joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x418040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea edx, [ecx + 2]
push edi
mov edi, ecx
mov dword [ebp - 0x234], 0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401147
sub ecx, edx
sar ecx, 1
cmp ecx, 0x40
ja 0x401384
mov ecx, 0x24
lea eax, [ebp - 0x230]
nop word [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401170
cmp dword [0x418d24], 2
movups xmm0, xmmword [str.vXP_VLPUU]
mov ax, word [0x41635c]
mov dword [ebp - 0x230], 0x24
movups xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x21c], 4
movups xmm0, xmmword [0x416334]
mov word [ebp - 0x238], ax
movups xmmword [ebp - 0x260], xmm0
movups xmm0, xmmword [0x416344]
movups xmmword [ebp - 0x250], xmm0
movq xmm0, qword [0x416354]
movq qword [ebp - 0x240], xmm0
jl 0x4012f2
movaps xmm4, xmmword [0x416380]
movaps xmm3, xmmword [0x4163e0]
movaps xmm5, xmmword [0x4163a0]
movaps xmm6, xmmword [0x4163b0]
nop
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm6
paddw xmm1, xmm0
movq xmm0, qword [ebp + ecx*2 - 0x270]
xorps xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movq qword [ebp + ecx*2 - 0x270], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm6
paddw xmm1, xmm0
movq xmm0, qword [ebp + ecx*2 - 0x268]
xorps xmm1, xmm0
movq qword [ebp + ecx*2 - 0x268], xmm1
add ecx, 8
cmp ecx, 0x18
jl 0x401200
cmp ecx, 0x1d
jge 0x40131b
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul eax, eax, 0x31
sub edx, eax
add edx, 0x33
xor word [ebp + ecx*2 - 0x270], dx
inc ecx
cmp ecx, 0x1d
jl 0x4012f2
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040683f
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004068a3
add esp, 0x18
lea eax, [ebp - 0x234]
push eax
push 0x416224
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov ecx, eax
mov eax, dword [ebp - 0x234]
mov dword [esi], eax
mov eax, ecx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403645
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x80004005
pop edi
mov dword [esi], 0
xor ecx, ebp
pop esi
call fcn.00403645
mov esp, ebp
pop ebp
ret
Function at 0x401ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 2
push 0
mov dword [ebp - 8], edx
mov ebx, 0xc0000022
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, 0x13
mov dword [ebp - 0x10], eax
mov esi, 0x416030
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [0x418d24], 2
movsw word es:[edi], word [esi]
jl 0x402030
movaps xmm4, xmmword [0x416380]
movaps xmm3, xmmword [0x4163e0]
movaps xmm5, xmmword [0x4163a0]
movaps xmm6, xmmword [0x4163b0]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm6
paddw xmm1, xmm0
movq xmm0, qword [ebp + ecx*2 - 0x60]
xorps xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movq qword [ebp + ecx*2 - 0x60], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm6
paddw xmm1, xmm0
movq xmm0, qword [ebp + ecx*2 - 0x58]
xorps xmm1, xmm0
movq qword [ebp + ecx*2 - 0x58], xmm1
add ecx, 8
cmp ecx, 0x20
jl 0x401f44
cmp ecx, 0x27
jge 0x402056
nop word [eax + eax]
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul eax, eax, 0x31
sub edx, eax
add edx, 0x33
xor word [ebp + ecx*2 - 0x60], dx
inc ecx
cmp ecx, 0x27
jl 0x402030
lea eax, [ebp - 4]
push eax
push ecx
lea ecx, [ebp - 0x60]
call fcn.00401120
mov esi, dword [ebp - 4]
add esp, 8
test eax, eax
jne 0x402090
test esi, esi
je 0x40209c
mov eax, dword [esi]
push 0
push 0
push 0
push dword [ebp - 8]
mov eax, dword [eax + 0x24]
push dword [ebp - 0xc]
push esi
call eax
mov ebx, eax
sar ebx, 0x1f
and ebx, 0xc0000022
test esi, esi
je 0x40209c
mov ecx, dword [esi]
push esi
mov ecx, dword [ecx + 8]
call ecx
cmp dword [ebp - 0x10], 0
jne 0x4020a8
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40402e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40406d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40406d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40406d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40406d
cmp dword [ecx + 0x74], 0xe
jbe 0x40406d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409f38
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x409fd5
push ebx
push esi
call fcn.00409f01
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00409e95
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x409f82
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409fd4
push edi
push eax
call fcn.00408914
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x409fa2
call fcn.00408962
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409fd3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00409e95
add esp, 0x20
test eax, eax
jne 0x409fc1
push edi
call fcn.00408962
jmp 0x409fc9
push ebx
call fcn.00408962
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40af93
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4132a8
push 0x4132a0
push str.FlsAlloc
push 0x1f
call fcn.0040aeaf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40afc7
push dword [ebp + 8]
mov ecx, esi
call dword [0x411150]
call esi
jmp 0x40afcd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b013
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4132b8
push 0x4132b0
push str.FlsGetValue
push 0x21
call fcn.0040aeaf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b04a
push dword [ebp + 8]
mov ecx, esi
call dword [0x411150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40b052
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4132c0
push 0x4132b8
push str.FlsSetValue
push 0x22
call fcn.0040aeaf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b08c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x411150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40fe30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fe5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fe5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x6cc08a
Capabilities:
Encode data using xor

Disassembly:
sar dword [edi - 0x44], 0xc5
inc ecx
dec esp
fisttp word [ebx - 0x50ca6740]
cmp byte [esi + 0x7780ddd6], al
and dl, dh
inc dword [eax]
add byte [eax], al
add bh, bh
add byte [eax], al
add byte [ebp + 0x26], ch
adc al, cl
invalid

Function at 0x6d0ad6
Capabilities:
Encode data using xor

Disassembly:
cmp ch, byte [eax]
fdiv qword [esi - 0x80]
and ebp, dword [edx]
xchg ebp, eax
inc dword [eax]
add byte [eax], al
add bh, bh
add byte [eax], al
add byte [eax + 0x70], al
xor cl, al
pop esi
push ds
mov edx, 0x159cb641
rcr dword [ecx + edi], 0x6f
cmp ah, byte [edi]
fstp xword [ecx - 0x80]
sub bl, byte es:[edi + edi*8]
inc dword [eax]
add byte [eax], al
xor dl, bl
xor cl, al
dec esp
pop esi
mov edx, 0x154c2041
shl dword [eax], 0x39
insd dword es:[edi], dx
cmp al, byte [edi]
test al, 0x78
sbb byte [ecx + 0x19], 0xc2
inc dword [eax]
add byte [eax], al
add bh, bh
add byte [eax], al
add byte [esi + 0x5ac1262e], ch
inc esi
mov ecx, 0xb1e5441
shl edx, 0x38
xor al, 0x3a
or byte [edx + 0x1e548071], ch
invalid

Function at 0x6d0bfb
Capabilities:
Encode data using xor

Disassembly:
add ecx, dword [edi + 0x94]
add byte [eax], al
inc dword [eax]
add byte [eax], al
pop esi
bound esi, qword [ecx + eax*8]
push edx
and bh, byte [esi + 0x19ee8041]
sar dword [ecx + 0x39], 0xfe
xor al, 0x28
ficom dword [edx + 0x5e2e2380]
inc dword [eax]
add byte [eax], al
add bh, bh
add byte [eax], al
add byte [eax + 0x4f], bh
xor ecx, eax
jl 0x6d0c08
mov edx, 0x22402d41
shl dword [ebx], 0x39
mov dh, 0x3a
sub eax, 0x1f808be0
xor byte [esi - 1], ah
add byte [eax], al
add byte [eax], al
inc dword [eax]
add byte [eax], al
add eax, 0x2ec131cd
and bh, byte [ebx + 0x22440141]
shl dword [edi], 0x39
mov dh, 0x3a
push ds
sal dword [eax + eax*4 + 0x30], 1
daa
scasb al, byte es:[edi]
inc dword [eax]
invalid

Function at 0x6d1061
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
inc dword [eax]
add byte [eax], al
dec ecx
cmp al, 0x15
shr edx, 0x97
mov edi, 0x9cc4641
shl dword [0x893b3530], 0xd5
and dword [eax - 0x2b265e], eax
add byte [eax], al
add byte [eax], al
inc dword [eax]
add byte [eax], al
std
cmp al, 0x15
sar dword [eax], 0x54
mov edi, 0x7ca4a41
ror dword [eax + esi], 0x35
cmp esi, dword [edi]
imul esp, esi, 0xffffff80
cmp esp, 0xffffff9b
add byte [eax], al
add byte [eax], al
add bh, bh
add byte [eax], al
add byte [ebx - 0x7f3ed683], bh
jno 0x6d106e
inc ecx
inc esi
int3
inc ecx
scasb al, byte es:[edi]
cmp cl, byte [ecx]
rcr dword [eax + 0x39], 0x4b
xor al, 0x3b
push 0xfa8980e8
mov eax, dword [pe_dos_header]
add bh, bh
add byte [eax], al
add byte [esi - 0x73ed9c7], ch
clc
outsb dx, byte [esi]
rol byte [ecx - 0x70], 0xb1
or ecx, eax
dec esi
cmp dword [ebx], esi
xor al, 0x4a
push 0xfb8b80f1
lahf
add byte [eax], al
add byte [eax], al
add bh, bh
add byte [eax], al
add byte [esp + ecx*2 + 0x26], bh
rol ecx, 0x25
rol byte [ecx - 0x4e], 0x6d
pop es
rcr dword [eax + 0x39], 0x28
xor al, 0x1e
jno 0x6d10cb
add byte [eax + 0x97fd], 0
add byte [eax], al
inc dword [eax]
add byte [eax], al
Function at 0x6d4e6d
Capabilities:
Encode data using xor

Disassembly:
invalid
mov edi, 0xff2147
add byte [eax], al
add bh, bh
add byte [eax], al
add bl, al
push ebx
pop ss
shl esp, 0x31
mov ebp, 0xfd02b041
sal byte [esi + esi - 0x16], 0x38
sbb dword [ebx], esi
jp 0x6d4d9b
xor byte [eax + eax*2 + 0xff1e], 0
mov ah, 0x40
push ds
inc dword [eax]
add byte [eax], al
add bh, bh
add byte [eax], al
add ch, cl
sub al, 0x17
sar dword [ecx + 0x7e41bd08], 0x6d
cld
sal byte [ebp + 0x36], 0xe6
cmp byte [eax], ah
sub al, 0x76
add al, 0x2d
enter 0xff, 0
add byte [eax], al
inc dword [eax]
add byte [eax], al
pushal
invalid
ja 0x6d4e8b
mov edi, 0x78381638
xor byte [esi + 0xffc927], 0
add byte [eax], al
inc dword [eax]
add byte [eax], al
xor dword [ecx + 0x17], ebp
shr edx, 0xc9
mov esp, 0xf31a6241
sar byte [eax + 0x36], 0xc3
cmp byte [ebx + 1], dh
jno 0x6d4dfb
sti
jo 0x6d4e1a
inc dword [eax]
add byte [eax], al
add bh, bh
add byte [eax], al
add bl, ah
xchg edi, eax
cmc
ror bh, 0x62
sbb al, byte [edx + 0x42]
jnp 0x6d4e53
iretd
shl byte [edx + ebp], 0x1b
xor esi, dword [esi + 2]
imul eax, dword [eax - 0x579009], 0
inc dword [eax]
add byte [eax], al
inc esp
pop edx
cmc
rcr byte [eax + 0x1c421a65], 0x7c
ret 0x24c0
Function at 0x4349ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4349c9
pop dword [ebp - 0xc]
mov eax, 0xc6ac2451
sub eax, 0xc668da88
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x4e39a
push 0
mov eax, 0x5365a3c3
add eax, 0xacdf3f11
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x3e5c
xor edx, edx
add edx, eax
mov edi, 0xec1547b2
add edi, 0x1432484e
add edi, dword [ebp - 0xc]
mov esi, 0x83800e17
add esi, 0x6801d285
sub dword [ebp - 4], 0x86ef7db2
mov ebx, dword [edi]
xor dword [ebp - 8], ecx
sub ebx, esi
sub dword [ebp - 4], 0x92f22433
mov dword [edx], ebx
xor dword [ebp - 4], eax
add edx, 4
add edi, 0xe8cf4905
add edi, 0x1730b6ff
loop 0x434a24
add eax, 0xec43
xor ebx, ebx
add ebx, eax
add eax, 0x55cdd11d
add eax, 0xaa322ee8
mov ecx, 0x6d4d546f
sub ecx, 0x6d0d546f
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x444db9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46f748
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x444dfc
push str.SystemFunction040
push dword [0x46f748]
call edi
push str.SystemFunction041
push dword [0x46f748]
mov dword [0x46f738], eax
call edi
mov dword [0x46f73c], eax
jmp 0x444e01
mov eax, dword [0x46f73c]
cmp dword [0x46f738], 0
je 0x444e12
test eax, eax
jne 0x444eb9
push 0x46f74c
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x444ec3
push str.CryptProtectMemory
push dword [0x46f74c]
call edi
cmp dword [0x46f738], 0
mov dword [0x46f740], eax
jne 0x444e77
test eax, eax
jne 0x444e77
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444e61
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444e68
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work35_swix_srclibsdutilcryputil.cpp
call fcn.004013b3
jmp 0x444ec3
push str.CryptUnprotectMemory
push dword [0x46f74c]
call edi
cmp dword [0x46f73c], 0
mov dword [0x46f744], eax
jne 0x444eb9
test eax, eax
jne 0x444eb9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444ead
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444eb4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x444e6b
mov dword [0x46f750], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x43187f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x43189d
mov eax, 0x5f9b90
push eax
push 1
mov ebx, 0x485470
call fcn.00484dd4
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4318c7
mov eax, 0
jmp 0x43193b
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x431928
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x431911
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x431900
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4318f1
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x44dc18
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x44de65
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x44dd62
cmp byte [edx + edi], 0xd
jne 0x44dd62
cmp byte [edx + edi + 1], 0xa
je 0x44dd9b
mov al, byte [edx + edi]
cmp al, 0xa
je 0x44dd9b
cmp al, 0x3d
jne 0x44dd77
inc ecx
cmp ecx, 2
ja 0x44de73
cmp al, 0x7f
ja 0x44de73
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x44de73
cmp al, 0x40
jae 0x44dd9a
test ecx, ecx
jne 0x44de73
inc esi
inc edx
cmp edx, ebx
jb 0x44dd4c
test esi, esi
je 0x44de65
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x44de84
cmp dword [ecx], eax
jb 0x44de84
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x44de54
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x44de50
cmp al, 0xa
je 0x44de50
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x44de50
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x44de3b
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x44de48
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x44de50
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x44ddec
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x475bc3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x475be6
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x475be6
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x475bf0
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x475c32
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x475c94
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x475c8f
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x475c7a
test dl, dl
je 0x475c76
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x475c7a
add ecx, 2
add eax, 2
test dl, dl
jne 0x475c5a
xor eax, eax
jmp 0x475c7f
sbb eax, eax
or eax, 1
test eax, eax
je 0x475ca0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x475c47
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x475d25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x475d48
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x475d48
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x475d52
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x475d94
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x475df6
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x475df1
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x475ddc
test dl, dl
je 0x475dd8
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x475ddc
add ecx, 2
add eax, 2
test dl, dl
jne 0x475dbc
xor eax, eax
jmp 0x475de1
sbb eax, eax
or eax, 1
test eax, eax
je 0x475e02
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x475da9
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x475e94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x475eb7
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x475eb7
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x475ec1
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x475f03
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x475f65
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x475f60
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x475f4b
test dl, dl
je 0x475f47
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x475f4b
add ecx, 2
add eax, 2
test dl, dl
jne 0x475f2b
xor eax, eax
jmp 0x475f50
sbb eax, eax
or eax, 1
test eax, eax
je 0x475f71
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x475f18
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8