joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e0e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d2e8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4cc06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 8]
mov dword [ebx], vtable.WinProcessCommandLine.0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x10
mov byte [ebp - 4], 2
call fcn.0047217f
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ecx, esi
call fcn.00450360
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
mov dword [ebx + 4], eax
add eax, 4
cmp ecx, eax
je 0x44e19e
push dword [ebp - 0x14]
push dword [eax + 4]
push dword [eax]
call fcn.0046ffe0
mov eax, dword [ebp - 0x1c]
xor esi, esi
mov ecx, dword [ebp - 0x20]
sub eax, ecx
sar eax, 4
test eax, eax
je 0x44e224
xor ebx, ebx
mov eax, dword [ebx + ecx + 4]
lea edx, [ebx + ecx]
cmp word [eax], 0x2d
je 0x44e205
mov ecx, dword [edi + 4]
cmp dword [edi + 8], ecx
je 0x44e1fa
mov dword [ecx], vtable.StringStorage.0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 4
mov eax, dword [ecx]
push dword [edx + 4]
call dword [eax + 4]
mov byte [ebp - 4], 2
add dword [edi + 4], 0x10
jmp 0x44e20e
push edx
push ecx
mov ecx, edi
call fcn.00423d30
jmp 0x44e20e
mov ecx, dword [ebp - 0x10]
push edx
call fcn.0044e280
mov eax, dword [ebp - 0x1c]
inc esi
mov ecx, dword [ebp - 0x20]
add ebx, 0x10
sub eax, ecx
sar eax, 4
cmp esi, eax
jb 0x44e1b1
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00423c50
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44ee90
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4d02f4]
sub esp, 0x2c
push esi
mov esi, ecx
test eax, eax
je 0x44eeac
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push 0
mov dword [0x4d02f4], 0
mov dword [0x4d02f8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push eax
push 0x44ee40
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4d02f4], eax
test eax, eax
je 0x44eee2
pop esi
mov esp, ebp
pop ebp
ret
push 0x4bad74
lea ecx, [esp + 0xc]
call fcn.0044ff80
push 0x4ca358
lea eax, [esp + 0xc]
push eax
call fcn.0047354d
int3
Function at 0x44f0e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d4e0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4cc06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 4], 0
jne 0x44f129
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ecx
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
mov bl, 1
push edi
call fcn.0044f000
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], 0
call fcn.0044f330
test al, al
je 0x44f1af
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x44f1af
push ecx
push esi
lea ecx, [ebp - 0x20]
call fcn.0044f640
push 0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
push dword [ebp - 0x20]
call fcn.0044f330
test esi, esi
je 0x44f1a1
xor edi, edi
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3c]
push dword [edi + eax + 4]
call fcn.0044f0e0
neg al
lea edi, [edi + 0x10]
sbb al, al
and bl, al
sub esi, 1
jne 0x44f181
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00423c50
jmp 0x44f1b1
xor bl, bl
mov eax, dword [edi + 4]
test eax, eax
jne 0x44f1bc
xor dl, dl
jmp 0x44f1cb
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete dl
xor ecx, ecx
movzx eax, bl
test dl, dl
mov dword [ebp - 0x3c], vtable.RegistryKey.0
cmovne ecx, eax
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x44f1f9
cmp ecx, dword [ebp - 0x34]
je 0x44f1f2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
call fcn.0043a180
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44f220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d508
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4cc06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x44f267
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push ecx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44f251
mov eax, dword [ebp - 0x10]
push ecx
inc eax
lea ecx, [ebp - 0x20]
push eax
call fcn.00425d40
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44f2be
xor bl, bl
jmp 0x44f2d9
mov eax, dword [ebp - 0x10]
cmp word [esi + eax*2], 0
je 0x44f2ce
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, dword [ebp + 0xc]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov bl, 1
test esi, esi
je 0x44f309
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x44f2ff
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f31f
push ecx
push esi
call fcn.00471cb1
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0047d9a1
int3
Function at 0x44f330
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d548
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4cc06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [esi + 4], 0
jne 0x44f379
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], vtable.StringStorage.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00421760
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4b0eac
push ecx
call fcn.004735c0
add esp, 0xc
mov dword [ebp - 4], 1
mov edi, 0x400
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
push 0x401
mov ecx, eax
call fcn.00421760
push edi
push dword [ebp - 0x20]
push ebx
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
je 0x44f44a
cmp esi, 0xea
jne 0x44f456
add edi, 0x400
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
lea eax, [edi + 1]
push eax
call fcn.00421760
mov eax, dword [ebp - 0x14]
push edi
push dword [ebp - 0x20]
push ebx
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x44f415
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x20]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x44f4a8
mov eax, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
lea edx, [eax + eax]
mov eax, ecx
cmp edx, 0x1000
jb 0x44f489
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f541
push edx
push ecx
call fcn.00471cb1
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test esi, esi
jne 0x44f513
cmp dword [ebp + 8], 0
mov esi, dword [ebp - 0x10]
je 0x44f4bf
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x2c]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
inc ebx
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x30], vtable.StringStorage.0
test edx, edx
je 0x44f381
mov ecx, dword [ebp - 0x24]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x44f504
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f541
push ecx
push edx
call fcn.00471cb1
add esp, 8
jmp 0x44f381
lea ecx, [ebp - 0x30]
call fcn.0043a180
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44f524
mov dword [eax], ebx
cmp esi, 0x103
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0047d9a1
int3
Function at 0x44fc50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x4cc06c]
xor eax, esp
mov dword [esp + 0x1a8], eax
push esi
mov esi, ecx
lea eax, [esp + 0x18]
push eax
push 0x102
mov dword [esi], vtable.WsaStartup.0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x44fc9e
mov ecx, dword [esp + 0x1ac]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00471ca0
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 4]
push str.Failed_to_initialize_WsaStartup.
push eax
call fcn.0043a6d0
add esp, 8
lea eax, [esp + 4]
push 0x4ca0f8
push eax
call fcn.0047354d
int3
Function at 0x4537e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push esi
mov esi, ecx
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [esp + 0x14], ecx
jg 0x45380e
jl 0x453841
cmp dword [esp + 0x10], eax
jb 0x453841
push 1
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esi + 4]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x45383a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x453862
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x18]
push str.Specified_file_pointer_position_is_more_than_file_length
push eax
call fcn.0043a6d0
add esp, 8
lea eax, [esp + 0x18]
push 0x4ca0f8
push eax
call fcn.0047354d
push str.Cannot_set_file_pointer_to_specified_position
lea ecx, [esp + 0x1c]
call fcn.0044ff80
push 0x4ca358
lea eax, [esp + 0x1c]
push eax
call fcn.0047354d
int3

Function at 0x454430
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0xcc
je 0x45445a
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x4544e3
mov ecx, dword [esi + 0x78]
lea ebx, [esi + 0x78]
nop dword [eax]
cmp ecx, dword [esi + 0x60]
jae 0x4544b6
mov eax, dword [esi + 8]
mov edi, ecx
test eax, eax
je 0x454497
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
mov edi, dword [ebx]
add esp, 4
mov eax, dword [esi + 0x19c]
push 0
push ebx
push 0
mov eax, dword [eax + 4]
push esi
call eax
mov ecx, dword [ebx]
add esp, 0x10
cmp ecx, edi
je 0x4544f9
cmp ecx, dword [esi + 0x60]
jb 0x454475
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
xor ecx, ecx
mov eax, dword [esi + 0x198]
add esp, 8
cmp byte [eax + 8], cl
jne 0x454470
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x459230
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, ecx
push ebx
push esi
push edi
mov esi, dword [edx + 0x4c]
mov ebx, 0x100
mov edi, dword [edx + 0x1c0]
cmp esi, 1
mov dword [ebp - 0xc], edx
sete al
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov byte [edi + 0x1c], al
mov eax, 0x2fe
push dword [edx + 0x64]
mov ecx, dword [edx + 4]
cmovne eax, ebx
push eax
push 1
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov dword [edi + 0x18], eax
add esp, 0x10
mov eax, dword [edi + 0x14]
mov dword [ebp - 8], ebx
cmp dword [ecx + 0x64], ebx
jle 0x45935a
nop dword [eax]
mov ecx, dword [edi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
cmp esi, 1
jne 0x4592ac
mov eax, dword [edi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [edi + 0x18]
lea edi, [ecx*2 - 2]
mov eax, dword [eax + ebx*4]
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ecx + 0xfe]
cdq
idiv edi
xor esi, esi
mov edx, eax
nop dword [eax + eax]
cmp esi, edx
jle 0x4592f4
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x4592e2
mov eax, dword [ebp - 0x10]
movzx eax, al
movzx ecx, bl
imul ecx, eax
mov eax, dword [ebp - 4]
mov byte [esi + eax], cl
inc esi
mov ecx, dword [ebp - 0x14]
cmp esi, 0xff
jle 0x4592d0
mov esi, dword [ebp - 0x18]
cmp esi, 1
jne 0x459341
mov ebx, eax
mov ecx, esi
lea edx, [ebx - 1]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x459321
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0x10]
jl 0x459290
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x30393ccd
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7ec46f18
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10030ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10030abf
pop dword [ebp - 0x44]
mov eax, 0xa0b4a472
sub eax, 0x90b199b3
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x68b79944
sub dword [ebp - 0x54], 0x1a6553f9
mov dword [ebp - 0x50], 0x9734d63e
sub dword [ebp - 0x50], 0x650189f9
mov dword [ebp - 0x4c], 0xc521640
sub dword [ebp - 0x4c], 0xc005d212
mov dword [ebp - 0x48], 0x22197a90
add dword [ebp - 0x48], 0xdde68570
lea eax, [ebp - 0x54]
push eax
mov eax, 0x27c7fd4d
sub eax, 0x17c45cd1
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xe3cf791c
add dword [ebp - 0x54], 0x90a2f03a
mov dword [ebp - 0x50], 0x732402c
add dword [ebp - 0x50], 0x3a3a2149
mov dword [ebp - 0x4c], 0xc1dc2480
sub dword [ebp - 0x4c], 0x5e6cb814
mov dword [ebp - 0x48], 0x166da00d
sub dword [ebp - 0x48], 0x166da00d
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xe150427e
sub eax, 0xd14ca21e
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36ed1
push 0
call eax
mov ecx, 0x20c3104c
add ecx, 0xdf3d2efe
mov edi, eax
mov edx, 0xd428de30
sub edx, 0xc421e830
add edx, dword [ebp - 0x44]
mov esi, 0xb46f3e1b
add esi, 0x8ccf95a4
add dword [ebp - 0x1c], edx
mov ebx, dword [edx]
xor ebx, esi
add dword [ebp - 8], 0x784b980b
mov dword [edi], ebx
sub dword [ebp - 0x40], esi
add edi, 0xab2a5034
add edi, 0x54d5afd0
add edx, 4
loop 0x10030be1
add eax, 0xb76c5997
add eax, 0x48949664
mov ebx, eax
add eax, 0x405fe323
add eax, 0xbfa01ce2
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402ee4
pop dword [ebp - 0x18]
mov eax, 0xf21c2f40
add eax, 0xe23ffa4
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe0600772
sub dword [ebp - 0x28], 0x920dc227
mov dword [ebp - 0x24], 0x7bd875a6
add dword [ebp - 0x24], 0xb65ad69f
mov dword [ebp - 0x20], 0x25ecb7c8
add dword [ebp - 0x20], 0x265f8c66
mov dword [ebp - 0x1c], 0x6abcd066
sub dword [ebp - 0x1c], 0x6abcd066
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc34855a5
sub dword [ebp - 0x28], 0x4ed5ec4f
mov dword [ebp - 0x24], 0x32a04bea
sub dword [ebp - 0x24], 0xf133ea75
mov dword [ebp - 0x20], 0x68144a92
add dword [ebp - 0x20], 0xfb5b21da
mov dword [ebp - 0x1c], 0x4da2e256
add dword [ebp - 0x1c], 0xb25d1daa
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x42a0c5be
add eax, 0xbd9fbb42
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x367b3
push 0
call eax
mov ecx, 0x9388c1ce
add ecx, 0x6c7783fa
xor esi, esi
add esi, eax
mov edx, 0x833a37fa
sub edx, 0x82f353fa
add edx, dword [ebp - 0x18]
mov edi, 0xc835337
sub edi, 0xea948fe7
add dword [ebp - 0x14], 0x5940fcf8
mov ebx, dword [edx]
xor dword [ebp - 0x14], 0xee9d0033
add ebx, edi
add dword [ebp - 8], 0x708c61b9
mov dword [esi], ebx
sub dword [ebp - 4], ebx
add esi, 0x65703273
sub esi, 0x6570326f
add edx, 4
loop 0x403003
add eax, 0xbd2bdd50
add eax, 0x42d52ca3
mov ebx, eax
add eax, 0xd73d40b0
sub eax, 0xd73d40ab
mov ecx, 0x8c46d892
sub ecx, 0x8c06d892
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4089fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x408a0a
pop dword [ebp - 0x38]
mov eax, 0xee6460f4
sub eax, 0xee23d6ea
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3e578
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x622416e1
add ecx, 0x9ddc3f5f
mov edi, eax
mov ebx, 0x7d2d7f88
sub ebx, 0x7ceb0988
add ebx, dword [ebp - 0x38]
mov esi, 0xce78b959
sub esi, 0xfdc1a48b
xor dword [ebp - 0x24], ecx
mov edx, dword [ebx]
add dword [ebp - 0x34], 0xc82a7366
sub edx, esi
xor dword [ebp - 4], 0xcce21cac
mov dword [edi], edx
sub dword [ebp - 0x1c], edi
add edi, 4
add ebx, 0x7957dbb1
sub ebx, 0x7957dbad
loop 0x408a64
add eax, 0xa5777dd2
add eax, 0x5a89ce01
mov ebx, eax
add eax, 0x5d452888
sub eax, 0x5d452883
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x410f5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42104c]
jne 0x413fe3
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x422720], eax
mov dword [0x42271c], ecx
mov dword [0x422718], edx
mov dword [0x422714], ebx
mov dword [0x422710], esi
mov dword [0x42270c], edi
mov word [0x422738], ss
mov word [0x42272c], cs
mov word [0x422708], ds
mov word [0x422704], es
mov word [0x422700], fs
mov word [0x4226fc], gs
pushfd
pop dword [0x422730]
mov eax, dword [ebp]
mov dword [0x422724], eax
mov eax, dword [ebp + 4]
mov dword [0x422728], eax
lea eax, [ebp + 8]
mov dword [0x422734], eax
mov eax, dword [ebp - 0x320]
mov dword [0x422670], 0x10001
mov eax, dword [0x422728]
mov dword [0x422624], eax
mov dword [0x422618], 0xc0000409
mov dword [0x42261c], 1
mov eax, dword [0x42104c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x421050]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x422668], eax
push 1
call fcn.00415efd
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x402cf0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x422668], 0
jne 0x4140cf
push 1
call fcn.00415efd
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1001d8d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001d8e7
pop dword [ebp - 0x24]
mov eax, 0x49422d7f
add eax, 0xc6bfab68
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x37adc
push 0
mov eax, 0xcf1a1230
sub eax, 0xbf1811ec
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xa7dee305
add ecx, 0x58215f60
mov edi, eax
mov ebx, 0x17556b5b
sub ebx, 0x752015b
add ebx, dword [ebp - 0x24]
mov edx, 0xb7d7836c
add edx, 0x39082dbf
sub dword [ebp - 0x20], 0xdb873e2e
mov esi, dword [ebx]
sub dword [ebp - 0xc], eax
xor esi, edx
mov dword [edi], esi
mov dword [ebp - 8], 0xef1fca09
add edi, 0x1e627dbb
add edi, 0xe19d8249
add ebx, 0x67e27263
sub ebx, 0x67e2725f
loop 0x1001d946
add eax, 0xfc67
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfcdcd4a6
sub ecx, 0xecdcd4a6
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x100092b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100092bf
pop dword [ebp - 0x24]
mov eax, 0x100092bf
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x859e5552
sub dword [ebp - 0x34], 0x374c1007
mov dword [ebp - 0x30], 0x3e2710f7
add dword [ebp - 0x30], 0xf40c3b4e
mov dword [ebp - 0x2c], 0x99daf9ea
add dword [ebp - 0x2c], 0xb2714a44
mov dword [ebp - 0x28], 0xdeb1ba76
add dword [ebp - 0x28], 0x214e458a
lea eax, [ebp - 0x34]
push eax
mov eax, 0xa71930bb
sub eax, 0x9717f06b
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x21c15f3
sub dword [ebp - 0x34], 0x8da9ac9d
mov dword [ebp - 0x30], 0xb8b49005
sub dword [ebp - 0x30], 0x77482e90
mov dword [ebp - 0x2c], 0x8daea54f
add dword [ebp - 0x2c], 0xd5c0c71d
mov dword [ebp - 0x28], 0x511b7262
add dword [ebp - 0x28], 0xaee48d9e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x1e90d05
add eax, 0xe18334f
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x37ec1
push 0
call eax
mov ecx, 0xc79cf6e1
sub ecx, 0xc79cb73c
mov edx, eax
mov ebx, 0x66bdc035
sub ebx, 0x56bbde35
add ebx, dword [ebp - 0x24]
mov esi, 0xb3bd5b99
xor dword [ebp - 0xc], edx
mov edi, dword [ebx]
xor dword [ebp - 0x1c], edi
sub edi, esi
xor dword [ebp - 4], eax
mov dword [edx], edi
sub dword [ebp - 4], esi
add edx, 0x9416f308
sub edx, 0x9416f304
add ebx, 0x3055d866
sub ebx, 0x3055d862
loop 0x100093d6
add eax, 0xf167
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret