joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e927a73
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x8c], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x90], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x74], eax
mov dword [esp + 8], 0x5c
mov dword [esp + 4], 0
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x6e930260
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xffffffff
jne 0x6e927b31
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libevent_core_2_1_6.dll_evutil_socket_geterror
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x2733
je 0x6e927b74
cmp dword [ebp - 0x6c], 0x2714
je 0x6e927b74
mov dword [esp + 0xc], str.evsig_cb
mov dword [esp + 8], str._s:_recv
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 1
call sym.libevent_core_2_1_6.dll_event_sock_err
cmp dword [ebp - 0x70], 0
je 0x6e927b77
mov dword [ebp - 0x78], 0
jmp 0x6e927b67
mov eax, dword [ebp - 0x78]
add eax, 0x6e930260
movzx eax, byte [eax]
mov byte [ebp - 0x79], al
cmp byte [ebp - 0x79], 0x16
ja 0x6e927b63
movzx eax, byte [ebp - 0x79]
mov edx, dword [ebp + eax*4 - 0x68]
add edx, 1
mov dword [ebp + eax*4 - 0x68], edx
add dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x70]
jl 0x6e927b40
jmp 0x6e927abd
nop
jmp 0x6e927b78
nop
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x6e927b9e
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_core_2_1_6.dll_evthreadimpl_lock_lock_
mov dword [ebp - 0x78], 0
jmp 0x6e927bd3
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x68]
test eax, eax
je 0x6e927bcf
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x68]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sym.libevent_core_2_1_6.dll_evmap_signal_active_
add dword [ebp - 0x78], 1
cmp dword [ebp - 0x78], 0x16
jle 0x6e927ba7
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x6e927bff
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_core_2_1_6.dll_evthreadimpl_lock_unlock_
nop
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6e927c10
call sym.___stack_chk_fail
leave
ret
Function at 0x6e9281fa
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x6e930244]
test eax, eax
jne 0x6e928246
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.evsig_handler
mov dword [esp], str._s:_received_signal__d__but_have_no_base_configured
call sym.libevent_core_2_1_6.dll_event_warnx
jmp 0x6e9282a6
mov dword [esp + 4], sym._evsig_handler
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._signal
mov eax, dword [ebp + 8]
mov byte [ebp - 0x15], al
mov eax, dword [0x6e92a280]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
lea eax, [ebp - 0x15]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSASetLastError]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x6e9282b6
call sym.___stack_chk_fail
leave
ret

Function at 0x6e9287d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x6e928830
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6e9309d8]
test esi, esi
jle 0x6e928930
mov eax, dword [0x6e9309dc]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6e928860
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6e9288df
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6e928850
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x6e928957
mov eax, dword [0x6e9309dc]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x6e9309dc]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6e928937
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6e9288d8
sub eax, 4
and eax, 0xfffffffb
jne 0x6e9288e6
add dword [0x6e9309d8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x6e9309dc]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6e9288d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
xor esi, esi
jmp 0x6e92886a
mov eax, dword [0x6e9309dc]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x42b831
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi - 0x55000004], edx
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
invalid
invalid
stosd dword es:[edi], eax
cld
invalid

Function at 0x42bb98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x42bbae
call fcn.0042a8be
add esp, 0xc
mov dword [ebp - 0x3c8], eax
push 0
push 0x80
push 3
add byte [edx + 3], ch
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x334]
push eax
call dword [ebp - 0x3c8]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
je 0x42ca8c
push 0
push dword [ebp - 0x66c]
call dword [ebp - 0x33c]
mov dword [ebp - 0x378], eax
push dword [ebp - 0x378]
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 4], eax
call fcn.0042a8f9
jg 0x42bc5b
jbe 0x42bb96
and byte [ebp - 0x6dc], 0
and byte [ebp - 0x6db], 0
mov byte [ebp - 0x6da], 0x2c
and byte [ebp - 0x6d9], 0
mov byte [ebp - 0x6d8], 0x81
mov byte [ebp - 0x6d7], 0xb6
mov byte [ebp - 0x6d6], 0xb2
mov byte [ebp - 0x6d5], 0xb7
mov byte [ebp - 0x6d4], 0x95
mov byte [ebp - 0x6d3], 0xba
mov byte [ebp - 0x6d2], 0xbf
mov byte [ebp - 0x6d1], 0xb6
mov byte [ebp - 0x6d0], 0xd3
call fcn.0042a8f9
xchg ecx, eax
jbe 0x42bcbb
dec edx
stc
invalid
Function at 0x43096c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa0], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x27
lea eax, [ebp - 0x2b]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0xa4], esi
mov byte [ebp - 0x2c], 0
call fcn.00450c60
xor eax, eax
mov byte [ebp - 0x40], 0
lea edi, [ebp - 0x3f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x5b
stosb byte es:[edi], al
lea eax, [ebp - 0x9b]
push 0
push eax
mov byte [ebp - 0x9c], 0
call fcn.00450c60
add esp, 0x18
test ebx, ebx
jne 0x4309e1
mov dword [ebp - 0xa0], 0x80290104
jmp 0x430a57
test esi, esi
jne 0x4309f1
mov dword [ebp - 0xa0], 0x80290103
jmp 0x430a57
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
pop ecx
push 5
lea esi, [ebx + 0x34]
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x9c]
lea esi, [ebx + 0xc]
lea edi, [ebp - 0x18]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00455870
push 0x28
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00455930
push dword [ebp - 0xa4]
lea eax, [ebp - 0x9c]
push eax
call fcn.00455a40
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x40]
push 0x14
sub eax, ecx
pop esi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec esi
jne 0x430a4e
push 0x28
pop ecx
pop edi
pop esi
lea eax, [ebp - 0x2c]
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x430a60
push 0x14
pop ecx
lea eax, [ebp - 0x40]
mov byte [eax], 0
inc eax
dec ecx
jne 0x430a6d
push 0x5c
pop ecx
lea eax, [ebp - 0x9c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x430a7d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa0]
xor ecx, ebp
call fcn.0044341a
leave
ret 4

Function at 0x43730e
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, ecx
movzx ecx, word [ecx]
xor eax, eax
test cx, cx
je 0x437334
movzx ecx, cx
movzx ecx, cx
rol eax, 0x10
xor eax, ecx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x437322
mov ecx, dword [ebp + 8]
xor edx, edx
div dword [ecx + 0xc]
mov eax, edx
pop ebp
ret 4

Function at 0x43f558
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x491b14]
test eax, eax
jne 0x43f58a
lea eax, [ebp - 8]
call fcn.0042284c
push 0
push 0xf4240
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00452fc0
mov dword [ebp - 4], edx
mov dword [0x491b14], eax
mul dword [ebp + 8]
push ebx
mov ebx, eax
mov ecx, edx
rdtsc
push esi
push edi
mov esi, eax
mov edi, edx
rdtsc
sub eax, esi
sbb edx, edi
cmp edx, ecx
jb 0x43f59a
ja 0x43f5aa
cmp eax, ebx
jb 0x43f59a
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x442dec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x46c8e4]
mov ecx, dword [ebp + 8]
sub esp, 0x1c
push ebx
mov ebx, dword [ecx + 0x18]
add eax, 0xffffffc8
push edi
cmp ebx, eax
jb 0x442e0a
mov ebx, eax
mov edi, dword [ecx + 0x10]
and dword [ebp - 0x18], 0
mov eax, dword [esi + 4]
lea edx, [edi + ebx]
xor edx, edi
mov dword [ebp - 0xc], eax
test edx, 0xfffff000
jne 0x442e37
test edi, edi
je 0x442e3b
movzx ecx, bx
push ecx
push edi
call fcn.00442c94
mov word [esi], ax
jmp 0x442eb6
test edi, edi
jne 0x442e42
xor eax, eax
mov word [esi], ax
jmp 0x442eb9
mov ecx, edi
and ecx, 0xfff
mov edx, 0x1000
sub edx, ecx
movzx ecx, dx
mov dword [ebp - 8], ecx
movzx ecx, cx
push ecx
push edi
call fcn.00442c94
mov word [esi], ax
movzx eax, word [ebp - 8]
add dword [ebp - 0xc], eax
add edi, eax
mov eax, ebx
sub eax, dword [ebp - 8]
movzx eax, ax
jmp 0x442eae
test edi, edi
je 0x442eb6
mov eax, 0x1000
mov ecx, eax
cmp cx, word [ebp - 0x10]
jb 0x442e8c
movzx eax, word [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, ax
push eax
mov eax, dword [ebp - 0xc]
push edi
call fcn.00442c94
add word [esi], ax
movzx eax, word [ebp - 8]
add dword [ebp - 0xc], eax
add edi, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
test ax, ax
ja 0x442e77
mov ecx, dword [ebp + 8]
movzx eax, word [esi]
sub ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0xc0000001
mov dword [ecx + 8], ebx
movzx eax, word [esi]
push 0x38
mov dword [ecx + 0x1c], eax
pop eax
mov word [ebp - 0x1c], ax
push esi
lea eax, [ebp - 0x1c]
push eax
push 2
mov dword [ebp - 0x18], ecx
call dword [0x491b1c]
pop edi
pop ebx
leave
ret 4

Function at 0x442eee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x10], 0
push ebx
movzx ebx, word [edi + 0x18]
push esi
mov esi, dword [edi + 0x10]
push 0x38
pop eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
movzx eax, bx
lea edx, [eax + esi]
xor edx, esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], ecx
test edx, 0xfffff000
jne 0x442f34
push eax
push ecx
mov eax, esi
call fcn.00442c94
movzx eax, ax
jmp 0x442f96
mov eax, esi
and eax, 0xfff
mov edx, 0x1000
sub edx, eax
movzx eax, dx
mov dword [ebp - 8], eax
movzx eax, ax
push eax
push ecx
mov eax, esi
call fcn.00442c94
movzx eax, ax
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 8]
sub ebx, dword [ebp - 8]
add dword [ebp - 0xc], eax
add esi, eax
test bx, bx
jbe 0x442f93
mov eax, 0x1000
mov ecx, eax
cmp cx, bx
jb 0x442f7a
movzx eax, bx
mov dword [ebp - 8], eax
movzx eax, ax
push eax
push dword [ebp - 0xc]
mov eax, esi
call fcn.00442c94
movzx eax, ax
add dword [ebp - 0x10], eax
jmp 0x442f5a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, eax
sub edx, ecx
neg edx
sbb edx, edx
and edx, 0xc0000001
mov dword [edi + 8], edx
mov dword [edi + 0x1c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [0x491b1c]
pop esi
pop ebx
leave
ret 4
Function at 0x44b7b9
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
and dword [ebx], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20
pop edi
push edi
call fcn.0044a2a4
mov esi, eax
test esi, esi
jl 0x44b87b
push 1
push dword [ebp + 8]
call fcn.0044b152
mov esi, eax
test esi, esi
jl 0x44b87b
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0044b0e3
mov esi, eax
test esi, esi
jl 0x44b87b
cmp word [ebp + 0x10], di
je 0x44b81b
mov esi, 0xc000000d
jmp 0x44b87b
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004446f0
add esp, 0xc
push 1
push dword [ebp + 0xc]
call fcn.0044b152
mov esi, eax
test esi, esi
jl 0x44b87b
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0044b0e3
mov esi, eax
test esi, esi
jl 0x44b87b
cmp word [ebp + 0x10], di
jne 0x44b814
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dl, byte [ecx + edx]
add eax, ecx
xor byte [eax], dl
inc ecx
cmp ecx, edi
jb 0x44b858
push ebx
push edi
push dword [ebp - 4]
push 0x2000
call fcn.0044b523
mov esi, eax
cmp dword [ebp - 4], 0
je 0x44b88a
push edi
push dword [ebp - 4]
call fcn.0044a468
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44c0fb
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x40
pop ebx
push ebx
push 0
push esi
call fcn.00450c60
push dword [ebp + 0x10]
push edi
push esi
call fcn.004446f0
add esp, 0x18
lea edi, [esi + 0x40]
push edi
call fcn.00454000
lea eax, [ebp - 0x44]
xor ecx, ecx
sub esi, eax
lea eax, [ebp + ecx - 0x44]
mov dl, byte [esi + eax]
xor dl, 0x36
inc ecx
cmp ecx, ebx
mov byte [eax], dl
jl 0x44c13f
push ebx
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.00454b30
lea eax, [ebp - 0x44]
mov byte [eax], 0
inc eax
dec ebx
jne 0x44c15e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044341a
leave
ret 0xc
Function at 0x44c176
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x24]
push eax
lea esi, [ebx + 0x40]
push esi
call fcn.00454c40
push esi
call fcn.00454000
mov edi, ebx
lea eax, [ebp - 0x64]
xor ecx, ecx
sub edi, eax
lea eax, [ebp + ecx - 0x64]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
cmp ecx, 0x40
mov byte [eax], dl
jl 0x44c1b0
push 0x40
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.00454b30
push 0x20
pop edi
push edi
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00454b30
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00454c40
mov eax, dword [ebp + 0x10]
cmp eax, edi
jb 0x44c1ef
mov eax, edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x68]
call fcn.004446f0
add esp, 0xc
push 0x40
pop ecx
lea eax, [ebp - 0x64]
mov byte [eax], 0
inc eax
dec ecx
jne 0x44c205
mov ecx, edi
lea eax, [ebp - 0x24]
mov byte [eax], 0
inc eax
dec ecx
jne 0x44c211
mov eax, 0xa8
mov byte [ebx], 0
inc ebx
dec eax
jne 0x44c21d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044341a
leave
ret 0xc
Function at 0x45f03a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
xor ecx, ecx
mov edx, dword [ebp + 8]
xor eax, dword [edx + ecx*4]
inc ecx
cmp ecx, 0x7f
jb 0x45f043
cmp eax, 0xffffffff
jne 0x45f057
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x45f05c
inc eax
pop ebp
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x492351
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ret 4
clc
adc edi, 0x7d
sahf
or ecx, 0xffffffff
test bl, al
inc ecx
lodsd eax, dword [esi]
lea edi, [eax + ebx]
cmp ecx, dword [edx + 0x18]
jmp 0x496e17
cld
pop eax
ja 0x496e3a
xor eax, 0xb7b0bdce
wait
sub eax, dword [esp + 4]
xchg cl, dh
xchg cl, dh
cld
jne 0x492241
jmp 0x496e81
ret
mov edx, ebx
jmp 0x496ecc
nop
push eax
movzx eax, byte [edi]
mov bl, bl
mov al, al
or bh, bh
inc edi
wait
cmc
cld
lea edi, [edi]
cmp ebx, esp
cmc
sub dword [esp], eax
cmp byte [edi], 0
jmp 0x492313
nop
lea edi, [edi]
cld
nop
wait
lea ebx, [ebx]
je 0x49234d
dec ecx
inc ecx
and esi, 0xffffffff
add edi, 0
nop
and eax, 0
mov edx, edx
or cl, 0
sahf
imul eax, eax, 0xf
jmp 0x496dd0
sbb al, 0x61
nop
cmc
mov edi, ebx
mov esi, ebx
nop
nop
inc al
add edi, dword [edx + 0x1c]
jmp 0x496e95
adc eax, edx
test eax, edi
not al
add esi, dword [edx + 0x24]
movzx eax, word [esi + ecx*2]
lea edx, [ebp + 0x60]
lea edx, [esi]
mov esi, ebx
test dl, bl
mov dh, ah
dec dl
add esi, dword [edi + eax*4]
jmp 0x492076
mov edi, edi
add cl, 0x89
mov esi, ebx
mov eax, ebx
cld
nop
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
add esi, dword [edx + 0x20]
jmp 0x492237
Function at 0x402ec4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a8b9d
call fcn.004a7794
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
and dword [edi + 0xc], 0
and dword [ebp - 4], 0
lea ebx, [edi + 0x14]
mov esi, ebx
mov dword [edi], vtable.TiXmlAttribute.0
call fcn.00402f9e
lea esi, [edi + 0x30]
call fcn.00402f9e
push dword [ebp + 0xc]
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00402f32
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00402f32
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x4c], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x405f4b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405f62
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x405f97
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x405f93
cmp edi, eax
jae 0x405f97
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x405f85
cmp edi, eax
jb 0x405f9b
xor eax, eax
jmp 0x405fa5
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x40619c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x40622a
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x4061d3
cmp dword [ebp - 8], 2
jne 0x406229
push esi
mov esi, dword [ebp + 0xc]
call fcn.00405d67
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.00405bfc
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x406211
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov dword [ebp - 0xc], 1
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x406221
push eax
call fcn.0047a9ca
pop ecx
mov edx, esi
call fcn.00405bdb
pop esi
pop edi
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x4065cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4065e3
test al, 0x10
je 0x4065e3
xor eax, eax
inc eax
ret
xor eax, eax
ret