joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050f5
Capabilities:
Encode data using xor

Disassembly:
or al, 0xd
pop eax
sal byte [ecx + 0x39], 1
push ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
stc
push ecx
wait
inc eax
pop esi
xor dword [esi + 0xe], 0x77437a8b
sub esi, 0xfffffffc
loop 0x4050f8
mov al, byte [0x79ec0b3]
xchg edx, eax
mov esp, 0x83857488
sub dword [edx], ecx
or al, 0x4d
pop esp
inc edx
lodsb al, byte [esi]
and al, 0xf4
xchg byte gs:[ecx + 0x28657a83], ah
aas
jo 0x4050a4
sub ecx, ecx
aam 0x97
popal
dec edx
mov dword [edx + 0x24], edi
jle 0x4050be
fld dword [edx + 0x16a4ca13]
aad 0x8c
pushal
invalid

Function at 0x406810
Capabilities:
Connect socket

Disassembly:
push ebp
wait
in al, dx
push esi
jns 0x40688b
or byte [eax + 0x2d], ch
inc ax
add byte [esi - 0x75], dl
push es
jne 0x406875
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0x28]
pop ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
push cs
rol dword [eax], 0x83
clc
dec dword [esi]
test dword [edi], esi
add dword [eax], eax
invalid
clc
test cl, bh
add byte [eax], al
add bh, bh
jmp 0x406899
mov bl, 1
or eax, dword [eax]
mov ah, 0x85
xchg esi, eax
add dword [edi + 0x207b8b00], edx
mov esi, dword [ebx + 0x24]
rol bh, 1
or edx, dword [esi + 0x2c]
push cs
pop edi
pop esi
jmp 0x406867

Function at 0x409120
Capabilities:
Encode data using xor

Disassembly:
in al, dx
mov ebp, esp
sub esp, 0x2c
mov esi, dword [edi - 0x41b27460]
push esi
push edi
push eax
in al, 0x55
aam 0x51
push edx
call fcn.00406aa7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmpsd dword [esi], dword es:[edi]
pushal
or al, byte [eax]
add byte [eax], al
mov dl, byte [eax*4 + 0x4cfb27]
mov dh, 0x85
fadd st(4)
inc eax
add byte [eax + 0x4140ff51], cl
mov dl, byte [eax]
mov byte [ecx - 0x20], dl
mov bh, byte [edi - 0x17f27428]
xor al, byte [ecx]
cmp byte [ebp - 0x3b576afc], cl
inc eax
add dh, al
add dword [eax], esp
inc ecx
scasd eax, dword es:[edi]
adc byte [ecx], dl
cmp al, byte [edx]
aaa
test dword [eax + eax*2 - 0x33], ebp
adc dword [esi - 0x270bfec0], ebx
add dword [ebx - 0x8661bbb], ecx
adc al, byte [ecx - 0x3a]
clc
and byte [ecx + 4], al
xor byte [eax + 0x18830bd], al
mov eax, dword [ebp - 0x20]
inc ecx
mov byte [ecx], dl
inc ecx
cdq
lodsb al, byte [esi]
jae 0x409165
add dword [eax], esp
inc ecx
add al, 0x30
add dl, 0x30
pop es
add dword [ebx - 0x44bef1bb], ecx
sub eax, dword [ecx - 0x67]
int3
Function at 0x403cda
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00404992
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00403e3a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x403e24
test ebx, ebx
jl 0x403dc8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcba13e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x403de9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x403ddb
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004057aa
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004057aa
add esp, 8
mov ebx, 0x80070057
jmp 0x403dc8
Function at 0x41ab5a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041b812
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041acba
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41aca4
test ebx, ebx
jl 0x41ac48
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd0fbe
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41ac69
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41ac5b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c62a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c62a
add esp, 8
mov ebx, 0x80070057
jmp 0x41ac48
Function at 0x4319ea
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004326a2
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00431b4a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x431b34
test ebx, ebx
jl 0x431ad8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce7e4e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x431af9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x431aeb
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004334ba
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004334ba
add esp, 8
mov ebx, 0x80070057
jmp 0x431ad8
Function at 0x44842a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004490e2
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0044858a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x448574
test ebx, ebx
jl 0x448518
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfe88e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x448539
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x44852b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00449efa
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00449efa
add esp, 8
mov ebx, 0x80070057
jmp 0x448518
Function at 0x45ee8a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045fb42
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045efea
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45efd4
test ebx, ebx
jl 0x45ef78
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd152ee
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45ef99
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45ef8b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0046095a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0046095a
add esp, 8
mov ebx, 0x80070057
jmp 0x45ef78
Function at 0x475c8a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476942
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00475dea
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x475dd4
test ebx, ebx
jl 0x475d78
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c0ee
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x475d99
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x475d8b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0047775a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0047775a
add esp, 8
mov ebx, 0x80070057
jmp 0x475d78
Function at 0x48d3aa
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048e062
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048d50a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48d4f4
test ebx, ebx
jl 0x48d498
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd4380e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48d4b9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48d4ab
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048ee7a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048ee7a
add esp, 8
mov ebx, 0x80070057
jmp 0x48d498
Function at 0x4a426a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a4f22
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a43ca
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a43b4
test ebx, ebx
jl 0x4a4358
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5a6ce
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a4379
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a436b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a5d3a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a5d3a
add esp, 8
mov ebx, 0x80070057
jmp 0x4a4358
Function at 0x4b95c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1368
cmp edx, dword [eax]
je 0x4b95e3
add eax, 8
inc ecx
cmp eax, 0x4c13f8
jl 0x4b95d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1368]
jne 0x4b9711
mov eax, dword [0x4c5cec]
cmp eax, 1
je 0x4b96eb
test eax, eax
jne 0x4b9614
cmp dword [0x4c1290], 1
je 0x4b96eb
cmp edx, 0xfc
je 0x4b9711
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b964b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9fa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba430
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b968e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba430
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be9cc
push edi
call fcn.004bc300
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9fa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9fb0
lea eax, [ebp - 0xa0]
push 0x4be9ac
push eax
call fcn.004b9fb0
push dword [esi + 0x4c136c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9fb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc274
add esp, 0x2c
pop edi
jmp 0x4b9711
lea eax, [ebp + 8]
lea esi, [esi + 0x4c136c]
push 0
push eax
push dword [esi]
call fcn.004ba430
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x407ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [eax]
push eax
mov esp, dword [esi - 0x80]
inc edi
add dword [ecx + 0x10], edx
outsd dx, dword [esi]
inc ebx
lodsd eax, dword [esi]
mov edx, dword [ebp + 0x26]
push eax
push ecx
or eax, 0xf9000e64
add byte [ebx - 0x3ca2e3f9], al
bound edx, qword [eax - 0x6f6f6f70]
stc
nop
nop
fmul qword [ebx + 0x7cec83ec]
add dword [ecx], 0x10
dec edi
jl 0x407f03
pop dword [ebp + 0x10]
dec esi
into
add byte [eax], al
fld qword [ebp + 0x2c]
fcomp qword [0xa8c230]
mov edi, edi
sbb byte [ecx + 0x5620448b], bl
xor esi, esi
push edi
fnstsw ax
mov dword [ebp - 4], esi
xchg byte [eax - 0xa], al
les eax, [0x9a7afb8b]
fld qword [ebp + 8]
fchs
fstp qword [ebp + 0x78]
mov dword [ecx], 0x59760001
mov esp, dword [edx]
or al, 0x42
push ebp
or byte [ebp - 0x13af13bb], cl
push edx
cli
adc eax, 0x1240c118
fstp qword [ebp + 0x4b]
fucom st(1)
ja 0x407f28
sbb eax, 0x40c230
lodsd eax, dword [esi]
les ecx, [edi + ebx*8]
loopne 0x407f4d
xor dl, al
inc eax
add byte [ebp - 0x1f20f33c], ch
test ah, 0x44
jnp 0x407fcd
les eax, [ebx + edi*2 + 0x72]
lea edi, [esi + 0x37762b3b]
fld qword [ebp - 0x14]
fcomp qword [0x40c230]
fnstsw ax
test ah, 0x44
mov eax, dword [0xec45dd48]
fsubp st(2)
adc byte [eax + 0xe3c0048], dh
pop ds
push eax
sub esp, 8
dec eax
inc esi
and al, 0xff
push esp
sbb cl, al
inc eax
add ch, bl
pop ebp
hlt
fld qword [ebp + 8]
fcomp qword [0xee408530]
fnstsw ax
cdq
add byte [ecx], al
add byte [ebp + 0x4c], dh
inc ebp
inc ebp
or byte [edx + 0xd], bh
arpl sp, di
inc eax
add ch, bl
and esp, esi
fld st(0)
fsubr qword [edx + 0x40c228]
invalid