joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ffd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x44001c
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x440006
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x440015
mov dword [esi], ebx
call fcn.0042a9a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4408f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0
test ebx, ebx
je 0x44094f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x440939
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x440948
mov dword [esi], ebx
call fcn.0042a9a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x4409c4
lea eax, [ebp - 0x18]
push 0x407b10
push eax
call fcn.004240c0
add esp, 8
mov ebx, eax
lea eax, [ebp + 8]
push 0x407b10
push eax
call fcn.004240c0
add esp, 8
lea edi, [ebp - 0x14]
mov ecx, edi
push ebx
push eax
push str.handle___::GetCurrentProcess__
call fcn.00424270
cmp dword [ebp - 0x14], 0
je 0x4409c4
lea ebx, [ebp - 0x1c]
push edi
push 0x1f
push str..._.._base_process_process_win.cc
push ebx
call fcn.00423d80
add esp, 0x10
mov ecx, ebx
call fcn.00423d50
mov ecx, ebx
call fcn.00423d60
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4409e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x440a01
call fcn.0042a9a0
mov dword [esi], 0
test edi, edi
je 0x440a27
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x440a5f
cmp ebx, 2
jae 0x440a7f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
add eax, 1
cmp eax, 2
jb 0x440a53
call fcn.0042a9a0
push dword [edi]
call fcn.00441df0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x440a20
mov dword [esi], edi
mov edi, eax
call fcn.0042a9a0
mov eax, edi
jmp 0x440a20
Function at 0x440ac0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x440ae2
cmp dword [esi], edi
jne 0x440aeb
jmp 0x440b07
call fcn.0042a9a0
cmp dword [esi], edi
je 0x440b07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x440b3f
cmp ebx, 2
jae 0x440b5f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
add eax, 1
cmp eax, 2
jb 0x440b33
call fcn.0042a9a0
push dword [edi]
call fcn.00441df0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x440b00
mov dword [esi], edi
mov edi, eax
call fcn.0042a9a0
mov eax, edi
jmp 0x440b00

Function at 0x440ce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x440d06
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x440d08
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x440d28
cmp byte [ebp + 0xc], 0
je 0x440d78
cmp byte [esi + 4], 0
je 0x440d6a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x440d6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x440d3c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x440d3e
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x440d55
xor ebx, ebx
jmp 0x440de6
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x440da6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x440da8
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 4], 0
je 0x440d86
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x440d88
mov eax, dword [esi]
push eax
call fcn.0045b970
add esp, 4
mov ecx, dword [0x599bac]
mov bl, 1
test ecx, ecx
je 0x440de6
push edi
push eax
call fcn.00459c50
jmp 0x440de6
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x440dba
mov edi, dword [ebp - 0x14]
cmp byte [esi + 4], 0
je 0x440dc8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x440dca
mov eax, dword [esi]
push eax
call fcn.0045b970
add esp, 4
mov ecx, dword [0x599bac]
test ecx, ecx
je 0x440de4
push edi
push eax
call fcn.00459c50
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4412f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, edx
mov ebx, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x44134a
mov eax, dword [0x5961d0]
cmp eax, 0xffffffff
jne 0x441330
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x5961d0
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x44133b
mov eax, dword [0x5961d0]
mov ebx, 0x100000
test eax, eax
jne 0x44134a
jmp 0x441345
mov dword [0x5961d0], 0
mov ebx, 0x80000
push 0xc
call fcn.00512878
add esp, 4
mov edi, eax
mov dword [eax], esi
mov esi, dword [ebp + 8]
test esi, esi
setne byte [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
push 0
push 0x10000
push edi
push 0x4416b0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x441389
test esi, esi
je 0x4413b6
mov dword [esi], eax
jmp 0x4413c1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x4413a2
cmp eax, 0x5af
je 0x4413a2
cmp eax, 0xe
jne 0x4413da
push ebx
call fcn.00440860
add esp, 4
push edi
call fcn.005128f8
add esp, 4
jmp 0x4413bf
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, eax
mov eax, dword [0x599758]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x441442
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.004342c0
add esp, 8
movzx eax, byte [ebp - 0x1c]
test al, 1
je 0x441416
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x44141b
shr eax, 1
lea ecx, [ebp - 0x1b]
push eax
push ecx
push dword [0x599754]
call fcn.00463b50
add esp, 0xc
test byte [ebp - 0x1c], 1
je 0x4413ab
push dword [ebp - 0x14]
call fcn.005128f8
jmp 0x4413a8
push 0x599758
call fcn.00512977
add esp, 4
cmp dword [0x599758], 0xffffffff
jne 0x4413f9
push 0x20
push str.create_thread_last_error
call fcn.00463b30
add esp, 8
mov dword [0x599754], eax
push 0x599758
call fcn.005129ed
add esp, 4
jmp 0x4413f9

Function at 0x4418c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x596ff8]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x441928
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x441928
cmp dword [ebp - 0x14], 4
jne 0x441928
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8
Function at 0x441940
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00512ef0
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.00516da0
add esp, 0xc
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea eax, [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x441a14
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x4419c9
mov edi, 0x3f4
cmp eax, 1
jne 0x441a14
mov ecx, esi
push ebx
jmp 0x441a0d
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.00516da0
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x441a14
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
call fcn.00421d26
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x441a30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.0052b964
add esp, 4
add eax, eax
add eax, 2
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4421d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x158], eax
mov eax, dword [0x599788]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x442225
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.00512931
mov eax, 0x599784
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x599788
call fcn.00512977
add esp, 4
cmp dword [0x599788], 0xffffffff
jne 0x44220a
lea eax, [esp + 0x40]
push 0x118
push 0
push eax
call fcn.00516da0
add esp, 0xc
mov dword [esp + 0x3c], 0x11c
lea edi, [esp + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x50
call fcn.00512878
add esp, 4
mov esi, eax
mov ebx, dword [esp + 0xc]
mov eax, dword [0x5997c8]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4422d4
mov ecx, esi
push ebx
push 0x5997a4
push edi
call fcn.00442430
mov dword [0x599784], esi
push 0x599788
call fcn.005129ed
add esp, 4
jmp 0x44220a
push 0x5997c8
call fcn.00512977
add esp, 4
cmp dword [0x5997c8], 0xffffffff
jne 0x4422ae
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x5997c4], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x5997b4], xmm1
movups xmmword [0x5997a4], xmm0
push 0x5997c8
call fcn.005129ed
add esp, 4
jmp 0x4422ae

Function at 0x442350
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x5997c8]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4423c4
movzx eax, word [0x5997a4]
cmp eax, 0xc
ja case.0x442390.1
xor esi, esi
jmp dword [eax*4 + 0x544850]
mov esi, 2
jmp case.0x442390.0
mov esi, 4
jmp case.0x442390.0
mov esi, 1
jmp case.0x442390.0
mov esi, 3
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00512931
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x5997c8
call fcn.00512977
add esp, 4
cmp dword [0x5997c8], 0xffffffff
jne 0x442382
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x20]
mov dword [0x5997c4], eax
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
movups xmmword [0x5997b4], xmm1
movups xmmword [0x5997a4], xmm0
push 0x5997c8
call fcn.005129ed
add esp, 4
jmp 0x442382
Function at 0x4437b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x596ff8]
xor ecx, ebp
mov dword [ebp - 8], ecx
test eax, eax
je 0x4437fc
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x4437fc
lea esi, [ebp - 0xc]
push str.success
push 0x20
push str..._.._base_rand_util_win.cc
push esi
call fcn.00423ce0
add esp, 0x10
mov ecx, esi
call fcn.00423d50
mov ecx, esi
call fcn.00423d60
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00512931
add esp, 8
pop esi
pop ebp
ret
Function at 0x444000
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x5997f0]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x444184
jp 0x444184
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x599800]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4441a9
mov eax, dword [0x599810]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4441e2
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea esi, [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x599808]
sbb ebx, dword [0x59980c]
movd xmm0, ebx
movd xmm1, edi
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x53f450]
subpd xmm1, xmmword [0x53f460]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
divsd xmm0, qword [esp + 0x20]
xorpd xmm1, xmm1
movsd xmm2, qword [0x544af8]
ucomisd xmm2, xmm0
ja 0x444184
mov eax, dword [esp + 8]
sub eax, dword [0x5997f8]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x5997fc]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x53f450]
subpd xmm2, xmmword [0x53f460]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x5997f0], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00512931
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x599800
call fcn.00512977
add esp, 4
cmp dword [0x599800], 0xffffffff
jne 0x444072
rdtsc
mov dword [0x5997f8], eax
mov dword [0x5997fc], edx
push 0x599800
call fcn.005129ed
add esp, 4
jmp 0x444072
push 0x599810
call fcn.00512977
add esp, 4
cmp dword [0x599810], 0xffffffff
jne 0x444093
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x59980c], ecx
mov dword [0x599808], eax
push 0x599810
call fcn.005129ed
add esp, 4
jmp 0x444093
Function at 0x445610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x4456c3
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov byte [esp + 8], 0x12
mov dword [esp + 0xd], 0x65647261
mov dword [esp + 9], 0x63736964
mov word [esp + 0x11], 0x64
push 0x40
call fcn.00512878
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.00445520
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.004444a0
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x4456ad
mov ecx, edi
call fcn.004444f0
push edi
call fcn.005128f8
add esp, 4
test byte [esp + 8], 1
je 0x4456c0
push dword [esp + 0x10]
call fcn.005128f8
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00512931
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44a750
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
mov ecx, dword [eax + 4]
mov edi, edx
shr edi, 1
mov dword [ebp - 0x28], edx
test dl, 1
mov edx, dword [eax + 8]
mov dword [ebp - 0x14], ecx
lea esi, [edx + ecx]
mov dword [ebp - 0x24], edi
lea edi, [eax + edi + 1]
cmovne edi, esi
lea esi, [eax + 1]
cmovne esi, edx
sub edi, esi
cmp edi, 4
jb 0x44a7c8
mov edx, esi
mov eax, edi
nop word cs:[eax + eax]
nop dword [eax]
imul ecx, dword [edx], 0x5bd1e995
mov ebx, ecx
shr ebx, 0x18
xor ebx, ecx
imul ecx, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, ecx
add edx, 4
add edi, 0xfffffffc
cmp edi, 3
ja 0x44a7a0
jmp 0x44a7cc
mov eax, edi
mov edx, esi
cmp edi, 1
mov dword [ebp - 0x20], esi
je 0x44a7f0
cmp edi, 2
je 0x44a7e7
cmp edi, 3
jne 0x44a7fb
movzx ecx, byte [edx + 2]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [edx + 1]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [edx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov esi, dword [ebp - 0x10]
mov ebx, dword [esi + 4]
xor ecx, ecx
test ebx, ebx
je 0x44a958
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov eax, ebx
shr eax, 1
and eax, 0x55555555
mov ecx, ebx
sub ecx, eax
mov eax, ecx
and eax, 0x33333333
shr ecx, 2
and ecx, 0x33333333
add ecx, eax
mov eax, ecx
shr eax, 4
add eax, ecx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x2c], eax
cmp eax, 1
ja 0x44a862
lea edx, [ebx - 1]
and edx, edi
jmp 0x44a871
mov edx, edi
cmp edi, ebx
jb 0x44a871
mov eax, edi
xor edx, edx
div ebx
mov esi, dword [ebp - 0x10]
mov eax, dword [esi]
mov eax, dword [eax + edx*4]
test eax, eax
mov ecx, 0
je 0x44a958
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x44a958
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x1c], eax
test byte [ebp - 0x28], 1
mov eax, dword [ebp - 0x14]
cmove eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x20]
jmp 0x44a8c8
and eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
cmp eax, ecx
jne 0x44a956
mov ebx, dword [ebx]
test ebx, ebx
je 0x44a956
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x44a920
movzx ecx, byte [ebx + 8]
mov eax, ecx
shr eax, 1
mov edx, eax
test cl, 1
je 0x44a8e1
mov edx, dword [ebx + 0xc]
cmp edx, dword [ebp - 0x14]
jne 0x44a8be
lea edx, [ebx + 8]
add edx, 1
test cl, 1
je 0x44a8f4
mov edx, dword [ebx + 0x10]
jne 0x44a938
cmp dword [ebp - 0x14], 0
je 0x44a952
xor ecx, ecx
nop
movzx edx, byte [ebx + ecx + 9]
cmp dl, byte [esi + ecx]
jne 0x44a8be
add ecx, 1
cmp eax, ecx
jne 0x44a900
jmp 0x44a952
cmp dword [ebp - 0x2c], 1
jbe 0x44a8b0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x44a8b3
xor edx, edx
div ecx
mov eax, edx
jmp 0x44a8b3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x44a952
push eax
push esi
push edx
call fcn.005152ed
add esp, 0xc
test eax, eax
jne 0x44a8be
mov ecx, ebx
jmp 0x44a958
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x44b120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x44b22e
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 0x60], eax
sar eax, 0x1f
mov dword [esp + 0x64], eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.00443a60
mov eax, dword [0x545cc8]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x53f380]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.004681e0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x44b22e
xor esi, esi
jmp 0x44b20a
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x44b22e
cmp byte [esp + esi + 0x51], 8
jne 0x44b200
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x44b200
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x44b200
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00512931
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret