joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49adf8
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebx
push esi
add esp, 0xfffffe3c
mov esi, eax
mov ecx, 0x32
mov eax, 0x4a71e8
lea edx, [esp + 0x190]
mov bl, byte [eax]
mov byte [edx], bl
inc edx
inc eax
dec ecx
jne 0x49ae13
cmp byte [esi + 0x48], 0
jne 0x49aed0
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x49af2f
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [0x4a8dac], eax
cmp dword [0x4a8dac], 0xffffffff
jne 0x49ae62
mov eax, dword [0x4a8dac]
push eax
call sub.wsock32.dll_closesocket
jmp 0x49af2f
mov word [0x4a8db0], 2
xor eax, eax
mov dword [0x4a8db4], eax
push 0x1a6f
call sub.wsock32.dll_htons
mov word [0x4a8db2], ax
push 0x10
push 0x4a8db0
mov eax, dword [0x4a8dac]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x49aea1
mov byte [esi + 0x48], 0
jmp 0x49af2f
mov byte [esi + 0x48], 1
push 1
push 0x401
mov eax, dword [esi + 0x44]
push eax
mov eax, dword [0x4a8dac]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 0x49af38
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a8da8], eax
mov eax, dword [esi + 0x30]
call fcn.00404a34
push eax
call sub.wsock32.dll_inet_addr
mov dword [0x4a8dc4], eax
mov word [0x4a8dc0], 2
push 0x89
call sub.wsock32.dll_htons
mov word [0x4a8dc2], ax
push 0x10
push 0x4a8dc0
push 0
push 0x32
lea eax, [esp + 0x1a0]
push eax
mov eax, dword [0x4a8dac]
push eax
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
je 0x49af2f
cmp eax, 0x32
jne 0x49af2f
mov eax, dword [0x4a8da8]
push eax
call sub.kernel32.dll_ResetEvent
add esp, 0x1c4
pop esi
pop ebx
ret

Function at 0x4a3118
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404a24
xor eax, eax
push ebp
push 0x4a31b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x5e0]
call fcn.00488128
test eax, eax
je 0x4a319d
push 5
push 0
push 0
push 0x4a31cc
mov eax, dword [ebx + 0x5e0]
call fcn.00488128
mov eax, dword [eax + 0x24]
lea edx, [ebp - 0xc]
call fcn.00408b90
push dword [ebp - 0xc]
push 0x4a31d8
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004048fc
mov eax, dword [ebp - 8]
call fcn.00404a34
push eax
push 0
mov eax, ebx
call fcn.0044b54c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a31bf
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045a8
ret

Function at 0x4ca245
Capabilities:
Encode data using xor

Disassembly:
push 0x4c9fca
pop edx
add edi, 0x152f4555
and esi, edi
and esi, esi
call fcn.004ca292
mov edi, esi
sub esi, edi
xor dword [eax], edx
sub esi, 0x1c913a96
mov esi, 0x2a615270
sub edi, 0x3fa698a4
inc eax
add edi, 0x6f55bc1b
cmp eax, ebx
jne fcn.004ca245
mov esi, 0x9cb4c0ec
add esi, 0xff489a8
sub esi, edi
ret
Function at 0x43b652
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edi
add ecx, eax
sub eax, ecx
dec ecx
call fcn.0043b689
dec eax
xor dword [esi], edi
add ecx, 0xf748cd6a
or eax, eax
inc esi
add ecx, eax
and eax, ecx
cmp esi, edx
jne fcn.0043b652
mov eax, 0xad50dd35
add ecx, 0xd46ea7ab
sub eax, 0x36774632
ret
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40891d
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ebx
sub esp, 4
mov dword [esp], 0x6c78048b
pop edx
call fcn.0040894b
add edx, ecx
add edx, edx
xor dword [eax], ebx
inc eax
add edx, 0x85f45a05
sub edx, 0x113cabc4
cmp eax, edi
jne fcn.0040891d
ret
Function at 0x401b45
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00401cf5
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x401c43
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401be6
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x401c29
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x401bfd
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x401c18
test al, 0x40
je 0x401c0f
mov ecx, dword [edi + 0x20]
jmp 0x401c16
test al, 0x80
je 0x401c29
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x401c29
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x401bb5
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x407385
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00407535
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x407483
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x407426
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x407469
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
push esi
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40743d
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x407458
test al, 0x40
je 0x40744f
mov ecx, dword [edi + 0x20]
jmp 0x407456
test al, 0x80
je 0x407469
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x407469
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4073f5
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x407535
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push ebx
push ecx
push edx
push esi
xor ecx, ecx
mov esi, dword fs:[ecx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
mov esi, dword [esi]
cmp byte [edi + 0x18], cl
jne 0x407551
nop
nop
mov dword [ebp - 0x94], eax
push ebp
mov ebp, eax
mov eax, dword [ebp + 0x3c]
mov edx, dword [ebp + eax + 0x78]
add edx, ebp
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, ebp
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, ebp
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x40757a
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40757a
mov ebx, dword [edx + 0x24]
add ebx, ebp
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, ebp
mov eax, dword [ebx + ecx*4]
add eax, ebp
pop ebp
pop esi
pop edx
pop ecx
pop ebx
mov dword [ebp - 0x90], eax
mov cl, 0x72
mov dl, 0x61
mov al, 0x65
xor bl, bl
mov byte [ebp - 0x8c], 0x56
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], cl
mov byte [ebp - 0x89], 0x74
mov byte [ebp - 0x88], 0x75
mov byte [ebp - 0x87], dl
mov byte [ebp - 0x86], 0x6c
mov byte [ebp - 0x85], 0x50
mov byte [ebp - 0x84], cl
mov byte [ebp - 0x83], 0x6f
mov byte [ebp - 0x82], 0x74
mov byte [ebp - 0x81], al
mov byte [ebp - 0x80], 0x63
mov byte [ebp - 0x7f], 0x74
mov byte [ebp - 0x7e], bl
mov byte [ebp - 0x4c], 0x4c
mov byte [ebp - 0x4b], 0x6f
mov byte [ebp - 0x4a], dl
mov byte [ebp - 0x49], 0x64
mov byte [ebp - 0x48], 0x4c
mov byte [ebp - 0x47], 0x69
mov byte [ebp - 0x46], 0x62
mov byte [ebp - 0x45], cl
mov byte [ebp - 0x44], dl
mov byte [ebp - 0x43], cl
mov byte [ebp - 0x42], 0x79
mov byte [ebp - 0x41], 0x41
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x5c], 0x56
mov byte [ebp - 0x5b], 0x69
mov byte [ebp - 0x5a], cl
mov byte [ebp - 0x59], 0x74
mov byte [ebp - 0x58], 0x75
mov byte [ebp - 0x57], dl
mov byte [ebp - 0x56], 0x6c
mov byte [ebp - 0x55], 0x41
mov byte [ebp - 0x54], 0x6c
mov byte [ebp - 0x53], 0x6c
mov byte [ebp - 0x52], 0x6f
mov byte [ebp - 0x51], 0x63
mov byte [ebp - 0x50], bl
mov byte [ebp - 0x3c], 0x56
mov byte [ebp - 0x3b], 0x69
mov byte [ebp - 0x3a], cl
mov byte [ebp - 0x39], 0x74
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], dl
mov byte [ebp - 0x36], 0x6c
invalid
inc ebp
Function at 0x4296d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472d48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.00424630
test eax, eax
jne 0x42973c
push ebp
push 0x4e4f84
mov ecx, edi
call fcn.00428950
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.00423ff0
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00415330
push ebx
mov dword [esp + 0x4c], ebp
call fcn.004247e0
add esp, 4
test eax, eax
je 0x4297df
add esi, 0x18
mov eax, dword [esi]
push ebp
push eax
mov ecx, edi
call fcn.00428a90
mov ebx, dword [esp + 0x58]
mov ebp, eax
lea edi, [esi + 0x18]
mov edx, dword [ebp + 0x28]
lea ecx, [ebx + ebx*4]
mov esi, edi
lea eax, [edx + ecx*4]
push esi
mov dword [esp + 0x5c], eax
call fcn.00415d30
add esi, eax
push esi
call fcn.00415d30
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x429830
mov ecx, dword [esi + 0x1c]
push ecx
call dword [0x47756c]
test eax, eax
je 0x429830
mov eax, 1
jmp 0x429832
xor eax, eax
cmp ebx, 8
jge 0x429a97
cmp ebx, 7
ja 0x429ae2
jmp dword [ebx*4 + 0x419270]
test eax, eax
jne 0x429aaa
mov ecx, dword [esp + 0x10]
push eax
push 6
call dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
xor ecx, ecx
add ebx, 0xfffffff8
push edx
mov dword [esp + 0x20], ecx
push ebx
push esi
mov dword [esp + 0x2c], ecx
call eax
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.00429ff0
Function at 0x437850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
push esi
push 0x3e9
mov dword [esp + 0x38], 0x64
mov dword [esp + 0x24], esi
call fcn.00439e30
mov ebp, eax
push esi
mov ebx, dword [esp + 0xec]
push esi
mov dword [esp + 0x58], ebp
lea edi, [ebx + 0x14]
mov ecx, edi
mov dword [esp + 0x1c], edi
call fcn.00434830
cmp eax, esi
je 0x437dea
cmp dword [esp + 0xec], esi
jne 0x4378e3
lea esi, [eax + 0x18]
push esi
call fcn.004265f0
add esi, eax
push esi
call fcn.004265f0
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x4378e1
mov eax, dword [esi + 0x1c]
push eax
call dword [0x47756c]
test eax, eax
je 0x4378e1
mov eax, dword [esi + 0x1b4]
test eax, eax
je 0x4378f6
push 0
push 0
mov ecx, esi
call fcn.0043ddb0
xor esi, esi
cmp dword [esp + 0xf4], 1
jne 0x437941
mov dword [esp + 0xf8], esi
jmp 0x43795b
mov ecx, dword [esi + 0x1c]
push ecx
call dword [0x477498]
test eax, eax
je 0x43791f
push 9
mov ecx, esi
call 0x48c164
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0x14
mov edx, dword [esi + 0x1c]
push edx
call dword [0x477518]
push eax
call 0x489792
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd4
ret 0x14
mov eax, dword [esp + 0xf8]
cmp eax, esi
je 0x43795b
push eax
call dword [0x47756c]
test eax, eax
je 0x437dea
push esi
push esi
push 0x7d9
call fcn.00439e30
lea ecx, [ebx + 0x34]
push edi
mov dword [esp + 0x24], ecx
call fcn.004347c0
push ebx
mov ecx, ebp
call fcn.00434e60
cmp eax, esi
mov dword [esp + 0x4c], eax
je 0x437dea
lea eax, [esp + 0xb4]
mov ecx, edi
push eax
mov dword [esp + 0xa0], esi
mov dword [esp + 0x14], esi
call fcn.004354c0
cmp eax, esi
mov dword [esp + 0x28], esi
jle 0x4379d1
mov edx, dword [esp + 0xb4]
lea ecx, [esp + 0x28]
push esi
push ecx
push esi
push 0xffffffffffffffff
push eax
push esi
push edx
mov ecx, edi
call fcn.00434830
push eax
call fcn.00445520
add esp, 0x18
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x54]
call fcn.00425bf0
mov esi, 0x4d035c
lea ecx, [esp + 0x7c]
mov dword [esp + 0x54], esi
call fcn.00425bf0
lea ecx, [esp + 0x68]
mov dword [esp + 0x7c], esi
call fcn.00425bf0
lea ecx, [esp + 0x34]
mov dword [esp + 0x68], esi
call fcn.00425bf0
mov esi, dword [ebx + 0x18]
mov ebx, esi
mov dword [esp + 0x30], esi
test esi, esi
mov dword [esp + 0x1c], ebx
jle 0x437cd9
Function at 0x43d5d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4fbf58]
xor edx, edx
cmp eax, edx
jne 0x43d5f6
xor eax, eax
mov byte [eax + 0x4fbe58], al
inc eax
cmp eax, 0x100
jl 0x43d5de
mov dword [0x4fbf58], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4fbe58
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x43d687
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x43d65a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x43d628
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x43d700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x43d753
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43d73a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444190
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x444328
cmp ebp, ebx
jle 0x444328
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x4441ee
dec eax
or eax, 0xfffffff8
inc eax
je 0x4441f5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x444204
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x44420b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call 0x4822b7
add esp, 4
cmp eax, ebx
je 0x44422c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call 0x4822b7
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret

Function at 0x447a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
push eax
mov edx, dword [ecx]
call dword [edx + 0x60]
cmp eax, 1
jne 0x447c72
mov edx, dword [esi]
push 0
push 0
push 0xc
push eax
mov ecx, esi
call dword [edx + 4]
lea ecx, [esp + 0x624]
mov dword [esp + 0x640], 0x32
call 0x48173c
lea ecx, [esp + 0x5c4]
mov byte [esp + 0x640], 0x31
call fcn.00448950
lea ecx, [esp + 0x588]
mov byte [esp + 0x640], 0x30
call 0x48a700
lea ecx, [esp + 0x54c]
mov byte [esp + 0x640], 0x2f
call 0x48a700
lea ecx, [esp + 0x510]
mov byte [esp + 0x640], 0x2e
call 0x48a58f
lea ecx, [esp + 0x4d4]
mov byte [esp + 0x640], 0x2d
call 0x48a58f
lea ecx, [esp + 0x498]
mov byte [esp + 0x640], 0x2c
call 0x48a58f
lea ecx, [esp + 0x45c]
mov byte [esp + 0x640], 0x2b
call 0x48a638
lea ecx, [esp + 0x420]
mov byte [esp + 0x640], 0x2a
call 0x48a58f
lea ecx, [esp + 0x3e4]
mov byte [esp + 0x640], 0x29
call 0x48a700
lea ecx, [esp + 0x3a8]
mov byte [esp + 0x640], 0x28
call 0x48a700
lea ecx, [esp + 0x36c]
mov byte [esp + 0x640], 0x27
call 0x113a700
add byte [eax + eax], al
jmp 0x447b5f
push 0x37
push ecx
push 0x281
mov ecx, esi
call 0x4970e1
push 0x37
push edi
push 0x440000
mov ecx, esi
call 0x4970b0
mov ecx, esi
call fcn.00447a30
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x10
ret 0x10
push eax
add al, 0x8b
add byte [edx + 0x50], dl
mov dword [ecx + 0x10], ebp
call fcn.004313a0
push esi
call fcn.00447400
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10
ret 0x10
Function at 0x44de90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4fbf58]
xor edx, edx
cmp eax, edx
jne 0x44deb6
xor eax, eax
mov byte [eax + 0x4fbe58], al
inc eax
cmp eax, 0x100
jl 0x44de9e
mov dword [0x4fbf58], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4fbe58
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x44df47
xor esi, esi
push ebp
mov byte [esp + 0x20], dl

Function at 0x44dfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x44e013
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x44dffa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x455bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc byte [ebp - 0x39d7dbb4], cl
test byte [eax + esi], ah
adc al, 0
add byte [ecx], al
call 0x48f3a9
lea ecx, [esp + 0x50]
mov byte [esp + 0x1430], 2
call 0x48f3a9
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1430], 3
call 0x48f3a9
mov byte [esp + 0x1430], 4
Function at 0x45d440
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4739c8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x45d479
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call 0x49fd6a
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call 0x49fdb6
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.0045d500
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call 0x49fdf3
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24