joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe8dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe8dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xe8dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe8dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xe8dd94
push eax
push esi
call fcn.00e9020b
add esp, 8
pop esi
ret 0x10

Function at 0xe8dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe8de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xe8de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xea6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e8fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xe8ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xe8de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe8dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xe8deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xea6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e8fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xe8deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xe8de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xe8e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xe8e131
push esi
call fcn.00e91145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00e80080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xe8e131
push 0
push ebp
call fcn.00e803a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00e80260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xe8e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00e802f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xe8e121
push 0xea6918
push edi
call fcn.00e8f3f0
push eax
push ebx
push esi
call fcn.00e8df60
push 0xea68f8
push edi
call fcn.00e8f3f0
push eax
push ebx
push esi
call fcn.00e8df60
push 0xea68d8
push edi
call fcn.00e8f3f0
push eax
push ebx
push esi
call fcn.00e8df60
push 0xea68c0
push edi
call fcn.00e8f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00e8df60
push 0xea68a0
push edi
call fcn.00e8f3f0
push eax
push ebx
push esi
call fcn.00e8df60
push 0xea6888
push edi
call fcn.00e8f3f0
push eax
push ebx
push esi
call fcn.00e8df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xe8f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e8f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e8f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e8f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e8f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe8fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe8fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xea187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe8fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe8fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x404680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x41671c
mov dword [esp + 0x18], 0
call fcn.00404440
mov edi, dword [esi + 0x30]
test edi, edi
je 0x4046da
mov ecx, edi
call fcn.00401760
push edi
call fcn.00407332
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0x42c780
call fcn.00404410
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004068b0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x404b70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004067b0
xor ebx, ebx
mov ecx, 0x42c780
mov dword [esp + 0x18], ebx
mov dword [esi], 0x41671c
call fcn.00404250
mov eax, dword [esp + 0x20]
push 1
push ebx
mov ecx, esi
mov dword [esi + 0x30], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x138], 0x1000
call fcn.004068e0
test al, al
jne 0x404bfe
mov ecx, esi
call fcn.00404680
push esi
call fcn.00407332
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4115c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x41671c
mov dword [esp + 0x18], 0
call fcn.00411380
mov edi, dword [esi + 0x30]
test edi, edi
je 0x41161a
mov ecx, edi
call fcn.0040e6a0
push edi
call fcn.00414272
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0x42c780
call fcn.00411350
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004137f0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x411ab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004136f0
xor ebx, ebx
mov ecx, 0x42c780
mov dword [esp + 0x18], ebx
mov dword [esi], 0x41671c
call fcn.00411190
mov eax, dword [esp + 0x20]
push 1
push ebx
mov ecx, esi
mov dword [esi + 0x30], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x138], 0x1000
call fcn.00413820
test al, al
jne 0x411b3e
mov ecx, esi
call fcn.004115c0
push esi
call fcn.00414272
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x417223
Capabilities:
Encode data using xor

Disassembly:
pop edi
xor eax, 0x4e1baf85
imul edi, dword [ebx + 0x2f27775d], 0xffffffd8
insb byte es:[edi], dx
add eax, 0x8092f05
cmp byte [ebp + 0x6f], 0xd4
cld
loope 0x4171d6
xchg edx, eax
adc al, 0x68
ljmp 0x6220
xlatb
mul byte es:[ecx + 0x5f4109c6]
cmp ebx, edx
pop ecx
sbb al, 0x39
popal
adc byte es:[edx - 0x779214ef], cl
ficomp dword [ecx + 0x1c]
cmp dword [ecx + 0x26], esp
adc byte [edx - 0x779214ef], cl
and al, 0xfe
nop
xor ch, byte [eax - 0xe372466]
test al, 0x9a
fcmovne st(0), st(0)
int1
pop esp
insb byte es:[edi], dx
mov al, 0x1b
jns 0x4171b8
sub al, 0xca
loop 0x4171a3
inc ah
xchg ebp, eax
sub cl, byte [eax - 0x2956fba6]
sbb eax, dword [esi + esi*4]
add al, 0xb6
dec ebp
arpl bx, bx
js 0x417172
xchg ebp, eax
js 0x4171ac
and al, 0xd2
add eax, 0xd990bfc
and ebx, esi
dec ecx
invalid
cmp eax, 0x573035c0
jo 0x41720f
mov eax, dword [0x9dceb4c8]
bound ebp, qword [esi]
mov ebx, 0xfaf8847a
stosd dword es:[edi], eax
mov ebx, 0xb857e415
cdq
push eax
movsd dword es:[edi], dword [esi]
xor al, 0xc8
pop edx
xchg ebx, eax
rcl dword [edi - 0x253efa93], cl
jge 0x417259
rcr edx, 0x7d
inc esi
mov dword [0x9304ca10], eax
add cl, cl
sub byte [edi + edx*8 - 0x2b2161e0], 0x38
jo 0x417274
push eax
push eax
punpckhdq mm0, qword [esi + 0x768298ca]
and dl, ch
push ds
sub dword [eax + 0x4a], 0x4982d839
js 0x4171eb
pop ebx
js 0x4171bc
loope 0x4171dc
adc eax, 0xf76bc102
mov byte [0xfc5e8bc7], al
add dword [edx - 0x1f], esp
mov ebx, dword [eax + 0x576df9bf]
pop edx
out 0x1f, eax
fucom st(0)
mov ebp, 0x18b57b9a
and bh, byte [ebx - 0x77cfdde6]
pushal
pop esp
div byte [edx + 0x1ae10085]
and eax, 0xd82adacd
mov al, 0x5c
cmp ch, dh
scasb al, byte es:[edi]
movsd dword es:[edi], dword [esi]
cmp byte [ecx], ah
invalid
Function at 0x41e5b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x41671c
mov dword [esp + 0x18], 0
call fcn.0041e370
mov edi, dword [esi + 0x30]
test edi, edi
je 0x41e60a
mov ecx, edi
call fcn.0041b690
push edi
call fcn.00421262
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0x42c780
call fcn.0041e340
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004207e0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x41eaa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004206e0
xor ebx, ebx
mov ecx, 0x42c780
mov dword [esp + 0x18], ebx
mov dword [esi], 0x41671c
call fcn.0041e180
mov eax, dword [esp + 0x20]
push 1
push ebx
mov ecx, esi
mov dword [esi + 0x30], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x138], 0x1000
call fcn.00420810
test al, al
jne 0x41eb2e
mov ecx, esi
call fcn.0041e5b0
push esi
call fcn.00421262
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x426ce9
Capabilities:
Encode data using xor

Disassembly:
popfd
popfd
cli
nop
call 0x398c7c48
jbe 0x426ce8
cmc
popal
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
or al, byte [ebx - 0x3d475f75]
das
mov ch, 0xe8
insb byte es:[edi], dx
mov bl, byte es:[ecx]
lea edx, fs:[ecx]
push ds
pop ebp
xor ah, cl
shr byte [eax - 0x3a], cl
push esp
call 0xb429f2a1
push edi
push esi
inc edi
add esp, dword [edx + 0x2f]
pop ds
xlatb
add ebx, edi
mul dword [esi - 0x586b2877]
xchg esi, eax
mov cl, 0xc5
inc esi
je 0x426cf2
xchg ebp, eax
push ds
and byte [ebx + 0xc], dh
invalid

Function at 0x42b790
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x41671c
mov dword [esp + 0x18], 0
call fcn.0042b550
mov edi, dword [esi + 0x30]
test edi, edi
je 0x42b7ea
mov ecx, edi
call fcn.00428870
push edi
call fcn.0042e442
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0x42c780
call fcn.0042b520
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0042d9c0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x42bc80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0042d8c0
xor ebx, ebx
mov ecx, 0x42c780
mov dword [esp + 0x18], ebx
mov dword [esi], 0x41671c
call fcn.0042b360
mov eax, dword [esp + 0x20]
push 1
push ebx
mov ecx, esi
mov dword [esi + 0x30], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x138], 0x1000
call fcn.0042d9f0
test al, al
jne 0x42bd0e
mov ecx, esi
call fcn.0042b790
push esi
call fcn.0042e442
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x438220
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x41671c
mov dword [esp + 0x18], 0
call fcn.00437fe0
mov edi, dword [esi + 0x30]
test edi, edi
je 0x43827a
mov ecx, edi
call fcn.00435300
push edi
call fcn.0043aed2
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0x42c780
call fcn.00437fb0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0043a450
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x438710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0043a350
xor ebx, ebx
mov ecx, 0x42c780
mov dword [esp + 0x18], ebx
mov dword [esi], 0x41671c
call fcn.00437df0
mov eax, dword [esp + 0x20]
push 1
push ebx
mov ecx, esi
mov dword [esi + 0x30], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x138], 0x1000
call fcn.0043a480
test al, al
jne 0x43879e
mov ecx, esi
call fcn.00438220
push esi
call fcn.0043aed2
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x445700
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x41671c
mov dword [esp + 0x18], 0
call fcn.004454c0
mov edi, dword [esi + 0x30]
test edi, edi
je 0x44575a
mov ecx, edi
call fcn.004427e0
push edi
call fcn.004483b2
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0x42c780
call fcn.00445490
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00447930
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x445bf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00447830
xor ebx, ebx
mov ecx, 0x42c780
mov dword [esp + 0x18], ebx
mov dword [esi], 0x41671c
call fcn.004452d0
mov eax, dword [esp + 0x20]
push 1
push ebx
mov ecx, esi
mov dword [esi + 0x30], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x138], 0x1000
call fcn.00447960
test al, al
jne 0x445c7e
mov ecx, esi
call fcn.00445700
push esi
call fcn.004483b2
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x452f50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x41671c
mov dword [esp + 0x18], 0
call fcn.00452d10
mov edi, dword [esi + 0x30]
test edi, edi
je 0x452faa
mov ecx, edi
call fcn.00450030
push edi
call fcn.00455c02
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0x42c780
call fcn.00452ce0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00455180
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x453440
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00455080
xor ebx, ebx
mov ecx, 0x42c780
mov dword [esp + 0x18], ebx
mov dword [esi], 0x41671c
call fcn.00452b20
mov eax, dword [esp + 0x20]
push 1
push ebx
mov ecx, esi
mov dword [esi + 0x30], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x138], 0x1000
call fcn.004551b0
test al, al
jne 0x4534ce
mov ecx, esi
call fcn.00452f50
push esi
call fcn.00455c02
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x458a0e
Capabilities:
Encode data using xor

Disassembly:
jo 0x458a50
adc dword ds:[esi - 0x36], ebx
loopne 0x458a90
retf 0x7ae0
and ch, bl
pop ecx
xor dl, byte [ebp + 0x51ca30ee]
mov ebx, 0x6021b89b
scasb al, byte es:[edi]
wait
jae 0x458a13
iretd
dec ebp
xor dword [eax - 0x531b925c], eax
outsd dx, dword [esi]
popal
mov byte [ebx], bh
fsub st(0), st(0)
cmpsd dword [esi], dword es:[edi]
xor eax, 0xc8bc4a50
mov fs, word [eax - 0x58]
cwde
rcr edx, 0x5b
int1
and edx, esp
retf 0x8a9a
dec esi
jmp 0x458afa
mov al, 0x6b
iretd

Function at 0x45ff80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x41671c
mov dword [esp + 0x18], 0
call fcn.0045fd40
mov edi, dword [esi + 0x30]
test edi, edi
je 0x45ffda
mov ecx, edi
call fcn.0045d060
push edi
call fcn.00462c32
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, 0x42c780
call fcn.0045fd10
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004621b0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x460470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414cb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x41b134]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004620b0
xor ebx, ebx
mov ecx, 0x42c780
mov dword [esp + 0x18], ebx
mov dword [esi], 0x41671c
call fcn.0045fb50
mov eax, dword [esp + 0x20]
push 1
push ebx
mov ecx, esi
mov dword [esi + 0x30], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x138], 0x1000
call fcn.004621e0
test al, al
jne 0x4604fe
mov ecx, esi
call fcn.0045ff80
push esi
call fcn.00462c32
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x44b32f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec edx
add byte [ebx + 0x4c18301], cl
mov dword [0x4a753c], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
jns 0x44b372
fadd qword [0x48cd18]
fmul qword [0x48cd20]
or ch, ah
pop ebp
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x4cd81985
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section._RDATA
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x11b110c
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219