dword [eax + 0x10c]
call fcn.00506120
add esp, 4
mov edi, 0x3c
test eax, eax
je 0x47af72
mov ecx, dword [esp + 8]
mov dword [ecx + 0x48], eax
push eax
call fcn.00630c50
add esp, 4
lea esi, [esp + 0x5c]
push eax
push 0x9caf8c
push 0x100
push esi
call fcn.0040b350
add esp, 0x10
jmp 0x47af77
mov byte [esp + 0x5c], 0
push 0x100
push esi
push ebp
call fcn.005b54b0
add esp, 0xc
cmp byte [esp + 0x5c], 0
je 0x47ae51
mov eax, edi
xor eax, 0x23
or eax, ebp
je 0x47ae7b
jmp 0x47af77
test ebp, ebp
mov eax, 0x9cb02d
mov ecx, 0x9cb01f
cmove ecx, eax
lea eax, [esp + 0x5c]
push ecx
push eax
call fcn.00786b80
add esp, 8
mov eax, edi
xor eax, 0x23
or eax, ebp
jne 0x47af77
mov ebp, dword [esp + 0x1d4]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
call dword [0xb03bec]
mov esi, eax
lea edi, [esp + 0x15c]
push edi
push 0
push 0
push dword [esp + 0x10]
push dword [ebx + 4]
call fcn.00438e90
add esp, 0x14
test esi, esi
sete al
cmp ebp, 5
setne cl
or cl, al
jne 0x47aef2
lea ebx, [esp + 0xc]
push 0x50
push ebx
push esi
call fcn.0041ba80
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, 0x9cb097
cmovne eax, ebx
mov ecx, dword [esp]
jmp 0x47af06
mov eax, 0x9cb11a
cmp ebp, 0xa
mov ecx, dword [esp]
ja 0x47af06
mov eax, dword [ebp*4 + 0x9cb924]
push edi
push dword [esp + 0x1bc]
push dword [ecx + 0xf4]
push eax
push 0x9cafef
push dword [esp + 0x18]
call fcn.00443930
add esp, 0x18
mov edi, 0x23
jmp 0x47af89
mov byte [esp + 0x5c], 0
lea esi, [esp + 0x5c]
push 0x100
push esi
push ebp
call fcn.005b54b0
add esp, 0xc
mov edi, 0x62
cmp byte [esp + 0x5c], 0
jne 0x47af77
mov word [esp + 0x68], 0x72
mov dword [esp + 0x64], 0x6f727265
mov dword [esp + 0x60], 0x206e776f
mov dword [esp + 0x5c], 0x6e6b6e55
jmp 0x47af77
mov esi, 0x9cafa8
push esi
push 0x9cb01c
push dword [esp + 0xc]
call fcn.00443930
add esp, 0xc
mov eax, edi
add esp, 0x1c0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b48e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov edi, dword [ebx + 0x28]
push dword [edi + 0x84]
call fcn.004bdd90
add esp, 4
mov esi, eax
mov dword [esp + 4], edi
imul esi, dword [edi + 8]
push dword [ebx + 0x2c]
call fcn.004bddf0
add esp, 4
push dword [ebx + 0x30]
call fcn.004bd4b0
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
test ebp, ebp
je 0x4b494b
mov dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x48]
cmp dword [esp + 8], 0
je 0x4b4959
inc eax
mov dword [ebx + 0x48], eax
cmp eax, esi
jae 0x4b4967
cmp dword [ebx + 0x5c], 0
je 0x4b4a27
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x4b497a
mov dword [ebx + 0x54], 0xc
mov esi, 0xc
mov edi, dword [esp]
push edi
push esi
push 0
push ebx
call fcn.004cad10
add esp, 0x10
push edi
push dword [ebx + 0x58]
push esi
push dword [ebx + 0x44]
call dword [ebx + 0x40]
add esp, 0x10
push dword [ebx + 0x2c]
call fcn.004bddf0
add esp, 4
push dword [ebx + 0x30]
call fcn.004bd4b0
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
mov eax, dword [ebx + 0x28]
movzx ecx, word [ebx]
push ecx
push dword [eax + 0x90]
call fcn.004bd0e0
add esp, 8
push dword [ebx + 0x34]
call fcn.004bd4b0
add esp, 4
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
push dword [ebx + 0x3c]
call fcn.004c18c0
add esp, 4
mov eax, dword [0xafb024]
push ebx
call dword [eax]
add esp, 4
push dword [esp + 4]
call fcn.004c7270
add esp, 4
mov eax, 0xc
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004b4a40
Function at 0x5ee910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, edx
mov dword [esp + 0xc], ecx
mov esi, dword [ecx + 0x14]
cmp esi, edx
jae 0x5eea5b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x18]
mov ebx, eax
sub ebx, edx
jb 0x5ee971
mov edi, eax
and ebx, 0xfffffffc
lea eax, [edx + ebx]
add eax, 4
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
shl eax, 4
push 0x71
push 0xa2f440
push eax
mov ebx, ecx
push dword [ecx + 0x40]
call fcn.005db4d0
add esp, 0x10
test eax, eax
je 0x5eea6d
mov dword [ebx + 0x40], eax
mov eax, edi
mov edx, esi
shl edx, 4
add edx, 0x1f
movdqa xmm0, xmmword [0xa2f420]
movdqa xmm1, xmmword [0xa2f430]
nop dword [eax]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + 0x40]
mov bh, byte [edi + edx - 0x10]
mov bl, bh
movzx ecx, byte [edi + edx - 0x11]
shr bh, 7
mov ch, cl
add ch, cl
or ch, bh
mov byte [edi + edx - 1], ch
mov ch, byte [edi + edx - 0x12]
shr cl, 7
mov bh, ch
add bh, ch
or bh, cl
mov byte [edi + edx - 2], bh
mov cl, byte [edi + edx - 0x13]
shr ch, 7
add cl, cl
or cl, ch
add bl, bl
mov byte [edi + edx - 3], cl
movd xmm2, dword [edi + edx - 0x17]
movd xmm4, dword [edi + edx - 0x16]
psrlw xmm4, 7
pand xmm4, xmm0
movq xmm3, xmm2
paddb xmm2, xmm2
por xmm2, xmm4
movd dword [edi + edx - 7], xmm2
movq xmm2, qword [edi + edx - 0x1f]
movdqa xmmword [esp + 0x10], xmm2
mov bh, byte [esp + 0x10]
sar bh, 7
and bh, 0x87
xor bh, bl
movdqa xmm4, xmm2
pand xmm4, xmm1
por xmm4, xmm3
psllq xmm4, 0x38
movdqa xmm3, xmm2
psrlq xmm3, 8
por xmm3, xmm4
psrlw xmm3, 7
pand xmm3, xmm0
paddb xmm2, xmm2
por xmm2, xmm3
movq qword [edi + edx - 0xf], xmm2
mov byte [edi + edx], bh
inc esi
add edx, 0x10
cmp eax, esi
jne 0x5ee990
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], eax
shl eax, 4
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5eea65
Function at 0x61cb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x61cb3d
mov eax, dword [eax]
test eax, eax
je 0x61cb3d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x61cb3d
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp eax
mov dword [esp + 0xf], 0x207265
mov dword [esp + 0xc], 0x65746e45
mov word [esp + 8], 0x20
mov dword [esp + 4], 0x726f6620
mov word [esp + 2], 0x3a
test ebp, ebp
je 0x61cbf2
push ebp
call fcn.00786b90
add esp, 4
mov esi, eax
test ebx, ebx
je 0x61cb8a
push ebx
call fcn.00786b90
add esp, 4
add esi, eax
add esi, 0xb
jmp 0x61cb8d
add esi, 6
add esi, 2
push 0x166
push 0xa493f0
push esi
call fcn.005db3a0
add esp, 0xc
test eax, eax
je 0x61cbf2
mov edi, eax
lea eax, [esp + 0xc]
push esi
push eax
push edi
call fcn.005dd240
add esp, 0xc
push esi
push ebp
push edi
call fcn.005dd2a0
add esp, 0xc
test ebx, ebx
je 0x61cbe1
lea eax, [esp + 4]
push esi
push eax
push edi
call fcn.005dd2a0
add esp, 0xc
push esi
push ebx
push edi
call fcn.005dd2a0
add esp, 0xc
lea eax, [esp + 2]
push esi
push eax
push edi
call fcn.005dd2a0
add esp, 0xc
jmp 0x61cbf4
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret