joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004b13
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002f388]
jne 0x10004b1d
repz ret
jmp fcn.100068e9

Function at 0x10006b94
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100036eb
and dword [ebp - 4], 0
cmp dword [0x10030d8c], 0
mov ebx, eax
jne 0x10006c45
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006cf6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10006cf6
push eax
call fcn.10003679
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10030d8c], eax
call esi
push eax
call fcn.10003679
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10030d90], eax
call esi
push eax
call fcn.10003679
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10030d94], eax
call esi
push eax
call fcn.10003679
pop ecx
mov dword [0x10030d9c], eax
test eax, eax
je 0x10006c45
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10003679
pop ecx
mov dword [0x10030d98], eax
mov eax, dword [0x10030d98]
cmp eax, ebx
je 0x10006c9d
cmp dword [0x10030d9c], ebx
je 0x10006c9d
push eax
call fcn.100036f4
push dword [0x10030d9c]
mov esi, eax
call fcn.100036f4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10006c9d
test edi, edi
je 0x10006c9d
call esi
test eax, eax
je 0x10006c94
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10006c94
test byte [ebp - 0xc], 1
jne 0x10006c9d
or dword [ebp + 0x10], 0x200000
jmp 0x10006cd6
mov eax, dword [0x10030d90]
cmp eax, ebx
je 0x10006cd6
push eax
call fcn.100036f4
pop ecx
test eax, eax
je 0x10006cd6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10006cd6
mov eax, dword [0x10030d94]
cmp eax, ebx
je 0x10006cd6
push eax
call fcn.100036f4
pop ecx
test eax, eax
je 0x10006cd6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10030d8c]
call fcn.100036f4
pop ecx
test eax, eax
je 0x10006cf6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10006cf8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100087e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.100087e0]
mov dword [ebp - 4], eax
jmp 0x10008820
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax], 0x4550
je 0x1000882f
jmp 0x1000880e
mov dword [ebp - 8], 0
jmp 0x1000883f
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
jmp 0x10008837
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100087f1
jmp 0x1000880e
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x1000883f
mov al, 1
test al, 1
jne 0x10008820
jmp 0x10008805
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
Function at 0x10009070
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x1002eaa0]
add eax, 0x1fe4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [0x1002ea9c], eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x1002ea9c]
sub ecx, 0x1d4
mov dword [0x1002ea9c], ecx
mov dword [ebp - 0x10], 0
jmp 0x10009182
mov dword [ebp - 4], 0
jmp 0x10009159
mov dword [0x1002ea9c], 0x23e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x16], dx
mov ax, word [ebp - 0x16]
movzx ecx, ax
cmp ecx, 0x6c
je 0x10009143
jmp 0x1000921a
mov eax, dword [0x1002ea9c]
add eax, 0x117
mov dword [0x1002ea9c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
je 0x100091fe
jmp 0x1000912d
jmp 0x1000921f
jmp 0x10009128
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2 - 0x14]
cmp eax, 0x64
je 0x10009101
jmp 0x10009128
mov eax, dword [0x1002eaa0]
sub eax, 0x21bc
mov dword [0x1002ea9c], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
add esp, 0x20
pop ebp
ret
mov dword [0x1002ea9c], 0x224c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x100091d7
jmp 0x10009221
cmp dword [ebp - 0x10], 0x104
setl al
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x17]
test al, 1
jne 0x10009198
jmp 0x100091c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2]
cmp eax, 0
jne 0x100091ab
jmp 0x100091c0
jmp 0x100091ad
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10009182
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x10009161
jmp 0x100090c8
mov eax, dword [0x1002eaa0]
sub eax, 0x56f
mov dword [0x1002ea9c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x1000912f
jmp 0x1000921f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
je 0x100090d4
jmp 0x1000912d
jmp 0x10009221
jmp 0x100090c8
Function at 0x1003c8d0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x44
mov eax, dword [0x100b4368]
push esi
push 0x20
mov dword [esp + 0x48], eax
lea eax, [esp + 0x28]
push eax
push 0xe
push 0x400
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
fld dword [esp + 0x54]
fmul dword [0x100a994c]
mov esi, dword [esp + 0x4c]
push 0xffffffffffffffff
push esi
call fcn.100a5245
push eax
call fcn.10083930
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c915
sub eax, edx
cmp eax, 2
jge 0x1003c959
push 0x100a9948
lea ecx, [esp + 8]
push 0xffffffffffffffff
push ecx
call fcn.100839e0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x14]
push 0xffffffffffffffff
push eax
call fcn.10083990
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push esi
call fcn.10084540
add esp, 0x28
jmp 0x1003c96b
lea edx, [esp + 0x24]
push edx
push 0
dec eax
push eax
push esi
call fcn.10084540
add esp, 0x10
mov eax, esi
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c971
mov ecx, dword [esp + 0x40]
sub eax, edx
call fcn.1009d15f
add esp, 0x44
ret

Function at 0x10040780
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x100407c9
xor ecx, ecx
test esi, esi
mov byte [esp + 7], 0x11
jle 0x100407c9
mov edx, dword [esp + 0xc]
lea esp, [esp]
mov al, byte [ecx + edx]
mov byte [esp + 0x10], al
mov ah, byte [esp + 7]
mov al, byte [esp + 0x10]
xor al, ah
push ax
pop ax
mov byte [esp + 0x10], al
mov al, byte [esp + 0x10]
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
mov byte [esp + 7], al
jl 0x100407a0
pop esi
pop ecx
ret
Function at 0x100a00e2
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100ab450
call fcn.1009e76c
push 8
call fcn.100a5245
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100b9844], esi
jne 0x100a0116
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x100b9840], esi
mov al, byte [ebp + 0x10]
mov byte [0x100b983c], al
cmp dword [ebp + 0xc], edi
jne 0x100a0160
cmp dword [0x100bc288], edi
je 0x100a0150
mov eax, dword [0x100bc284]
sub eax, 4
mov dword [0x100bc284], eax
cmp eax, dword [0x100bc288]
jb 0x100a0150
mov eax, dword [eax]
cmp eax, edi
je 0x100a0131
call eax
jmp 0x100a0131
push 0x100ad028
mov eax, 0x100ad020
call fcn.100a0060
pop ecx
push 0x100ad030
mov eax, 0x100ad02c
call fcn.100a0060
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x100a0191
cmp dword [ebp + 0x10], edi
jne 0x100a019f
mov dword [0x100b9844], esi
push dword [ebp + 8]
call fcn.100a001e
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x100a019e
push 8
call fcn.100a5245
pop ecx
ret
call fcn.1009e7a7
ret

Function at 0x100a0bb2
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x100b4368]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100b49f0]
je 0x100a0be7
inc eax
cmp eax, 0x13
jb 0x100a0bd8
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100b49f0]
jne 0x100a0d0d
mov eax, dword [0x100b9784]
cmp eax, 1
je 0x100a0ce5
cmp eax, edx
jne 0x100a0c17
cmp dword [0x100b9788], 1
je 0x100a0ce5
cmp ecx, 0xfc
je 0x100a0d0d
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100a0c4d
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.100a0e60
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.100a1090
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100a0c81
mov eax, edi
push eax
call fcn.100a1090
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x100a73f8
push edi
call fcn.100a0f60
add esp, 0x10
push edi
call fcn.100a1090
push dword [esi + 0x100b49f4]
mov ebx, eax
call fcn.100a1090
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.1009daf0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.100a0e60
push edi
push ebx
call fcn.100a0e70
push 0x100aafc0
push ebx
call fcn.100a0e70
push dword [esi + 0x100b49f4]
push ebx
call fcn.100a0e70
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100a5245
add esp, 0x2c
jmp 0x100a0d0d
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x100b49f4]
push dword [esi]
call fcn.100a1090
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1009d15f
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x100a3693
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x100b4368]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x100a36c4
xor eax, eax
jmp 0x100a384d
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x100bc180]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x100a3700
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.100a5245
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x100a37db
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x100a3819
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x100a3764
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100a3755
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x100a3735
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100a37a4
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x100a37ad
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x100a3726
jmp 0x100a37af
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x100a3848
cmp dword [ebp - 0x6c], edi
je 0x100a3819
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x100a380e
call fcn.1009f770
mov dword [eax], 9
call fcn.1009f779
mov dword [eax], esi
jmp 0x100a3843
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100a3803
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x100a37af
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x100a37af
push dword [ebp - 0x6c]
call fcn.1009f782
pop ecx
jmp 0x100a3843
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x100a3831
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x100a3831
xor eax, eax
jmp 0x100a384b
call fcn.1009f770
mov dword [eax], 0x1c
call fcn.1009f779
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x100a384b
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.1009d15f
add ebp, 0x3a0
leave
ret
Function at 0x100a5245
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100a5254
pop dword [ebp - 0x40]
mov eax, 0x100a5254
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3b3f9
push 0
mov eax, 0xd97c0c01
sub eax, 0xc971aae5
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x6116a0ff
add ecx, 0x9ee9aaef
mov esi, eax
mov edi, 0xf54e53f5
add edi, 0x1abfdc0b
add edi, dword [ebp - 0x40]
mov edx, 0x757f4454
sub dword [ebp - 8], 0xd4293b42
mov ebx, dword [edi]
xor dword [ebp - 0x20], edx
sub ebx, edx
mov dword [ebp - 8], 0xebc03dae
mov dword [esi], ebx
sub dword [ebp - 0x20], edx
add esi, 0x126f19dd
sub esi, 0x126f19d9
add edi, 0x7da3c2d4
add edi, 0x825c3d30
loop 0x100a52a8
add eax, 0x33d83952
sub eax, 0x33d716c7
xor ebx, ebx
add ebx, eax
add eax, 0xd600c703
add eax, 0x29ff3902
mov ecx, 0xcbfea411
sub ecx, 0xbbfea411
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x448d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b42a0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x638bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x448d8f
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x448da0
push 0x48
push esi
call fcn.005b0e2a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x449370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b43bc
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x638bb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x24], edi
push 0
mov dword [ebp - 0x1c], 0
call fcn.00465870
mov dword [ebp - 4], 0
mov dword [edi], vtable.CryptoPP::BaseN_Decoder.0
mov dword [edi + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
push esi
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.004663c0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00467f20
mov dword [ebp - 0x18], eax
push 0x14
mov byte [ebp - 4], 5
call fcn.005b0b7d
mov esi, eax
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 4], str.DecodingLookupArray
mov word [esi + 8], 1
mov dword [esi + 0xc], 0
mov dword [esi], vtable.CryptoPP::AlgorithmParametersTemplate_int_const__.0
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 6
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov dword [eax + 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x449481
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], 0
test ecx, ecx
je 0x44949e
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], esi
mov byte [eax + 8], 1
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.00467ea0
mov esi, eax
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4494cc
mov eax, dword [ecx]
push 1
call dword [eax]
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 4
push eax
push str.Log2Base
mov ecx, esi
mov dword [ebp - 0x30], vtable.CryptoPP::NameValuePairs.0
call fcn.00455690
push eax
mov ecx, edi
call fcn.0046bd90
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x449500
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0882
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449520
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b42a0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x638bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
cmp eax, dword [esi + 0x34]
mov edx, dword [esi + 0x38]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x34]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x449582
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x449593
push 0x3c
push esi
call fcn.005b0e2a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4495b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b42c0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x638bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x20]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 8
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x449637
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x449648
push 0x40
push esi
call fcn.005b0e2a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44be90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x44beb2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x1f]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x44bea0
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret
Function at 0x4507f0
Capabilities:
Execute command
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b5148
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x638bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x3c]
push str.start_cmd__C__color_b__title_Error__echo
push eax
call fcn.00455450
push str.__timeout__t_5__nul_2_1
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
call fcn.00455400
add esp, 0x18
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004533d0
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.00453530
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.00453530
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x450880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b5180
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x638bb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
call fcn.0047bcc0
mov edi, eax
test edi, edi
jne 0x45091d
push 4
mov dword [esi + 0x10], eax
mov ecx, esi
mov dword [esi + 0x14], 0xf
push str.null
mov byte [esi], al
call fcn.004546a0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x450a5f
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x450a55
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x450a55
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 2
xor ecx, ecx
movaps xmm0, xmmword [str.wTURP]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0x1d5f5958
mov dword [ebp - 0x38], 0x195c4452
mov dword [ebp - 0x34], 0x15091606
mov word [ebp - 0x30], 0x100
nop dword [eax + eax]
lea eax, [ecx + 0x1f]
xor byte [ebp + ecx - 0x4c], al
inc ecx
cmp ecx, 0x1c
jb 0x450960
lea eax, [ebp - 0x4c]
mov byte [ebp - 0x2f], 0
push eax
push 0x2712
push edi
call fcn.0047fa80
push 0
push 0x40
push edi
call fcn.0047fa80
push 0
push 0x51
push edi
call fcn.0047fa80
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0x271f
push edi
call fcn.0047fa80
push 0x450790
push 0x4e2b
push edi
call fcn.0047fa80
lea eax, [ebp - 0x2c]
push eax
push 0x2711
push edi
call fcn.0047fa80
add esp, 0x48
push edi
call fcn.0047bd60
add esp, 4
test eax, eax
je 0x4509f0
push 0x10
push 0
push eax
call fcn.0047c720
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.0047bc80
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x200002
push edi
call fcn.0047bca0
add esp, 0x10
cmp dword [ebp - 0x14], 0x1ad
je 0x450a7c
movups xmm0, xmmword [ebp - 0x2c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 4
jmp 0x4508e5
push edx
push ecx
call fcn.005b0e2a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0882
mov esp, ebp
pop ebp
ret
sub esp, 0x18
mov ecx, esp
push str.Youre_connecting_too_fast_to_loader__slow_down.
call fcn.00453660
call fcn.004507f0
int3