joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401741
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x408990
call fcn.00401890
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40b418
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x401502
cmp eax, esi
jne 0x4014f5
xor esi, esi
inc esi
mov ebx, esi
jmp 0x401505
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4014dc
xor esi, esi
inc esi
mov eax, dword [0x40b414]
cmp eax, esi
jne 0x401518
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401547
mov eax, dword [0x40b414]
test eax, eax
jne 0x401541
mov dword [0x40b414], esi
push 0x401018
push 0x40100c
call fcn.0040144b
pop ecx
pop ecx
test eax, eax
je 0x401547
jmp 0x40166f
mov dword [0x40909c], esi
mov eax, dword [0x40b414]
cmp eax, esi
jne 0x40156b
push 0x401008
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40b414], 2
test ebx, ebx
jne 0x401577
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40b41c], 0
je 0x40159b
push 0x40b41c
call fcn.00401824
pop ecx
test eax, eax
je 0x40159b
push 0
push 2
push 0
call dword [0x40b41c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4015f7
test al, al
je 0x4015b5
cmp dword [ebp - 0x1c], 0
jne 0x4015f7
mov al, byte [esi]
test al, al
je 0x4015c5
cmp al, 0x20
ja 0x4015c5
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4015b5
test byte [ebp - 0x3c], 1
je 0x4015d1
movzx eax, word [ebp - 0x38]
jmp 0x4015d4
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x409098], eax
cmp dword [0x40908c], 0
jne 0x40164b
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x401606
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x401619
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x4015a2
cmp dword [0x40909c], 0
jne 0x40165a
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x409098]
jmp 0x40167b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.004018d5
ret
call fcn.004019bf
jmp 0x4014a2

Function at 0x403f96
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov edx, ecx
pop esi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
dec esi
jne 0x403f9e
mov dword [ecx*4 + 0x409400], edx
inc ecx
cmp ecx, 0x100
jb 0x403f99
mov edx, 0x400
mov ecx, dword [edx + section..data]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x409400]
mov dword [edx + 0x409400], ecx
add edx, 4
cmp edx, 0x2000
jb 0x403fc6
mov eax, 0x40401c
mov esi, 0x4040b9
mov dword [0x40b408], eax
mov dword [0x40b400], eax
mov dword [0x40b404], esi
call fcn.00405722
mov ecx, dword [0x40b400]
test eax, eax
cmove ecx, esi
mov dword [0x40b400], ecx
pop esi
ret
Function at 0x404c98
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x404caa
xor eax, eax
jmp 0x404cf1
and dword [edi], 0
mov ecx, 0x400000
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push 0
push eax
cmp esi, ecx
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x404cf5
test ecx, ecx
je 0x404cee
mov ecx, 0x400000
test esi, esi
jne 0x404cb6
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x404d79
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x404d8b
xor eax, eax
jmp 0x404dd2
and dword [edi], 0
mov ecx, 0x400000
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push 0
push eax
cmp esi, ecx
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x404dd6
test ecx, ecx
je 0x404dcf
mov ecx, 0x400000
test esi, esi
jne 0x404d97
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4054fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov edx, dword [edx]
and edx, 7
cmp eax, 5
jae 0x40551a
xor eax, eax
jmp 0x405631
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
push ebx
mov ebx, dword [ebp + 8]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x405539
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x40553d
inc esi
cmp esi, ecx
jb 0x405530
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x40561e
cmp ecx, 2
jbe 0x405596
xor edx, edx
movzx ebx, byte [esi + 4]
lea eax, [ebx + 1]
test al, 0xfe
jne 0x405613
movzx eax, byte [esi + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0x10]
add eax, edi
add edi, 5
cmp dword [ebp + 0x18], 0
mov dword [ebp - 4], eax
je 0x4055c2
add ebx, eax
jmp 0x4055c4
shr edx, cl
test edx, edx
je 0x405557
cmp edx, 4
ja 0x4055b4
cmp edx, 3
je 0x4055b4
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x405557
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x40552b
sub ebx, eax
test edx, edx
je 0x4055f3
and edx, 6
mov eax, ebx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x4055f1
mov eax, pe_nt_image_headers32
shl eax, cl
dec eax
xor ebx, eax
cmp dword [ebp + 0x18], 0
je 0x4055ee
add ebx, dword [ebp - 4]
jmp 0x4055f1
sub ebx, dword [ebp - 4]
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
mov byte [esi + 4], bl
jmp 0x405619
or edx, 8
shr edx, 1
inc edi
mov ebx, dword [ebp + 8]
jmp 0x4055ba
xor eax, eax
shr edx, cl
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4203c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4203d6
pop dword [ebp - 0x4c]
mov eax, 0x4203d6
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x4ac3fe67
add dword [ebp - 0x5c], 0x38e46e4
mov dword [ebp - 0x58], 0x39218873
sub dword [ebp - 0x58], 0x6ee3c2e
mov dword [ebp - 0x54], 0xa46b6bba
add dword [ebp - 0x54], 0xa7e0d874
mov dword [ebp - 0x50], 0xb65df2fd
sub dword [ebp - 0x50], 0xb65df2fd
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9fd351ab
sub dword [ebp - 0x5c], 0x2b60e855
mov dword [ebp - 0x58], 0x54c87bd9
sub dword [ebp - 0x58], 0x135c1a64
mov dword [ebp - 0x54], 0xe77a787b
add dword [ebp - 0x54], 0x7bf4f3f1
mov dword [ebp - 0x50], 0xe13a7861
add dword [ebp - 0x50], 0x1ec5879f
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x2c3529c1
sub eax, 0x2bf2f89d
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x415e6
push 0
call eax
mov ecx, 0xdff3b5dc
add ecx, 0x200c9fd4
mov esi, eax
mov edi, 0x434400
add edi, dword [ebp - 0x4c]
mov ebx, 0x7c1375e9
sub dword [ebp - 0x44], ebx
mov edx, dword [edi]
xor dword [ebp - 0x44], 0x5a18921c
xor edx, ebx
sub dword [ebp - 0x44], edx
mov dword [esi], edx
sub dword [ebp - 0x28], edi
add esi, 4
add edi, 4
loop 0x4204e2
add eax, 0x98b47b2
sub eax, 0x989fe1f
xor ebx, ebx
add ebx, eax
add eax, 0x60984659
sub eax, 0x60984654
mov ecx, 0x62859a23
sub ecx, 0x62459a23
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x27027207
mov ebx, 0x7fed1750
xor ebx, edi
mov esi, 0x7251c07b
xor ebx, esi
xor ebx, 0x2abe8db8
mov ecx, 0x20
mov edx, 0x1000
xor ecx, edx
mov eax, 0x4fd3f354
xor eax, 0x4fd3f155
xor ecx, eax
xor ebx, ecx
mov eax, ebx
push eax
pop edx
mov edi, edx
mov esi, edi
mov ecx, esi
push ecx
add esp, 0xfffffffc
mov eax, esp
mov ebx, eax
mov dword [ebx], edi
pop edi
jmp 0x403f06

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4062ca
Capabilities:
Encode data using xor

Disassembly:
int1
xor ecx, edx
mov edx, 0x2182c100
mov edi, 0x503229
xor edx, edi
push 0x3f140984
mov ebx, 0xba3041a
pop esi
xor ebx, esi
xor ebx, edx
xor ebx, ecx
xor ecx, ecx
add ecx, ebx
sub ecx, 0xffffffbb
mov eax, dword [ecx - 0x45]
push 0x3b75f510
jne 0x406307
jne 0x406307
mov ebx, 0x3b75f510
pop edx
xor ebx, edx
mov edx, 0x200d951d
mov ecx, 0x200d951d
xor ecx, edx
xor ebx, ecx
push 0x139eb54b
mov edi, 0x62e434bb
pop ecx
xor edi, ecx
mov ecx, 0x717a81f0
xor edi, ecx
xor ebx, edi
mov ecx, 0xfffffffc
add esp, ecx
xor esi, esi
add esi, esp
mov dword [esi], ebx
mov ebx, 0x4b1df583
mov edx, 0x4b1df583
xor edx, ebx
xor edx, esp
mov ebx, edx
mov ecx, ebx
add esp, 0xfffffffc
cmc
sbb eax, 0xf583ba4b
sbb eax, 0x31da314b
loop 0x40629d
ror dword [ecx - 0x33b7c27], cl
mov ebx, esp
mov dword [ebx], ecx
mov ecx, 0x14a20004
mov edx, 0x2910a409
xor ecx, edx
mov edx, 0x3db2a44d
xor ecx, edx
mov edi, 0x74b621b7
xor edi, 0x33b14886
push edi
push 0x9db85d7
mov ebx, 0x4edcece6
pop esi
xor ebx, esi
pop edx
xor ebx, edx
xor ecx, ebx
xor esi, esi
add esi, ecx
add esp, 0xfffffffc
mov edx, esp
mov dword [edx], esi
mov esi, 0
mov ebx, 0
xor esi, ebx
mov ecx, 0
mov edi, 0
xor ecx, edi
xor esi, ecx
mov ebx, 0x3e3de4cb
xor ebx, 0x19bee2a0
push ebx
mov ebx, 0x6019476c
mov edx, 0x479ad507
xor edx, ebx
pop edi
xor edx, edi
xor esi, edx
mov edi, 0xfffffffc
add esp, edi
mov ecx, esp
mov ebx, ecx
mov dword [ebx], esi
mov ebx, 0x4ee61a24
xor ebx, 0x52cf9f55
mov ecx, 0x1c699571
xor ebx, ecx
mov edx, 0
mov edi, 0
xor edx, edi
push 0x66b5f3cb
mov esi, 0x66b5f3cb
pop edi
xor esi, edi
xor edx, esi
xor ebx, edx
add esp, 0xfffffffc
mov esi, esp
mov ecx, esi
mov dword [ecx], ebx
call eax
pop edi
push 0x566ed41
mov eax, 0x52d36c12
pop ecx
xor eax, ecx
mov edi, 0x7cf0b594
mov esi, 0x3ba9f139
xor esi, edi
xor esi, eax
push 0x7cbf8216
mov ebx, 0x6c7b00dd
pop ecx
xor ebx, ecx
mov edi, 0x200010
mov eax, 0x84400
xor edi, eax
xor ebx, edi
xor ebx, esi
mov eax, 0x28c61b77
xor eax, 0x3c0f53b2
push eax
mov edx, 0x5b3f8968
xor edx, 0x6bf516ef
pop ecx
xor edx, ecx
push 0x472b5e07
mov eax, 0x6368e842
pop edi
xor eax, edi
xor edx, eax
push 0x54b2c6b2
mov ecx, 0xdce2fcd
pop edi
xor ecx, edi
mov eax, 0x18ad434d
xor ecx, eax
xor ecx, 0x70d63b2b
mov eax, 0x3ec310b1
xor eax, 0xcb67960
push eax
mov esi, 0x1322088
mov eax, 0x2008041
xor esi, eax
pop edi
xor esi, edi
xor esi, ecx
mov ecx, ebx
mov eax, 4
mov edi, 0
xor eax, edi
sub esp, eax
mov dword [esp], ecx
mov eax, 4
sub esp, eax
xor edi, edi
add edi, esp
mov dword [edi], esi
xor ebx, ebx
mov bl, byte [edx]
add esi, ebx
mov bl, byte [esi]
pop esi
mov byte [edx], bl
mov edi, 0x54186021
mov eax, 0x1401994
xor edi, eax
mov ecx, 0x555879b4
xor edi, ecx
sub edx, edi
pop ebx
mov edi, 0x2e255de1
xor edi, 0x2e255de0
sub ebx, edi
mov ecx, ebx
sub ecx, 0
jne 0x406471
mov esi, 0x4000000
mov edx, 0x400000
xor esi, edx
push 0x58726f30
mov edi, 0x58df2b78
pop ebx
xor edi, ebx
xor esi, edi
push esi
pop edi
mov eax, 0xffffffff
xor edi, eax
and edi, 0x4ad19ab
and esi, 0xfb52e654
or esi, edi
call esi
pop edx
pop edx
ret
Function at 0x4384e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [edx + 0x10]
lock inc dword [eax]
jle 0x4385c9
mov edi, dword [edx + 0x14]
mov dword [esp + 4], eax
mov esi, edx
lock inc dword [edi]
jle 0x4385c9
lea eax, [esi + 0x60]
mov ebx, ecx
add ecx, 0x60
push eax
push ecx
call fcn.004d1960
add esp, 8
lea eax, [esi + 0x3c]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.004d1960
add esp, 8
movzx eax, byte [esi + 0x5c]
movsd xmm1, qword [esi + 0x54]
movsd xmm0, qword [esi + 0x4c]
mov ecx, dword [esi + 0x38]
mov byte [esp + 0x4c], al
movsd qword [esp + 0x44], xmm1
mov eax, dword [esi + 0x48]
movups xmm1, xmmword [esi + 0x28]
movsd qword [esp + 0x3c], xmm0
movups xmmword [esp + 0x18], xmm1
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x10], eax
movzx eax, byte [esi + 0x78]
mov dword [esp + 0x14], ecx
lea ecx, [ebx + 0x6c]
mov byte [esp + 3], al
lea eax, [esi + 0x6c]
push eax
push ecx
call fcn.00428050
add esp, 8
mov ecx, dword [esp + 4]
mov eax, dword [esi + 8]
mov edx, dword [esi]
mov ebp, dword [esi + 4]
lea esi, [esp + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], edi
lea edi, [ebx + 0x18]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
movzx ecx, byte [esp + 3]
mov byte [ebx + 0x78], cl
mov dword [ebx + 4], ebp
mov dword [ebx], edx
mov dword [ebx + 8], eax
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4415a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov dword [esi], 0
mov dword [esi + 4], 1
mov dword [esi + 8], 0
push 0x40
push 0
push esi
call fcn.00503700
add esp, 0xc
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dword [ebp + ebx + 0x3b], 0x20202020
mov dword [ebp + ebx + 0x38], 0x20202020
mov dword [ebp + ebx + 0x34], 0x20202020
mov dword [ebp + ebx + 0x30], 0x20202020
mov dword [ebp + ebx + 0x2c], 0x20202020
mov dword [ebp + ebx + 0x28], 0x20202020
mov dword [ebp + ebx + 0x24], 0x20202020
mov dword [ebp + ebx + 0x20], 0x20202020
mov dword [ebp + ebx + 0x1c], 0x20202020
mov dword [ebp + ebx + 0x18], 0x20202020
mov dword [ebp + ebx + 0x14], 0x20202020
mov dword [ebp + ebx + 0x10], 0x20202020
mov dword [ebp + ebx + 0xc], 0x20202020
mov dword [ebp + ebx + 8], 0x20202020
mov dword [ebp + ebx + 4], 0x20202020
mov dword [ebp + ebx], 0x20202020
mov byte [ebp + ebx + 0x3f], 0x20
add ebx, 0x40
mov eax, dword [esi]
mov dword [esi + 8], ebx
sub eax, ebx
cmp eax, 0x21
jbe 0x4416ad
lea eax, [ebp + ebx]
push 0x22
push str.TLS_1.3__client_CertificateVerify
push eax
call fcn.004f5b80
add esp, 0xc
mov edi, dword [edi + 0x40]
add ebx, 0x22
mov dword [esi + 8], ebx
cmp edi, 0x41
jae 0x4416d4
mov eax, dword [esi]
sub eax, ebx
cmp eax, edi
jb 0x4416c1
add ebp, ebx
push edi
push dword [esp + 0x1c]
push ebp
call fcn.004f5b80
add esp, 0xc
add ebx, edi
mov eax, esi
mov dword [esi + 8], ebx
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x22
push ebx
push esi
call fcn.00503700
add esp, 0xc
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
jmp 0x441667
push edi
push ebx
push esi
call fcn.00503700
add esp, 0xc
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
jmp 0x441691
ud2
Function at 0x4416e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov dword [esi], 0
mov dword [esi + 4], 1
mov dword [esi + 8], 0
push 0x40
push 0
push esi
call fcn.00503700
add esp, 0xc
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dword [ebp + ebx + 0x3b], 0x20202020
mov dword [ebp + ebx + 0x38], 0x20202020
mov dword [ebp + ebx + 0x34], 0x20202020
mov dword [ebp + ebx + 0x30], 0x20202020
mov dword [ebp + ebx + 0x2c], 0x20202020
mov dword [ebp + ebx + 0x28], 0x20202020
mov dword [ebp + ebx + 0x24], 0x20202020
mov dword [ebp + ebx + 0x20], 0x20202020
mov dword [ebp + ebx + 0x1c], 0x20202020
mov dword [ebp + ebx + 0x18], 0x20202020
mov dword [ebp + ebx + 0x14], 0x20202020
mov dword [ebp + ebx + 0x10], 0x20202020
mov dword [ebp + ebx + 0xc], 0x20202020
mov dword [ebp + ebx + 8], 0x20202020
mov dword [ebp + ebx + 4], 0x20202020
mov dword [ebp + ebx], 0x20202020
mov byte [ebp + ebx + 0x3f], 0x20
add ebx, 0x40
mov eax, dword [esi]
mov dword [esi + 8], ebx
sub eax, ebx
cmp eax, 0x21
jbe 0x4417ed
lea eax, [ebp + ebx]
push 0x22
push str.TLS_1.3__server_CertificateVerify
push eax
call fcn.004f5b80
add esp, 0xc
mov edi, dword [edi + 0x40]
add ebx, 0x22
mov dword [esi + 8], ebx
cmp edi, 0x41
jae 0x441814
mov eax, dword [esi]
sub eax, ebx
cmp eax, edi
jb 0x441801
add ebp, ebx
push edi
push dword [esp + 0x1c]
push ebp
call fcn.004f5b80
add esp, 0xc
add ebx, edi
mov eax, esi
mov dword [esi + 8], ebx
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x22
push ebx
push esi
call fcn.00503700
add esp, 0xc
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
jmp 0x4417a7
push edi
push ebx
push esi
call fcn.00503700
add esp, 0xc
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
jmp 0x4417d1
ud2
Function at 0x445870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x148
mov ecx, dword [esp + 0x174]
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov eax, dword [esp + 0x170]
mov esi, dword [esp + 0x178]
movsd xmm1, qword [ecx + 8]
movsd xmm2, qword [ecx + 0x10]
movsd xmm0, qword [ecx]
cmp dword [eax], 0
movsd qword [esp + 0xc], xmm1
movsd xmm1, qword [ecx + 0x18]
movsd qword [esp + 0x14], xmm2
movsd xmm2, qword [ecx + 0x20]
movsd qword [esp + 4], xmm0
movsd qword [esp + 0x1c], xmm1
movsd xmm1, qword [ecx + 0x28]
movsd qword [esp + 0x24], xmm2
movsd xmm2, qword [ecx + 0x30]
movsd qword [esp + 0x2c], xmm1
movsd xmm1, qword [ecx + 0x38]
movsd qword [esp + 0x34], xmm2
movsd qword [esp + 0x3c], xmm1
mov dword [esp + 0x74], esi
je 0x4459c3
add eax, 4
lea ecx, [esp + 0xc3]
push 0x44
push eax
push ecx
call fcn.004f5b80
add esp, 0xc
lea eax, [esp + 0xc0]
lea edi, [esp + 0x78]
push 0x47
push eax
push edi
call fcn.004f5b80
add esp, 0xc
mov byte [esp + 0xc0], 0
lea eax, [esp + 0xc1]
push 0x47
push edi
push eax
call fcn.004f5b80
add esp, 0xc
mov edx, dword [esp + 0x104]
cmp edx, 0x41
jae 0x445afb
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
mov esi, 0x16
mov ebp, str.extended_master_secretmaster_secret.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rustls_0.22.2_src_tls12mod.rs
lea edi, [esp + 0xc4]
jmp 0x445a67
movsd xmm0, qword [ecx + 0x18]
movsd xmm1, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm3, qword [ecx + 8]
movsd xmm4, qword [esp + 0x3c]
movsd xmm5, qword [esp + 0x34]
movsd xmm6, qword [esp + 0x24]
movsd xmm7, qword [esp + 0x2c]
lea edi, [esp + 0xc1]
mov byte [esp + 0xc0], 1
lea eax, [esp + 0x78]
movsd qword [esp + 0x78], xmm2
movsd qword [esp + 0x80], xmm3
movsd qword [esp + 0x88], xmm1
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0x98], xmm6
movsd qword [esp + 0xa0], xmm7
movsd qword [esp + 0xa8], xmm5
movsd qword [esp + 0xb0], xmm4
push 0x47
push eax
push edi
call fcn.004f5b80
add esp, 0xc
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
mov edx, 0x40
mov esi, 0xd
mov ebp, 0x51e9ca
mov dword [esp], eax
mov ebx, dword [esp + 0x15c]
lea eax, [esp + 0x44]
push edx
push edi
push esi
mov esi, eax
push ebp
push dword [esp + 0x17c]
push dword [esp + 0x17c]
push dword [esp + 0x17c]
push dword [esp + 0x17c]
push eax
push ecx
lea eax, [esp + 0xa0]
push eax
mov eax, dword [esp + 0x2c]
call dword [eax + 0x10]
add esp, 0x2c
movzx eax, byte [esp + 0x78]
cmp al, 0x14
jne 0x445ac3
lea esi, [esp + 4]
mov ecx, 0x1d
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
jmp 0x445aee
movsd xmm1, qword [esp + 0x80]
movsd xmm0, qword [esp + 0x79]
movsd qword [ebx + 8], xmm1
movsd qword [ebx + 1], xmm0
mov byte [ebx], al
mov dword [ebx + 0x70], 0
push esi
call fcn.00452930
add esp, 4
mov eax, ebx
add esp, 0x148
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x44e380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edx, esp
movzx esi, byte [edi]
mov ecx, ebx
mov dword [esp], esi
call fcn.0044e4c0
test esi, esi
je 0x44e3da
movzx esi, byte [edi + 1]
mov edx, esp
mov ecx, ebx
mov dword [esp], esi
call fcn.0044e4c0
add edi, 2
test esi, esi
je 0x44e491
mov dword [esp], 0x10
mov edx, esp
mov ecx, ebx
push 4
call fcn.00404670
add esp, 4
mov eax, 0x10
jmp 0x44e4ab
mov esi, ebx
cmp dword [edi + 4], 0
mov ebx, dword [edi + 0xc]
mov ebp, dword [edi + 8]
cmovne ebp, ebx
cmovne ebx, dword [edi + 0x10]
test ebx, ebx
je 0x44e48c
add ebx, ebp
mov edi, esp
jmp 0x44e41f
inc ebp
mov edx, eax
lea ecx, [eax - 0x41]
xor edx, 0x20
cmp ecx, 0x1a
mov ecx, esi
cmovae edx, eax
mov dword [esp], edx
mov edx, edi
call fcn.0044e4c0
cmp ebp, ebx
je 0x44e48c
movzx eax, byte [ebp]
test al, al
jns 0x44e400
mov edi, esi
movzx esi, byte [ebp + 1]
mov ecx, eax
and ecx, 0x1f
and esi, 0x3f
cmp al, 0xdf
jbe 0x44e46d
movzx edx, byte [ebp + 2]
shl esi, 6
and edx, 0x3f
or edx, esi
cmp al, 0xf0
jb 0x44e479
movzx eax, byte [ebp + 3]
and ecx, 7
shl edx, 6
mov esi, edi
mov edi, esp
shl ecx, 0x12
and eax, 0x3f
or eax, edx
or eax, ecx
cmp eax, 0x110000
je 0x44e48c
add ebp, 4
jmp 0x44e401
shl ecx, 6
add ebp, 2
or ecx, esi
mov eax, ecx
jmp 0x44e483
shl ecx, 0xc
add ebp, 3
or edx, ecx
mov eax, edx
mov esi, edi
mov edi, esp
jmp 0x44e401
add esp, 4
jmp 0x44e4b8
mov dword [esp], 4
mov edx, esp
mov ecx, ebx
push 4
call fcn.00404670
add esp, 4
mov eax, 4
mov ecx, ebx
mov edx, edi
push eax
call fcn.00404670
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret