joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464941
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x5669
pop ebx
push edi
push edx
add esp, 4
add edi, 0xea1
add edi, 0x137b9
or edi, 0x5413
call fcn.00464941
add byte [ebx], bh
inc ecx
inc ecx
xor dh, byte [esi]
cmp dword [edi], edi
xor eax, 0x4c4834b
add esp, 4
add esp, 4
pop edi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc38], edx
dec dword [ebx - 0x4db7b]
dec dword [ebx - 0x7276cfb8]
int3
invalid
invalid
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
add dh, bh
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x45
int3
push ecx
push esi
add esp, 4
or ecx, 0x144b7
and ecx, 0x8978
pop ecx
push esi
push ebx
add esp, 4
sub esi, 0x5989
jmp 0x464994
add esi, 0xab34
add esi, 0x12f8a
pop esi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push esi
or esi, 0xd376
pop esi
push ecx
and ecx, 0x7030
and ecx, 0x46e
pop ecx
push edi
xor edi, 0x18674
add edi, 0xde01
pop edi
push edi
xor edi, 0x11d8e
xor edi, 0xac74
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x464a47
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x464aa1
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x46496f
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x46496f
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x464a8b
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x464a95
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x464aea
push edx
add edx, 0xcdfa
pop edx
push ebx
push edx
add esp, 4
and ebx, 0x11d2a
sub ebx, 0x6d08
sub ebx, 0x174f7
and ebx, 0x145ac
pop ebx
push esi
push ebx
add esp, 4
xor esi, 0xecce
pop esi
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x464b52
push esi
sub esi, 0xd59f
and esi, 0x4409
or esi, 0x150e1
pop esi
push esi
push eax
add esp, 4
and esi, 0x9460
add esi, 0x62c1
pop esi
push edi
push edi
add esp, 4
or edi, 0x14cd9
pop edi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x464b48
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x464913
mov dword [ebp - 0x2e0], 0
push ebx
xor ebx, 0x155fc
xor ebx, 0x10ef6
or ebx, 0x5d93
pop ebx
push ecx
push eax
add esp, 4
sub ecx, 0x4047
call 0x464b80
add byte [ecx], bh
inc edi
inc eax
cmp dword [edi], edi
inc eax
aaa
push eax
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push edi
xor edi, 0x4440
call fcn.00464ba8
add byte [0x4e4a384e], bh
cmp eax, 0x4e4a384e
Function at 0x464950
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x4db7b]
dec dword [ebx - 0x7276cfb8]
int3
Function at 0x464b80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x5669
pop ebx
push edi
push edx
add esp, 4
add edi, 0xea1
add edi, 0x137b9
or edi, 0x5413
call fcn.00464941
add byte [ebx], bh
inc ecx
inc ecx
xor dh, byte [esi]
cmp dword [edi], edi
xor eax, 0x4c4834b
add esp, 4
add esp, 4
pop edi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc38], edx
dec dword [ebx - 0x4db7b]
dec dword [ebx - 0x7276cfb8]
int3
invalid
invalid
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
add dh, bh
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x45
int3
push ecx
push esi
add esp, 4
or ecx, 0x144b7
and ecx, 0x8978
pop ecx
push esi
push ebx
add esp, 4
sub esi, 0x5989
jmp 0x464994
add esi, 0xab34
add esi, 0x12f8a
pop esi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push esi
or esi, 0xd376
pop esi
push ecx
and ecx, 0x7030
and ecx, 0x46e
pop ecx
push edi
xor edi, 0x18674
add edi, 0xde01
pop edi
push edi
xor edi, 0x11d8e
xor edi, 0xac74
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x464a47
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x464aa1
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x46496f
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x46496f
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x464a8b
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x464a95
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x464aea
push edx
add edx, 0xcdfa
pop edx
push ebx
push edx
add esp, 4
and ebx, 0x11d2a
sub ebx, 0x6d08
sub ebx, 0x174f7
and ebx, 0x145ac
pop ebx
push esi
push ebx
add esp, 4
xor esi, 0xecce
pop esi
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x464b52
push esi
sub esi, 0xd59f
and esi, 0x4409
or esi, 0x150e1
pop esi
push esi
push eax
add esp, 4
and esi, 0x9460
add esi, 0x62c1
pop esi
push edi
push edi
add esp, 4
or edi, 0x14cd9
pop edi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x464b48
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x464913
mov dword [ebp - 0x2e0], 0
push ebx
xor ebx, 0x155fc
xor ebx, 0x10ef6
or ebx, 0x5d93
pop ebx
push ecx
push eax
add esp, 4
sub ecx, 0x4047
call 0x464b80
add byte [ecx], bh
inc edi
inc eax
cmp dword [edi], edi
inc eax
aaa
push eax
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push edi
xor edi, 0x4440
call fcn.00464ba8
add byte [0x4e4a384e], bh
cmp eax, 0x4e4a384e
Function at 0x464ba0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0x4e4a384e
inc ecx
cmp cl, byte [esi - 0x7d]
add esp, 4
pop edi
push edx
jmp 0x464bb2
sub edx, 0x168f6
add edx, 0xb9ae
jmp 0x464bc4
pop edx
mov dword [ebp - 0x70c], 0
invalid

Function at 0x464ba8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0x4e4a384e
inc ecx
cmp cl, byte [esi - 0x7d]
add esp, 4
pop edi
push edx
jmp 0x464bb2
sub edx, 0x168f6
add edx, 0xb9ae
jmp 0x464bc4
pop edx
mov dword [ebp - 0x70c], 0
invalid

Function at 0x464e60
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [esi], dh
cmp eax, 0x43434445
inc ecx
cmp eax, dword [ebx - 0x347efb3c]
ljmp 0xeb53

Function at 0x464e70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [esi], dh
cmp eax, 0x43434445
inc ecx
cmp eax, dword [ebx - 0x347efb3c]
ljmp 0xeb53
Function at 0x464ff0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop ebx
push edx
and edx, 0x13e
pop edx
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push esi
push edx
add esp, 4
xor esi, 0x15397
pop esi
push esi
or esi, 0x29f4
pop esi
push edx
push edx
add esp, 4
sub edx, 0x1289
and edx, 0x884d
pop edx
push eax
push edi
add esp, 4
sub eax, 0x1367a
pop eax
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
push dword [esi + eax*8 - 0x7b]
movsb byte es:[edi], byte [esi]
idiv bh
push dword [ebp - 0x3a]
test dword [ebp + 0x61fffff6], esp
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
push eax
add esp, 4
xor edi, 0x6232
or edi, 0xc00
sub edi, 0x331f
and edi, 0x94dc
pop edi
push esi
add esi, 0x13a7c
or esi, 0xbb97
xor esi, 0x115b5
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push esi
and esi, 0x16510
add esi, 0x6560
pop esi
push edi
and edi, 0x3130
pop edi
push edi
or edi, 0x105e5
jmp 0x46513e
add edi, 0x14538
jmp 0x465149
pop edi
cmp dword [ebp - 0x150c], 0
jne 0x465162
mov dword [ebp - 0x2a8], 0
jmp 0x465409
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push edx
and edx, 0x13504
jmp 0x465182
pop edx
push eax
jmp 0x465189
xor eax, 0x9c5
jmp 0x465197
pop eax
push ebx
and ebx, 0x471f
add ebx, 0x72c4
pop ebx
cmp dword [ebp - 0xc4c], 0
jne 0x4651be
mov dword [ebp - 0x2a8], 0
jmp 0x465409
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push ebx
push ebx
add esp, 4
invalid
Function at 0x465070
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop ebx
push edx
and edx, 0x13e
pop edx
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push esi
push edx
add esp, 4
xor esi, 0x15397
pop esi
push esi
or esi, 0x29f4
pop esi
push edx
push edx
add esp, 4
sub edx, 0x1289
and edx, 0x884d
pop edx
push eax
push edi
add esp, 4
sub eax, 0x1367a
pop eax
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
push dword [esi + eax*8 - 0x7b]
movsb byte es:[edi], byte [esi]
idiv bh
push dword [ebp - 0x3a]
test dword [ebp + 0x61fffff6], esp
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
push eax
add esp, 4
xor edi, 0x6232
or edi, 0xc00
sub edi, 0x331f
and edi, 0x94dc
pop edi
push esi
add esi, 0x13a7c
or esi, 0xbb97
xor esi, 0x115b5
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push esi
and esi, 0x16510
add esi, 0x6560
pop esi
push edi
and edi, 0x3130
pop edi
push edi
or edi, 0x105e5
jmp 0x46513e
add edi, 0x14538
jmp 0x465149
pop edi
cmp dword [ebp - 0x150c], 0
jne 0x465162
mov dword [ebp - 0x2a8], 0
jmp 0x465409
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push edx
and edx, 0x13504
jmp 0x465182
pop edx
push eax
jmp 0x465189
xor eax, 0x9c5
jmp 0x465197
pop eax
push ebx
and ebx, 0x471f
add ebx, 0x72c4
pop ebx
cmp dword [ebp - 0xc4c], 0
jne 0x4651be
mov dword [ebp - 0x2a8], 0
jmp 0x465409
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push ebx
push ebx
add esp, 4
invalid
Function at 0x465b18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x188]
add edx, 1
mov dword [ebp - 0x188], edx
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
cmp edx, ecx
je 0x465b61
mov edx, dword [ebp - 0x71c]
add edx, dword [ebp - 0x188]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x188]
movsx edx, byte [ebp + ecx - 0x830]
cmp eax, edx
jne 0x465b68
jmp 0x465aae
jmp 0x465b6f
Function at 0x4660d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, 0xbe80000
add byte [eax], al
add byte [eax], al
dec esp
dec ecx
Function at 0x475560
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], eax
mov ebx, 0x2020234
push 0xea108f8b
add dword [ecx], eax
mov esp, 0x2020230
push 0xea12978b
add dword [ecx], eax
mov edx, 0x2020266
push 0xea14878b
add dword [ecx], eax
mov ebx, 0x202026e
push 0xea168f8b
add dword [ecx], eax
mov esp, 0x202026e
push 0xea18978b
add dword [ecx], eax
xor eax, 0x878b68c2
sbb ch, dl
add dword [ecx], eax
pop ecx
adc ecx, 0x36
cwde
add al, byte [edx]
popal
push ebx
xor ebx, 0x5f
push ebx
add eax, dword [edx]
pop ebx
push ebp
xor ebp, 0xffffff8d
mov es, word [edx]
add al, byte [ebx + 0x2da25c5]
add bl, byte [ebp + 0x54]
add esp, 0xffffffaf
pop ebx
add eax, dword [edx]
sub esp, 0xffffffab
sub eax, dword [edx]
add al, byte [ebx + 0x2ab17c4]
add bl, byte [eax + ecx*8 - 0x79]
xor bh, cl
xchg dword [edx], esi
stc
add dword [ecx], eax
dec esi
enter 0x3387, 0xfffffffffffffff9
add dword [ecx], eax
jno 0x4755b0
xchg dword [ecx + edi*8], esi
add dword [ecx], eax
arpl ax, cx
xchg dword [0x660101f9], esi
enter 0x3687, 0xfffffffffffffff9
add dword [ecx], eax
dec esi
enter 0x3787, 0xfffffffffffffff9
add dword [ecx], eax
imul ecx, eax, 0xffffff87
cmp cl, bh
add dword [ecx], eax
enter 0x3987, 0xfffffffffffffff9
add dword [ecx], eax
je 0x4755da
xchg dword [edx], edi
stc
add dword [ecx], eax
arpl ax, cx
xchg dword [ebx], edi
stc
add dword [ecx], eax
je 0x4755e8
xchg dword [ecx + edi*8], edi
add dword [ecx], eax
jnp 0x4755ef
xchg dword [0x590101f9], edi
enter 0x3e87, 0xfffffffffffffff9
add dword [ecx], eax
add ah, byte [esi - 0x73]
bndldx bnd0, [edx]
add al, byte [edx]
mov ecx, dword [edi + 0x101e676]
lea edx, [edi + 0x101e676]
lea eax, [edx + esi - 0x75]
xchg dword [edx - 0x1a], esi
add dword [ecx], eax
lea ecx, [edi + 0x101e672]
mov ecx, dword [edi + 0x101ef06]
pop ecx
ljmp 0x4902
Function at 0x486550
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x391
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38
ja case.0x486574.17
mov edx, dword [ebp - 4]
jmp dword [edx*4 + 0x486678]
mov al, 0x41
jmp 0x486674
mov al, 0x42
jmp 0x486674
mov al, 0x47
jmp 0x486674
mov al, 0x44
jmp 0x486674
mov al, 0x45
jmp 0x486674
mov al, 0x5a
jmp 0x486674
mov al, 0x48
jmp 0x486674
mov al, 0x51
jmp 0x486674
mov al, 0x49
jmp 0x486674
mov al, 0x4b
jmp 0x486674
mov al, 0x4c
jmp 0x486674
mov al, 0x4d
jmp 0x486674
mov al, 0x4e
jmp 0x486674
mov al, 0x58
jmp 0x486674
mov al, 0x4f
jmp 0x486674
mov al, 0x50
jmp 0x486674
mov al, 0x52
jmp 0x486674
mov al, 0x53
jmp 0x486674
mov al, 0x54
jmp 0x486674
mov al, 0x55
jmp 0x486674
mov al, 0x4a
jmp 0x486674
mov al, 0x43
jmp 0x486674
mov al, 0x59
jmp 0x486674
mov al, 0x57
jmp 0x486674
mov al, 0x61
jmp 0x486674
mov al, 0x62
jmp 0x486674
mov al, 0x67
jmp 0x486674
mov al, 0x64
jmp 0x486674
mov al, 0x65
jmp 0x486674
mov al, 0x7a
jmp 0x486674
mov al, 0x68
jmp 0x486674
mov al, 0x71
jmp 0x486674
mov al, 0x69
jmp 0x486674
mov al, 0x6b
jmp 0x486674
mov al, 0x6c
jmp 0x486674
mov al, 0x6d
jmp 0x486674
mov al, 0x6e
jmp 0x486674
mov al, 0x78
jmp 0x486674
mov al, 0x6f
jmp 0x486674
mov al, 0x70
jmp 0x486674
mov al, 0x72
jmp 0x486674
mov al, 0x73
jmp 0x486674
mov al, 0x73
jmp 0x486674
mov al, 0x74
jmp 0x486674
mov al, 0x75
jmp 0x486674
mov al, 0x6a
jmp 0x486674
mov al, 0x63
jmp 0x486674
mov al, 0x79
jmp 0x486674
mov al, 0x77
jmp 0x486674
mov al, 0x20
mov esp, ebp
pop ebp
ret

Function at 0x49fe20
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67f038
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x70af2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
movzx eax, byte [0x70a011]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004113e0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x2c]
add edx, 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.0040d510
cvtsi2sd xmm0, eax
sub esp, 8
movsd qword [esp], xmm0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0049f5c0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30]
add edx, 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], edx
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00411410
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.0040d670
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.004113e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00408e30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bde50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x70af2c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x66
movzx eax, byte [ebp + 0xc]
sar eax, 4
and eax, 0xf
movzx ecx, byte [ebp + eax - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004113e0
movzx edx, byte [ebp + 0xc]
and edx, 0xf
movzx eax, byte [ebp + edx - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.004113e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006588a1
mov esp, ebp
pop ebp
ret
Function at 0x4d0060
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
push 0x69dff8
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00409690
test eax, eax
jne 0x4d00a6
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
push 0
push 0
push 0x8003
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov dword [ebp - 8], eax
jmp 0x4d00e3
push 0x6a37c0
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00409690
test eax, eax
jne 0x4d00dc
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
push 0
push 0
push 0x8004
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov dword [ebp - 8], eax
jmp 0x4d00e3
xor eax, eax
jmp 0x4d0165
cmp dword [ebp - 8], 0
je 0x4d00eb
jmp 0x4d00f8
push 0x6a3634
mov ecx, dword [ebp - 4]
call fcn.004d0360
push 0
mov ecx, dword [ebp + 8]
call fcn.0040d510
push eax
mov ecx, dword [ebp + 8]
call fcn.00412090
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4d011f
jmp 0x4d012c
push str.Error_during_CryptHashData.
mov ecx, dword [ebp - 4]
call fcn.004d0360
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
call fcn.004d0170
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x4d0151
jmp 0x4d0162
push str.ERROR_during_CryptDestroyHash
mov ecx, dword [ebp - 4]
call fcn.004d0360
xor eax, eax
jmp 0x4d0165
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4d04b0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
push 0xf0000000
push 1
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4d04df
jmp 0x4d0507
push 8
push 1
push 0
push 0
mov edx, dword [ebp - 4]
add edx, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4d04fa
jmp 0x4d0507
push str.Could_not_create_a_new_key_container._n
mov ecx, dword [ebp - 4]
call fcn.004d0360
mov esp, ebp
pop ebp
ret
Function at 0x4d08b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
jmp 0x4d08d5
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jge 0x4d09da
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
add edx, 1
and edx, 0xff
mov eax, dword [ebp - 8]
mov dword [eax + 0x1c], edx
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00412000
movzx eax, al
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x20]
and eax, 0xff
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00412000
mov byte [ebp - 1], al
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00412000
movzx ecx, al
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00412ae0
movzx ecx, byte [ebp - 1]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00412ae0
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00412000
movzx esi, al
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00412000
movzx edi, al
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00412000
movzx eax, al
add edi, eax
and edi, 0xff
push edi
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00412000
movzx ecx, al
xor esi, ecx
push esi
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.00412ae0
jmp 0x4d08cc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4d87a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68164a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x70af2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], 0
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], 0
push 0x1c
call fcn.004096f0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x4d8877
push 0xa
mov ecx, dword [ebp - 0x14]
call fcn.0052c503
mov dword [ebp - 0x18], eax
jmp 0x4d887e
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x44], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x4c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x50], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret