joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4021e0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
mov eax, dword [0x465e10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x402910
mov dword [esp + 8], 0
mov dword [esp + 4], 0xd3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x465050], eax
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
add esp, 0x2c
ret

Function at 0x4037f0
Capabilities:
Create process on windows

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 4], str.open
mov dword [esp], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
cmp eax, 0x20
jbe 0x403840
add esp, 0x28
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.00454bc0
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Failed_to_run___s_:__s
call fcn.0044f440
mov dword [esp + 0xc], 0x30
mov ebx, eax
mov dword [esp + 8], 0x458040
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
mov dword [esp + 0x30], ebx
add esp, 0x28
pop ebx
jmp fcn.00450510
Function at 0x405110
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
xor ecx, ecx
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, dword [edx + ecx*4]
mov dword [edi + ecx*4], eax
mov ebx, dword [esi*4 + 0x457014]
add ecx, 1
cmp ebx, ecx
jg 0x405125
mov eax, ecx
mov ebp, dword [edi + ecx*4 - 4]
cdq
idiv ebx
test edx, edx
jne 0x4051dd
lea esi, [esi]
mov edx, ebp
mov eax, dword [eax*4 + 0x45895c]
ror edx, 8
mov ebp, edx
bswap eax
shr ebp, 0x18
mov dword [esp], eax
movzx ebp, byte [ebp + 0x458860]
movzx eax, dl
movzx eax, byte [eax + 0x458860]
shl ebp, 0x18
or ebp, eax
movzx eax, dh
shr edx, 0x10
movzx eax, byte [eax + 0x458860]
movzx edx, dl
shl eax, 8
or eax, ebp
movzx ebp, byte [edx + 0x458860]
shl ebp, 0x10
or ebp, eax
xor ebp, dword [esp]
mov eax, ecx
sub eax, ebx
mov edx, dword [edi + eax*4]
xor edx, ebp
mov dword [edi + ecx*4], edx
mov eax, dword [esi*4 + 0x457020]
add ecx, 1
add eax, 1
imul eax, dword [esi*4 + 0x457008]
cmp eax, ecx
jle 0x405230
mov ebx, dword [esi*4 + 0x457014]
mov eax, ecx
mov ebp, dword [edi + ecx*4 - 4]
cdq
idiv ebx
test edx, edx
je 0x405150
cmp edx, 4
jne 0x4051a0
cmp ebx, 6
jle 0x4051a0
mov eax, ebp
mov edx, ebp
shr eax, 0x18
movzx edx, dl
movzx eax, byte [eax + 0x458860]
movzx edx, byte [edx + 0x458860]
shl eax, 0x18
or eax, edx
mov edx, ebp
shr ebp, 0x10
movzx edx, dh
movzx edx, byte [edx + 0x458860]
shl edx, 8
or eax, edx
mov edx, ebp
movzx ebp, dl
movzx edx, byte [ebp + 0x458860]
shl edx, 0x10
or eax, edx
mov ebp, eax
jmp 0x4051a0
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4053a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, ebx
lea ebp, [ebx + ebx]
mov esi, ebx
shr al, 7
mov dword [esp], edi
lea ecx, [eax + eax]
add ecx, eax
lea ecx, [ecx + ecx*8]
xor ecx, ebp
mov eax, ecx
shr al, 7
lea edx, [eax + eax]
add edx, eax
lea eax, [ecx + ecx]
lea edx, [edx + edx*8]
xor edx, eax
mov eax, edi
shr al, 1
mov ebp, eax
and ebp, 1
mov eax, ebp
imul eax, ecx
mov ecx, edx
shr cl, 7
mov ebp, eax
mov eax, edi
and eax, 1
imul eax, ebx
xor ebp, eax
mov eax, edi
shr al, 2
and eax, 1
imul eax, edx
xor ebp, eax
lea eax, [ecx + ecx]
add eax, ecx
lea ecx, [eax + eax*8]
lea eax, [edx + edx]
mov edx, edi
shr dl, 3
xor eax, ecx
and edx, 1
mov ecx, esi
imul eax, edx
xor ebp, eax
mov eax, ebp
mov byte [esp + 7], al
mov eax, edi
mov edi, 4
shr al, 4
and eax, 1
mov edx, ecx
add ecx, ecx
shr dl, 7
mov ebp, edx
lea edx, [ebp + ebp]
add edx, ebp
lea edx, [edx + edx*8]
xor ecx, edx
sub edi, 1
jne 0x405433
imul eax, ecx
xor al, byte [esp + 7]
mov edi, 5
mov ecx, ebx
mov byte [esp + 7], al
movzx eax, byte [esp]
shr al, 5
and eax, 1
nop
lea esi, [esi]
mov edx, ecx
add ecx, ecx
shr dl, 7
mov ebp, edx
lea edx, [ebp + ebp]
add edx, ebp
lea edx, [edx + edx*8]
xor ecx, edx
sub edi, 1
jne 0x405470
movzx ebp, byte [esp + 7]
mov edi, 6
imul eax, ecx
xor ebp, eax
movzx eax, byte [esp]
shr al, 6
and eax, 1
mov ecx, ebx
add ebx, ebx
shr cl, 7
lea edx, [ecx + ecx]
add edx, ecx
lea edx, [edx + edx*8]
xor ebx, edx
sub edi, 1
jne 0x4054a2
imul eax, ebx
movzx ebx, byte [esp]
mov ecx, 7
mov edx, esi
xor ebp, eax
shr bl, 7
nop
lea esi, [esi]
mov eax, edx
add edx, edx
shr al, 7
mov esi, eax
lea eax, [esi + esi]
add eax, esi
lea eax, [eax + eax*8]
xor edx, eax
sub ecx, 1
jne 0x4054d0
mov eax, edx
add esp, 8
imul eax, ebx
pop ebx
pop esi
xor eax, ebp
pop edi
pop ebp
ret

Function at 0x4058e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], 0x90d0b0e
mov dword [esp + 0x24], 0xd0b0e09
mov dword [esp + 0x28], 0xb0e090d
mov dword [esp + 0x2c], 0xe090d0b
mov eax, dword [eax*4 + 0x457008]
test eax, eax
jle 0x4059b3
mov esi, dword [esp + 0x48]
mov dword [esp + 0xc], 0
lea esi, [esi]
lea edi, [edi]
lea eax, [esp + 0x1c]
lea ebx, [esp + 0x20]
mov dword [esp + 8], eax
mov eax, 0xe
xor ebp, ebp
xor edi, edi
mov dword [esp + 4], eax
movzx eax, byte [esi + edi]
add edi, 1
mov dword [esp], eax
call fcn.004053a0
xor ebp, eax
cmp edi, 4
je 0x405965
movzx eax, byte [ebx + edi]
jmp 0x405945
mov ecx, dword [esp + 8]
mov eax, ebp
add ebx, 4
mov byte [ecx], al
lea eax, [esp + 0x30]
add ecx, 1
mov dword [esp + 8], ecx
cmp eax, ebx
je 0x405984
movzx eax, byte [ebx]
jmp 0x405941
xor eax, eax
movzx edx, byte [esp + eax + 0x1c]
mov byte [esi + eax], dl
add eax, 1
cmp eax, 4
jne 0x405986
mov edx, dword [esp + 0x44]
add dword [esp + 0xc], 1
add esi, 4
mov eax, dword [esp + 0xc]
cmp dword [edx*4 + 0x457008], eax
jg 0x405930
add esp, 0x30
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4059c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
mov ecx, 0x3c
sub esp, 0x124
lea edi, [esp + 0x34]
mov ebp, dword [esp + 0x138]
mov ebx, dword [esp + 0x148]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
mov dword [esp], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 4], eax
call fcn.00405110
mov eax, dword [ebx]
mov ecx, dword [esp + 0x140]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 4]
test ecx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x30], eax
jle 0x405ba3
mov esi, dword [ebp*4 + 0x457008]
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], 0
mov eax, dword [ebp*4 + 0x457020]
mov edi, dword [esp + 0x13c]
lea edx, [esi*4]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
xor eax, eax
add ecx, edi
test edx, edx
mov edi, edx
jle 0x405bb0
nop
lea esi, [esi]
movzx edx, byte [ecx + eax]
mov byte [ebx + eax], dl
add eax, 1
cmp eax, edi
jne 0x405a90
mov edx, dword [esp + 0x10]
test edx, edx
js 0x405b60
mov dword [esp + 0x138], ebp
mov ebp, dword [esp + 0x10]
test esi, esi
jle 0x405ad4
mov eax, ebp
imul eax, esi
lea ecx, [esp + eax*4 + 0x34]
xor eax, eax
mov edx, dword [ebx + eax*4]
xor edx, dword [ecx + eax*4]
mov dword [ebx + eax*4], edx
add eax, 1
cmp eax, esi
jne 0x405ac4
test ebp, ebp
je 0x405b40
mov eax, dword [esp + 0x138]
cmp dword [eax*4 + 0x457020], ebp
jg 0x405b32
mov eax, dword [esp + 0x138]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004057f0
mov eax, dword [esp + 0x138]
mov esi, dword [eax*4 + 0x457008]
test esi, esi
jle 0x405b2d
lea edi, [ebx + esi*4]
mov eax, ebx
lea ecx, [eax + 4]
movzx edx, byte [eax]
add eax, 1
movzx edx, byte [edx + 0x458760]
mov byte [eax - 1], dl
cmp ecx, eax
jne 0x405b15
cmp edi, eax
jne 0x405b12
sub ebp, 1
jmp 0x405ab5
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004058e0
jmp 0x405ae8
lea edx, [esi*4]
mov ebp, dword [esp + 0x138]
test edx, edx
jle 0x405b8e
mov eax, dword [esp + 0x13c]
mov edi, dword [esp + 0xc]
lea ecx, [eax + edi]
xor eax, eax
movzx edx, byte [ebx + eax]
xor dl, byte [esp + eax + 0x24]
mov edi, edx
movzx edx, byte [ecx + eax]
mov byte [esp + eax + 0x24], dl
mov edx, edi
mov byte [ecx + eax], dl
mov esi, dword [ebp*4 + 0x457008]
add eax, 1
lea edx, [esi*4]
cmp edx, eax
jg 0x405b62
add dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x140], eax
jg 0x405a5d
add esp, 0x124
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x10]
test eax, eax
js 0x405b8e
jmp 0x405aaa
Function at 0x405bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push ebx
mov edx, 0x38e38e39
sub esp, 0x254
mov ecx, dword [esp + 0x268]
lea ebx, [esp + 0xe8]
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x20], 0x64
mov dword [esp + 0x1c], 0x2d
mov dword [esp + 0x18], 0x48
mov dword [esp + 0x10], 0x2b
lea eax, [ecx + 0xe1f]
mov dword [esp + 0xc], 0x45
mov dword [esp + 8], str._c_c1_d6_c36_c_c8_d6P_c_c
mov dword [esp + 4], 0x168
mov dword [esp], ebx
mov dword [esp + 0x24], eax
mov eax, ecx
sar ecx, 0x1f
imul edx
mov dword [esp + 0x3b], 0x4829452b
mov dword [esp + 0x3f], 0x2e642d25
mov dword [esp + 0x43], 0x3d323a2f
mov dword [esp + 0x47], 0x5f405028
mov byte [esp + 0x4b], 0
mov dword [esp + 0x2c], 0x5f
sar edx, 3
sub edx, ecx
mov dword [esp + 0x14], edx
call fcn.00404b30
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x405c6c
mov ecx, eax
lea esi, [esp + 0x4c]
mov dword [esp + 4], ebx
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
mov dword [esp], esi
cmove edx, ecx
mov ecx, eax
add cl, al
sbb edx, 3
sub edx, ebx
mov dword [esp + 8], edx
call fcn.00404b60
lea eax, [esp + 0x6c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
sub esp, 4
test eax, eax
lea ecx, [esp + 0x3b]
je 0x405d0b
lea ebx, [esp + 0x70]
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x405cd0
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea ecx, [esp + 0x3b]
sbb edx, 3
sub edx, ebx
cmp edx, 0x26
je 0x405d40
mov eax, dword [esp + 0x264]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
mov dword [esp], 2
mov dword [esp + 8], eax
mov eax, dword [esp + 0x260]
mov dword [esp + 4], eax
call fcn.004059c0
add esp, 0x254
xor eax, eax
pop ebx
pop esi
ret
xor eax, eax
movzx edx, byte [ebx + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x405d42
movzx eax, byte [esp + 0x94]
mov byte [esp + 0x3b], al
movzx eax, byte [esp + 0x89]
mov byte [esp + 0x3f], al
movzx eax, byte [esp + 0x8c]
mov byte [esp + 0x41], al
movzx eax, byte [esp + 0x90]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x84]
mov byte [esp + 0x49], al
jmp 0x405d0b
Function at 0x4068e0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
xor edx, edx
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov eax, dword [esi + 8]
mov dword [esi + 4], 0
test eax, eax
jne 0x406916
jmp 0x406980
test edi, edi
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
je 0x406950
add edx, edi
cmp edx, eax
mov dword [esi + 4], edx
jae 0x406950
sub eax, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 1
mov dword [esp + 8], eax
add edx, dword [esi]
mov dword [esp], edx
call sub.msvcrt.dll_fread
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x406903
add esp, 0x10
mov eax, 2
pop ebx
pop esi
pop edi
ret
cmp eax, edx
je 0x406980
xor eax, eax
mov ecx, dword [esi]
mov dword [esi + 0x14], edx
lea edx, [esi + 0xc]
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], edx
mov dword [esi + 0xc], ecx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
mov edx, dword [esi + 4]
setne al
movzx eax, al
jmp 0x406956
Function at 0x4163a0
Capabilities:
Create pipe

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov eax, dword [eax]
cmp dl, 1
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x1000
mov dword [esp + 0x28], eax
sbb eax, eax
mov dword [esp + 0x1c], edx
and eax, 0xfff80000
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0xff
add eax, 0x40080003
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
sub esp, 0x20
cmp eax, 0xffffffff
mov dword [ebx + 0xc], eax
setne al
add esp, 0x38
pop ebx
ret

Function at 0x416420
Capabilities:
Connect pipe

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x20
test dl, dl
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x416461
mov eax, dword [ebx + 0x28]
mov esi, dword [ebx + 0xc]
mov edx, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x416520
mov dword [esp], eax
call dword [edx + 0x10]
test eax, eax
jne 0x4164f1
xor edx, edx
mov eax, ebx
call fcn.004163a0
test al, al
je 0x416493
lea eax, [ebx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
sub esp, 8
test eax, eax
jne 0x416432
call edi
cmp eax, 0x3e5
mov esi, eax
je 0x4164ea
test eax, eax
je 0x416432
cmp eax, 0x217
jne 0x416497
jmp 0x416432
call edi
mov esi, eax
mov dword [esp], esi
call fcn.00454bc0
mov dword [esp], str.Error_while_listening_to_named_pipe:__s
mov dword [esp + 4], eax
call fcn.0044f440
mov edi, eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00415260
mov edx, dword [ebx + 0x28]
mov ecx, dword [edx]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edx
call dword [ecx]
mov dword [esp], edi
call fcn.00450510
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x416454
Function at 0x416e20
Capabilities:
Create thread

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp + 8], 0
mov dword [esp + 4], 0x102c
mov dword [esp], 1
call fcn.00450480
mov ebx, eax
mov dword [eax], 0
mov eax, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [ebx + 0x10], eax
cmp dword [0x457040], 0xffffffff
mov eax, dword [esp + 0x44]
mov byte [ebx + 0x16], 0
mov byte [ebx + 0x14], 0
mov byte [ebx + 0x15], 0
mov dword [ebx + 0x1028], eax
mov eax, dword [esp + 0x48]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [ebx + 0x1c], eax
je 0x416f00
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x416790
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x14], eax
lea eax, [ebx + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x416ef1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov byte [ebx + 0x17], 1
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
mov dword [0x4657d8], 0x4657d8
mov dword [0x4657dc], 0x4657d8
mov dword [esp], 0x4657c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [0x457040], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x416c50
mov dword [esp], eax
call fcn.00404850
jmp 0x416eaa
Function at 0x4174a0
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x465e5c], 0
jne 0x4174e0
push ebp
push edi
mov ebp, edx
push esi
push ebx
mov ebx, eax
mov esi, ecx
mov edi, ecx
sub esp, 0x18c
mov eax, dword [eax + 4]
test eax, eax
je 0x4174e2
cmp eax, 1
je 0x4174f2
cmp eax, 2
je 0x417510
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret
repz ret
mov dword [esp], ebx
call fcn.00417480
mov eax, dword [ebx + 4]
cmp eax, 1
jne 0x4174c7
add ebx, 8
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.0044dbd0
jmp 0x4174cc
mov eax, dword [ebx]
test eax, eax
je 0x417590
mov dword [esp + 4], 0x109
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call fcn.0044e440
cmp eax, 1
jne 0x417534
cmp byte [ebp], 0xa
je 0x4175b1
mov eax, dword [ebx]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebp
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp eax, edi
jae 0x4174cc
mov eax, dword [ebx]
test eax, eax
je 0x41756a
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx], 0
mov eax, dword [ebx + 0x20]
mov dword [ebx + 4], 3
mov edx, dword [eax]
mov dword [esp + 4], str.Disabled_writing_session_log_due_to_error_while_writing
mov dword [esp], eax
call dword [edx]
jmp 0x4174cc
mov dword [esp + 8], 0x37
mov dword [esp + 4], str._MoTTY_logging.c
mov dword [esp], str.ctx__lgfp
call fcn.00455fa0
jmp 0x417516
lea eax, [esp + 0x20]
lea esi, [esp + 0x80]
mov edi, 0x18
mov dword [esp], eax
call fcn.00453ab0
mov eax, dword [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 8], str._Y__m__d__H:_M:_S
mov dword [esp + 4], 0x18
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_strftime
mov dword [esp + 4], esi
mov dword [esp], str._n__s_
call fcn.0044f440
mov esi, eax
mov eax, dword [ebx]
mov dword [esp + 8], 0x18
mov dword [esp + 4], 1
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call fcn.00450510
mov eax, dword [esp + 0x1c]
jmp 0x41754e
Function at 0x4248e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x64]
mov ebx, dword [esp + 0x70]
mov ebp, dword [esp + 0x68]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov edi, dword [esp + 0x78]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], edx
call fcn.00451010
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x80], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x78], eax
mov dword [esp + 0x60], ebp
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x64], edx
add esp, 0x4c
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00423d80

Function at 0x4249d0
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov ecx, 0x10624dd3
push esi
push ebx
mov esi, 1
mov ebx, 1
sub esp, 0x4c
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
imul edx, dword [esp + 0x68], 0x3e8
mov eax, edx
mul ecx
shr edx, 6
mov dword [esp + 0x3c], edx
jmp 0x424a2b
mov eax, ebx
not eax
cmp eax, esi
jb 0x424ac6
mov eax, dword [esp + 0x98]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004510b0
lea eax, [esi + ebx]
mov esi, ebx
mov ebx, eax
call edi
mov ebp, eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call fcn.00451010
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x90]
mov edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x64]
mov dword [esp], ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
call fcn.00423d80
call edi
sub eax, ebp
cmp dword [esp + 0x3c], eax
ja 0x424a01
mov eax, dword [esp + 0x6c]
mov dword [eax], ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4270f0
Capabilities:
Encrypt data using blowfish

Disassembly:
push edi
xor eax, eax
push esi
mov ecx, 0x243f6a88
push ebx
mov edx, dword [esp + 0x10]
jmp 0x427106
mov ecx, dword [eax + 0x45e0c0]
mov dword [edx + eax + 0x1000], ecx
add eax, 4
cmp eax, 0x48
jne 0x427100
xor eax, eax
mov edi, 0x3a39ce37
mov esi, 0xe93d5a68
mov ebx, 0x4b7a70e9
mov ecx, 0xd1310ba6
jmp 0x427148
mov ecx, dword [eax + 0x45dcc0]
mov ebx, dword [eax + 0x45d8c0]
mov esi, dword [eax + 0x45d4c0]
mov edi, dword [eax + 0x45d0c0]
mov dword [edx + eax], ecx
mov dword [edx + eax + 0x400], ebx
mov dword [edx + eax + 0x800], esi
mov dword [edx + eax + 0xc00], edi
add eax, 4
cmp eax, 0x400
jne 0x427130
pop ebx
pop esi
pop edi
ret
Function at 0x42cb70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov edx, dword [ebx]
cmp dword [edi], edx
je 0x42cba3
mov dword [esp + 8], 0xa6
mov dword [esp + 4], str._MoTTY_crypto_mpint.c
mov dword [esp], str.x0__nw__x1__nw
call fcn.00455fa0
mov edx, dword [edi]
mov eax, dword [esp + 0x48]
and eax, 1
neg eax
test edx, edx
mov dword [esp + 0x1c], eax
je 0x42cbdd
mov esi, dword [edi + 4]
mov ebx, dword [ebx + 4]
xor eax, eax
lea esi, [esi]
mov ecx, dword [esi + eax*4]
mov edx, dword [ebx + eax*4]
mov ebp, dword [esp + 0x1c]
xor edx, ecx
and edx, ebp
xor ecx, edx
mov dword [esi + eax*4], ecx
xor dword [ebx + eax*4], edx
add eax, 1
cmp dword [edi], eax
ja 0x42cbc0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42cc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
cmp eax, 0x3fffffff
mov dword [esp + 0x18], eax
ja 0x42cd50
mov edi, dword [esp + 0x18]
mov edx, 1
lea eax, [edi*4 + 0x1f]
shr eax, 5
test eax, eax
cmove eax, edx
mov dword [esp], eax
call fcn.0042c780
test edi, edi
mov dword [esp + 0x1c], eax
je 0x42cd3b
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x18]
lea esi, [eax + ebx - 1]
xor ebx, ebx
mov esi, esi
lea edi, [edi]
movsx ecx, byte [esi]
mov edx, 0x66
sub esi, 1
lea eax, [ecx - 0x61]
sub edx, ecx
lea ebp, [ecx - 0x30]
or eax, edx
lea edx, [ecx - 0x57]
sar eax, 0x1f
xor edx, ebp
not eax
and edx, eax
lea eax, [ecx - 0x41]
xor edx, ebp
mov ebp, 0x46
sub ebp, ecx
sub ecx, 0x37
or eax, ebp
xor ecx, edx
mov ebp, ebx
sar eax, 0x1f
shr ebp, 3
not eax
and ecx, eax
xor edx, ecx
mov ecx, ebx
add ebx, 1
and ecx, 7
and edx, 0xf
shl ecx, 2
shl edx, cl
or dword [edi + ebp*4], edx
cmp dword [esp + 0x18], ebx
jne 0x42cce0
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x106
mov dword [esp + 4], str._MoTTY_crypto_mpint.c
mov dword [esp], str.hex.len_____size_t_0____4
call fcn.00455fa0
mov eax, dword [esp + 0x18]
mov edx, 1
lea eax, [eax*4 + 0x1f]
shr eax, 5
test eax, eax
cmove eax, edx
mov dword [esp], eax
call fcn.0042c780
mov dword [esp + 0x1c], eax
jmp 0x42ccc6