joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424370
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4573b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x128
xor edi, edi
push edi
push esi
call fcn.00429c90
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.0042d799
push eax
call fcn.004026b4
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x448d88]
je 0x4244ce
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4244e2
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4244e2
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
je 0x42442c
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x424420
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.00424177
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
jmp 0x424427
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42442e
mov eax, edi
mov ecx, esi
mov dword [ecx + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00424620
test eax, eax
je 0x424455
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.00423ffe
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x424459
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00424620
test eax, eax
je 0x424480
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.00423ffe
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x424484
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.00424620
test eax, eax
je 0x4244ac
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.00423ffe
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x4244ae
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x4244c0
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x4244ce
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427f18
leave
ret 4
xor eax, eax
jmp 0x4244d1

Function at 0x428cdb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x428d1a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x428d1a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x428d1a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x428d1a
cmp dword [ecx + 0x74], 0xe
jbe 0x428d1a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x436ee0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44c628
push 0x44c620
push str.FlsAlloc
push 0x1f
call fcn.00436d9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436f14
push dword [ebp + 8]
mov ecx, esi
call dword [0x4445c0]
call esi
jmp 0x436f1a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x436f5e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44c638
push 0x44c630
push str.FlsGetValue
push 0x21
call fcn.00436d9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436f95
push dword [ebp + 8]
mov ecx, esi
call dword [0x4445c0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x436f9d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44c640
push 0x44c638
push str.FlsSetValue
push 0x22
call fcn.00436d9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436fd7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4445c0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x439935
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4399d2
push ebx
push esi
call fcn.004398fe
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00438648
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43997f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4399d1
push edi
push eax
call fcn.00435a02
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43999f
call fcn.00435102
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4399d0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00438648
add esp, 0x20
test eax, eax
jne 0x4399be
push edi
call fcn.00435102
jmp 0x4399c6
push ebx
call fcn.00435102
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4399d5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4399e6
pop esi
ret
push ebx
push edi
push esi
call fcn.004398fe
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00435a02
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x439a0e
push ebx
push esi
push edi
call fcn.00429710
add esp, 0xc
push 0
call fcn.00435102
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x439dde
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439a23
Function at 0x440d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x440d2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x440d2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x463e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465560
push 0x463e80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edx, edx
mov dword [ebp - 4], edx
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x1267cf4], 0xffffffff
or dword [0x1267cf8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x1267cf0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x1267cec]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1267cfc], eax
call fcn.0046400f
cmp dword [0x468260], ebx
jne 0x463f13
push 0x46400c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00463ffa
push 0x46800c
push 0x468008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x1267ce8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x1267ce4]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x468004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x463fa6
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x463f7a
cmp al, 0x22
jne 0x463f6c
cmp byte [esi], 0x22
jne 0x463f83
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x463f8d
cmp al, 0x20
jbe 0x463f7f
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x463fb1
movzx eax, word [ebp - 0x2c]
jmp 0x463fb4
cmp byte [esi], 0x20
jbe 0x463f83
inc esi
mov dword [ebp - 0x74], esi
jmp 0x463fa6
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x417bc6
Capabilities:
Encode data using xor

Disassembly:
mov ch, 7
sbb eax, 0x2d2aa0e1
fcomp qword [esi + 0x352d9f9f]
mov al, 0x9d
lahf
lahf
sub byte [0x9f9f9db0], ch
lahf
mov ch, 0x2b
sbb eax, 0x6923a0e1
loope 0x417b36
and ebp, dword [ecx - 0x61]
sub eax, 0x9f9db05d
pop ebp
mov al, 0x9d
lahf
lahf
shl dword [eax + 0x2d], cl
xor eax, 0x9f9f9edc
xchg edx, eax
dec esi
xchg edi, eax
jno 0x417b77
cdq
sub esp, dword [ecx + 0x2b]
xchg edi, eax
sub ebx, dword [edx - 0x6123cad3]
lahf
lahf
popal
mov dword [edx + 0x682b4593], esp
mov byte [0x682b4593], al
shl dword [eax + 0x23], cl
and dword [ebx - 0x78a0bb6d], 0x23a0e116
inc esp
pop edi
xchg dword [esi], edx
loope 0x417b6c
invalid
imul ebx, dword [edi + 0x71974e92], 0x972b99cb
sub ebx, dword [edx + 0x6923712b]
lahf
xchg edx, eax
dec esi
sub ebp, dword [edx - 0x11]
popal
mov dword [edx + 0x6a2b4593], esp
sub eax, 0x9f9edc35
lahf
push 0x2d
xor eax, 0x9f9f9edc
and eax, dword [ecx + 0x5f4493a3]
ja 0x417c0e
loope 0x417b9a
and ebp, dword [ecx - 0x61]
xchg edx, eax
dec esi
xchg edi, eax
jno 0x417bcd
cdq
sub edx, dword [edi + 0x712b9a2b]
and ebp, dword [ecx - 0x61]
xchg edx, eax
dec esi
sub ebp, dword [edx - 0x11]
popal
mov dword [edx + 0x63414593], esp
push ss
loope 0x417bbb
sub ebp, dword [edx + 0x23]
and dword [ebx + 0xa4493f0], 0x1fb59fa8
sbb eax, 0x9ff0a0e1
mov ch, 0x17
sbb eax, 0x2d2da0e1
or byte [edi + 0x2df39f9f], bl
xor eax, 0x9f9f99c8
int1
sub edx, dword [eax + 0x1dfbb59f]
sti
invalid
loope 0x417be9
sub ebx, dword [eax - 0x1ee9a0bf]
mov al, byte [0xf7f0f3f3]
lahf
mov ch, 0xf
sbb eax, 0xb52ba0e1
arpl word [esi], dx
loope 0x417c00
sub eax, 0xf1f398ed
div bh
lahf
mov ch, 0x13
sbb eax, 0x9ff7a0e1
mov ch, 3
sbb eax, 0x252da0e1
or byte [edi - 0x5ef76061], bl
mov al, 0xa0
mov al, byte [0x9edc2d2d]
lahf
lahf
invalid
Function at 0x5f2158
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f2173
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b7398]
pop edx
test eax, eax
je 0x5f2245
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f2234
test dword [ebp - 0x2a8], 1
jne 0x5f2234
and dword [ebp - 0x2a8], 0x100
jne 0x5f2234
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2e6b]
pop edx
pop esi
test eax, eax
je 0x5f21d7
jmp 0x5f2234
cmp word [esi], 0x5a4d
jne 0x5f2234
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f2234
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2c63]
pop edx
test eax, eax
je 0x5f2234
lea eax, [ebp - 0x28c]
push eax
call fcn.005f20b4
test eax, eax
jne 0x5f222d
jmp 0x5f2234
mov eax, esi
jmp 0x5f2245
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f2173
pop esi
leave
ret 4
Function at 0x43c500
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x43ca20
test edx, edx
je 0x43ca20
call fcn.0043c517
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43ca60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0043c500
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x43cad1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x43ca96
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x43d3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x43d464
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x43d43c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x43d444
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0043d469

Function at 0x449630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1db0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x449694
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x4496a5
push 0x48
push esi
call fcn.005ce99e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x449c00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1ed1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
mov dword [ebp - 0x10], 0
call fcn.00483520
mov dword [ebp - 4], 0
mov dword [esi], vtable.CryptoPP::BaseN_Decoder.0
mov dword [esi + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
push dword [ebp + 0x10]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00484070
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00485bd0
mov edi, eax
push 0x14
mov byte [ebp - 4], 3
call fcn.005ce71d
mov ecx, dword [ebp + 8]
mov ebx, eax
add esp, 4
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
mov dword [ebx + 4], str.DecodingLookupArray
mov word [ebx + 8], 1
mov dword [ebx + 0xc], 0
mov dword [ebx], vtable.CryptoPP::AlgorithmParametersTemplate_int_const__.0
mov dword [ebx + 0x10], ecx
mov byte [ebp - 4], 4
mov eax, dword [edi + 4]
mov dword [edi + 4], 0
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x449cfa
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi + 4]
mov dword [ebp + 8], 0
test ecx, ecx
je 0x449d11
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 4], ebx
mov byte [edi + 8], 1
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00485b50
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x449d3d
mov eax, dword [ecx]
push 1
call dword [eax]
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 2
push eax
push str.Log2Base
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], vtable.CryptoPP::NameValuePairs.0
call fcn.00471520
push eax
mov ecx, esi
call fcn.00489a40
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x449d72
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x449d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1db0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
mov edx, dword [esi + 0x38]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x449de7
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x449df8
push 0x3c
push esi
call fcn.005ce99e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44b910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44b96b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x44b96b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x44b958
cmp esi, edx
jae 0x44b96b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x44b946
cmp esi, edx
jae 0x44b96b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x44c450
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x44c472
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x12]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x44c460
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret
Function at 0x456540
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3150
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
call fcn.004566a0
mov edi, eax
cmp byte [edi + 9], 0
je 0x4565ba
xor ebx, ebx
nop dword [eax + eax]
mov eax, 0x29e4129f
lea esi, [ebx + edi]
mul ebx
mov eax, ebx
mov cl, bl
sub eax, edx
inc ebx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul eax, eax, 0x37
sub cl, al
add cl, 0x35
xor byte [esi], cl
cmp ebx, 0xa
jl 0x456590
push edi
lea ecx, [ebp - 0x40]
call fcn.0046efe0
sub esp, 0xc
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.0046edb0
push eax
lea ecx, [ebp - 0x120]
call fcn.0046d4c0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0046ef10
lea eax, [ebp - 0x28]
push eax
call fcn.004566d0
mov edi, eax
cmp byte [edi + 0xa], 0
je 0x45662a
xor ecx, ecx
nop dword [eax]
mov eax, 0x29e4129f
lea esi, [ecx + edi]
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov dl, cl
shr eax, 5
inc ecx
movsx eax, al
imul eax, eax, 0x37
sub dl, al
add dl, 0x35
xor byte [esi], dl
cmp ecx, 0xb
jl 0x456600
push edi
lea ecx, [ebp - 0x70]
call fcn.0046efe0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.0046edb0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00471350
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x120]
call fcn.00471f20
push 0x471f40
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0x58]
call fcn.0046ef10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.0046ef10
lea ecx, [ebp - 0x120]
call fcn.0046d490
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x456d40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov edi, ecx
mov dword [ebp - 0x130], 0x128
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x456de4
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x456de4
mov eax, edi
lea ecx, [ebp - 0x10c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x456dc0
test dl, dl
je 0x456dbc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x456dc0
add ecx, 2
add eax, 2
test dl, dl
jne 0x456da0
xor eax, eax
jmp 0x456dc5
sbb eax, eax
or eax, 1
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x456d94
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ce5ea
mov esp, ebp
pop ebp
ret

Function at 0x45b190
Capabilities:
Execute command
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
mov dword [ebp - 0x74], str..NiGgEr
mov dword [ebp - 0x70], str..KsDumper
nop dword [eax + eax]
push 0
push 0x80
push 3
push 0
push 1
push connect
push dword [ebp + esi*4 - 0x74]
call edi
cmp eax, 0xffffffff
jne 0x45b1f3
inc esi
cmp esi, 2
jl 0x45b1c0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005ce5ea
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x64a740]
lea ecx, [ebp - 0x6c]
movups xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0xc], 0x19011d4c
movaps xmm0, xmmword [0x64a750]
movups xmmword [ebp - 0x5c], xmm0
mov word [ebp - 8], 0x100
movaps xmm0, xmmword [0x64a710]
movups xmmword [ebp - 0x4c], xmm0
movaps xmm0, xmmword [0x64a700]
movups xmmword [ebp - 0x3c], xmm0
movaps xmm0, xmmword [0x64a6e0]
movups xmmword [ebp - 0x2c], xmm0
movaps xmm0, xmmword [0x64a730]
movups xmmword [ebp - 0x1c], xmm0
call fcn.0045b260
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x45b260
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x65], 0
je 0x45b282
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x12]
inc eax
xor byte [edx], cl
cmp eax, 0x64
jb 0x45b270
mov byte [esi + 0x65], 0
mov eax, esi
pop esi
ret