joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440560
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebx, dword [edi + 4]
xor esi, esi
mov dword [esp + 0x20], ebx
test ebx, ebx
jle 0x4405a3
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
lea ebp, [edi + 0x21c]
mov ecx, dword [esp + 0x10]
call fcn.00434080
xor eax, dword [ebp]
add dword [esp + 0x10], 4
mov dword [esp + esi*4 + 0x24], eax
inc esi
add ebp, 4
cmp esi, ebx
jl 0x440586
mov ecx, dword [edi + 8]
cmp ecx, 1
lea esi, [esp + 0x44]
mov edx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], esi
jle 0x440668
dec ecx
mov dword [esp + 0x18], ecx
test ebx, ebx
jle 0x440653
mov ebp, eax
lea ecx, [edi + 0x24]
lea edi, [edi + edx*4 + 0x21c]
sub ebp, esi
add edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [eax + ebx*4 + 2]
mov ebx, dword [ebx*4 + 0x47cc70]
shr edx, 8
movzx edx, dl
mov edx, dword [edx*4 + 0x47cc70]
rol edx, 8
rol ebx, 0x10
xor edx, ebx
movzx ebx, byte [ecx + 2]
movzx ebx, byte [eax + ebx*4 + 3]
mov ebx, dword [ebx*4 + 0x47cc70]
ror ebx, 8
xor edx, ebx
movzx ebx, byte [esi + ebp]
xor edx, dword [ebx*4 + 0x47cc70]
add edi, 4
xor edx, dword [edi - 4]
add esi, 4
mov dword [esi - 4], edx
add ecx, 3
sub dword [esp + 0x10], 1
jne 0x4405e2
mov edi, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ecx, eax
mov eax, esi
mov esi, ecx
mov dword [esp + 0x14], esi
jne 0x4405c2
test ebx, ebx
jle 0x440702
lea edx, [edi + edx*4 + 0x21c]
mov dword [esp + 0x18], edx
mov edx, eax
sub edx, esi
lea ecx, [edi + 0x24]
mov ebp, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
lea esp, [esp]
movzx edx, byte [ecx]
mov edx, dword [eax + edx*4]
shr edx, 8
movzx edx, dl
movzx edi, byte [edx + 0x47ca70]
movzx edx, byte [ecx + 1]
movzx edx, byte [eax + edx*4 + 2]
movzx edx, byte [edx + 0x47ca70]
rol edi, 8
rol edx, 0x10
xor edi, edx
movzx edx, byte [ecx + 2]
movzx edx, byte [eax + edx*4 + 3]
movzx edx, byte [edx + 0x47ca70]
ror edx, 8
xor edi, edx
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ebp]
movzx edx, byte [edx + 0x47ca70]
xor edi, edx
mov edx, dword [esp + 0x18]
xor edi, dword [edx]
add edx, 4
mov dword [ebp], edi
add ebp, 4
add ecx, 3
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
jne 0x440690
mov edi, dword [esp + 0x68]
xor ebp, ebp
test ebx, ebx
jle 0x440730
mov ecx, dword [esp + 0x6c]
mov ebx, eax
sub ebx, esi
mov eax, dword [esi]
call fcn.0043fd80
mov dword [esi], 0
mov dword [ebx + esi], 0
inc ebp
add esi, 4
add ecx, 4
cmp ebp, dword [edi + 4]
jl 0x440710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x442860
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, eax
mov esi, ecx
cmp ebx, edi
jne 0x442941
mov eax, dword [esi + 8]
mov ecx, dword [esi]
test eax, eax
jne 0x4428d1
mov eax, dword [esi + 4]
push edi
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
push edx
push eax
call dword [esp + 0x30]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push edi
push ecx
push edx
call fcn.00444960
mov esi, dword [esi]
add esp, 0x20
test edi, edi
jle 0x442a11
mov ecx, esi
mov eax, ebp
sub ecx, ebp
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x4428c0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebx, edi
sub ebx, eax
add ecx, eax
test ebx, ebx
jle 0x4428f0
mov eax, ebp
sub ecx, ebp
mov dword [esp + 0x24], ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0x24], 1
jne 0x4428e3
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
push edx
push eax
call dword [esp + 0x30]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push edi
push ecx
push edx
call fcn.00444960
mov ecx, dword [esi + 8]
mov edx, dword [esi]
add esp, 0x20
lea eax, [ebx + ebp]
test ecx, ecx
jle 0x442a11
sub edx, eax
mov esi, ecx
lea ecx, [ecx]
mov cl, byte [edx + eax]
xor byte [eax], cl
inc eax
sub esi, 1
jne 0x442930
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x442995
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edi
push edx
push eax
call fcn.00444960
mov ecx, dword [esi]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [esp + 0x30]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push edi
push eax
push ecx
call fcn.00444960
mov eax, dword [esi]
add esp, 0x20
test ebx, ebx
jle 0x44298c
sub eax, ebp
mov edi, ebx
jmp 0x442980
mov dl, byte [eax + ebp]
xor byte [ebp], dl
inc ebp
sub edi, 1
jne 0x442980
pop edi
mov dword [esi + 8], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
sub eax, edx
cmp eax, ebx
jge 0x44299d
mov ebx, eax
mov ecx, dword [esi]
add ecx, edx
test ebx, ebx
jle 0x4429bd
mov eax, ebp
sub ecx, ebp
mov dword [esp + 0x10], ebx
lea ecx, [ecx]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0x10], 1
jne 0x4429b0
add dword [esi + 8], ebx
cmp ebx, dword [esp + 0x24]
jge 0x442a11
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
push edx
push eax
call dword [esp + 0x30]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push edi
push ecx
push edx
call fcn.00444960
mov ecx, dword [esp + 0x44]
mov edi, dword [esi + 4]
sub ecx, ebx
add esp, 0x20
lea eax, [ebx + ebp]
test ecx, ecx
jle 0x442a0e
sub edi, eax
mov ebp, ecx
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
sub ebp, 1
jne 0x442a03
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x442b00
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
mov ebx, eax
cmp edi, ebx
jne 0x442bd3
mov eax, dword [esi + 8]
mov ecx, dword [esi]
test eax, eax
jne 0x442b63
mov eax, dword [esi + 4]
push ebx
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [esp + 0x2c]
mov edi, dword [esi]
add esp, 0x14
test ebx, ebx
jle 0x442b50
mov eax, ebp
sub edi, ebp
mov ecx, ebx
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x442b45
mov eax, dword [esi + 4]
push ebx
push ebp
push eax
call fcn.00444960
add esp, 0xc
pop edi
pop ebp
pop ebx
pop ecx
ret
mov edi, ebx
sub edi, eax
add ecx, eax
test edi, edi
jle 0x442b82
mov eax, ebp
sub ecx, ebp
mov dword [esp + 0x20], edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0x20], 1
jne 0x442b75
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebx
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [esp + 0x2c]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
add esp, 0x14
lea eax, [edi + ebp]
test ecx, ecx
jle 0x442bbb
sub edx, eax
lea esp, [esp]
mov bl, byte [edx + eax]
xor byte [eax], bl
inc eax
sub ecx, 1
jne 0x442bb0
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
add edx, edi
push ebp
push edx
call fcn.00444960
add esp, 0xc
pop edi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x442c23
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebx
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [esp + 0x2c]
mov ecx, dword [esi]
add esp, 0x14
test edi, edi
jle 0x442c0d
mov eax, ebp
sub ecx, ebp
mov edx, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
sub edx, 1
jne 0x442c02
mov ecx, dword [esi + 4]
push edi
push ebp
push ecx
call fcn.00444960
add esp, 0xc
mov dword [esi + 8], edi
pop edi
pop ebp
pop ebx
pop ecx
ret
sub eax, edx
cmp eax, edi
jge 0x442c2b
mov edi, eax
mov ecx, dword [esi]
add ecx, edx
test edi, edi
jle 0x442c4d
mov eax, ebp
sub ecx, ebp
mov dword [esp + 0xc], edi
jmp 0x442c40
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0xc], 1
jne 0x442c40
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
push edi
push ebp
push eax
call fcn.00444960
add dword [esi + 8], edi
add esp, 0xc
cmp edi, dword [esp + 0x20]
jge 0x442cbc
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ebx
push ecx
push edx
call fcn.00444960
mov eax, dword [esi]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov edx, dword [esi + 4]
sub eax, edi
add esp, 0x14
lea ecx, [edi + ebp]
test eax, eax
jle 0x442cab
mov edi, edx
sub edi, ecx
mov edx, eax
lea esp, [esp]
mov bl, byte [edi + ecx]
xor byte [ecx], bl
inc ecx
sub edx, 1
jne 0x442ca0
mov edx, dword [esi + 4]
push eax
push ebp
push edx
mov dword [esi + 8], eax
call fcn.00444960
add esp, 0xc
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x442cd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, eax
mov esi, ecx
cmp ebx, ebp
jne 0x442da5
mov eax, dword [esi + 8]
mov ecx, dword [esi]
test eax, eax
jne 0x442d36
mov eax, dword [esi + 4]
push ebp
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [esp + 0x2c]
mov ecx, dword [esi + 4]
push ebp
push edi
push ecx
call fcn.00444960
mov esi, dword [esi]
add esp, 0x20
test ebp, ebp
jle 0x442e80
mov ecx, esi
mov eax, edi
sub ecx, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub ebp, 1
jne 0x442d26
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, ebp
sub ebx, eax
add ecx, eax
test ebx, ebx
jle 0x442d55
mov eax, edi
sub ecx, edi
mov dword [esp + 0x20], ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0x20], 1
jne 0x442d48
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebp
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [esp + 0x2c]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
add edx, ebx
push edi
push edx
call fcn.00444960
mov ecx, dword [esi + 8]
mov edx, dword [esi]
add esp, 0x20
lea eax, [ebx + edi]
test ecx, ecx
jle 0x442e80
sub edx, eax
mov esi, ecx
mov cl, byte [edx + eax]
xor byte [eax], cl
inc eax
sub esi, 1
jne 0x442d95
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x442df3
mov edx, dword [esi + 4]
mov eax, dword [esi]
push ebp
push edx
push eax
call fcn.00444960
mov ecx, dword [esi]
mov edx, dword [esp + 0x20]
push ecx
push edx
call dword [esp + 0x2c]
mov eax, dword [esi + 4]
push ebx
push edi
push eax
call fcn.00444960
mov eax, dword [esi]
add esp, 0x20
test ebx, ebx
jle 0x442deb
sub eax, edi
mov ebp, ebx
lea ecx, [ecx]
mov cl, byte [eax + edi]
xor byte [edi], cl
inc edi
sub ebp, 1
jne 0x442de0
pop edi
mov dword [esi + 8], ebx
pop esi
pop ebp
pop ebx
ret
mov eax, ebp
sub eax, edx
cmp eax, ebx
jge 0x442dfd
mov ebx, eax
mov ecx, dword [esi]
add ecx, edx
test ebx, ebx
jle 0x442e1d
mov eax, edi
sub ecx, edi
mov dword [esp + 0x1c], ebx
lea ecx, [ecx]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0x1c], 1
jne 0x442e10
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
push ebx
push edi
push eax
call fcn.00444960
add dword [esi + 8], ebx
add esp, 0xc
cmp ebx, dword [esp + 0x20]
jge 0x442e80
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ebp
push ecx
push edx
call fcn.00444960
mov eax, dword [esi]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [esp + 0x2c]
mov ebp, dword [esp + 0x34]
mov edx, dword [esi + 4]
sub ebp, ebx
push ebp
push edi
push edx
call fcn.00444960
mov ecx, dword [esi + 4]
add esp, 0x20
lea eax, [ebx + edi]
test ebp, ebp
jle 0x442e7d
sub ecx, eax
mov edi, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x442e72
mov dword [esi + 8], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x443180
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, eax
mov esi, ecx
cmp ebx, edi
jne 0x443251
mov eax, dword [esi + 8]
mov ecx, dword [esi]
test eax, eax
jne 0x4431e4
mov eax, dword [esi + 4]
push edi
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
push edx
push eax
call dword [esp + 0x30]
mov ecx, dword [esi]
add esp, 0x14
test edi, edi
jle 0x4431d3
mov eax, ebp
sub ecx, ebp
mov ebp, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub ebp, 1
jne 0x4431c8
mov ecx, dword [esi + 4]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.00443050
mov ebx, edi
sub ebx, eax
add ecx, eax
test ebx, ebx
jle 0x443203
mov eax, ebp
sub ecx, ebp
mov dword [esp + 0x24], ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0x24], 1
jne 0x4431f6
mov ecx, dword [esi + 4]
mov eax, edi
call fcn.00443050
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
push edx
push eax
call dword [esp + 0x30]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
add esp, 0x14
lea eax, [ebx + ebp]
test ecx, ecx
jle 0x44330e
sub edx, eax
mov esi, ecx
lea ecx, [ecx]
mov cl, byte [edx + eax]
xor byte [eax], cl
inc eax
sub esi, 1
jne 0x443240
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x443295
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edi
push edx
push eax
call fcn.00444960
mov ecx, dword [esi]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [esp + 0x30]
mov eax, dword [esi]
add esp, 0x14
test ebx, ebx
jle 0x44328c
sub eax, ebp
mov edi, ebx
mov edi, edi
mov cl, byte [eax + ebp]
xor byte [ebp], cl
inc ebp
sub edi, 1
jne 0x443280
pop edi
mov dword [esi + 8], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
sub eax, edx
cmp eax, ebx
jge 0x44329d
mov ebx, eax
mov ecx, dword [esi]
add ecx, edx
test ebx, ebx
jle 0x4432bd
mov eax, ebp
sub ecx, ebp
mov dword [esp + 0x10], ebx
lea ecx, [ecx]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub dword [esp + 0x10], 1
jne 0x4432b0
add dword [esi + 8], ebx
cmp ebx, dword [esp + 0x24]
jge 0x44330e
mov ecx, dword [esi + 4]
mov eax, edi
call fcn.00443050
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00444960
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
push edx
push eax
call dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov edi, dword [esi]
sub ecx, ebx
add esp, 0x14
lea eax, [ebx + ebp]
test ecx, ecx
jle 0x44330b
sub edi, eax
mov ebp, ecx
nop
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
sub ebp, 1
jne 0x443300
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x443817
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x477af4]
jne 0x443821
repz ret
jmp fcn.00447b1b
Function at 0x451527
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004489c7
and dword [ebp - 4], 0
cmp dword [0x47df60], 0
mov ebx, eax
jne 0x4515d8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x451689
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x451689
push eax
call fcn.00448955
mov dword [esp], 0x463ef4
push edi
mov dword [0x47df60], eax
call esi
push eax
call fcn.00448955
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47df64], eax
call esi
push eax
call fcn.00448955
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47df68], eax
call esi
push eax
call fcn.00448955
pop ecx
mov dword [0x47df70], eax
test eax, eax
je 0x4515d8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00448955
pop ecx
mov dword [0x47df6c], eax
mov eax, dword [0x47df6c]
cmp eax, ebx
je 0x451630
cmp dword [0x47df70], ebx
je 0x451630
push eax
call fcn.004489d0
push dword [0x47df70]
mov esi, eax
call fcn.004489d0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x451630
test edi, edi
je 0x451630
call esi
test eax, eax
je 0x451627
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x451627
test byte [ebp - 0xc], 1
jne 0x451630
or dword [ebp + 0x10], 0x200000
jmp 0x451669
mov eax, dword [0x47df64]
cmp eax, ebx
je 0x451669
push eax
call fcn.004489d0
pop ecx
test eax, eax
je 0x451669
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x451669
mov eax, dword [0x47df68]
cmp eax, ebx
je 0x451669
push eax
call fcn.004489d0
pop ecx
test eax, eax
je 0x451669
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47df60]
call fcn.004489d0
pop ecx
test eax, eax
je 0x451689
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45168b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4046b9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437ba9
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4047dc
push ecx
lea ecx, [esi + 0x18]
call fcn.00423ed9
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4047f3
push ecx
lea ecx, [esi + 0x24]
call fcn.00423de9
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44d5a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x44d610
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x44d62d
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x44d696
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00496579
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x44d669
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x44d659
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x44d690
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d6ea
inc edi
cmp edi, ecx
jb 0x44d67d
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00480f19
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494df5
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x44d690
cmp dword [esi + 0x14], 0x10
jb 0x44d6f9
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x44d713
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00496579
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x44d749
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x44d739
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d787
cmp ecx, edx
je 0x44d7fe
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x44d76f
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0046c4e9
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00481049
mov eax, esi
jmp 0x44d6cf
or ecx, 0xffffffff
jmp 0x44d789