joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55bf90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00573700
push esi
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
lea eax, [esp + 0xc]
xor esi, esi
push eax
push edi
call fcn.005432c0
add esp, 0xc
test eax, eax
je 0x55c1ab
nop dword [eax + eax]
mov ecx, dword [esp + 8]
lea eax, [esi + 1]
shl ecx, 0xa
inc edi
and ecx, dword [esp + 0x20]
cmove eax, esi
mov esi, eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push edi
call fcn.005432c0
add esp, 0xc
test eax, eax
jne 0x55bfc0
test esi, esi
je 0x55c1ab
mov eax, dword [esp + 0x50]
cdq
idiv esi
mov edi, dword [esp + 0x5c]
cmp esi, 1
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
mov esi, 0
cmovne esi, dword [esp + 0x58]
push edi
push 0
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], esi
call fcn.0058b610
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esp + 0x20]
push eax
push 0
call fcn.005432c0
add esp, 0x18
test eax, eax
je 0x55c176
mov ebx, dword [esp + 0x60]
nop word [eax + eax]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x28], eax
je 0x55c152
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x55c183
push edi
push ebx
push dword [esp + 0x58]
and esi, 1
push dword [esp + 0x58]
add esi, dword [esp + 0x2c]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push esi
mov esi, dword [esp + 0x88]
push esi
push ecx
call fcn.0055c1d0
add esp, 0x3c
test eax, eax
je 0x55c1a1
add esi, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x54], esi
test edi, edi
jle 0x55c14e
cmp edi, 0x20
jb 0x55c12b
lea eax, [ebx - 1]
lea edx, [ebp - 1]
add eax, edi
add edx, edi
cmp ebp, eax
ja 0x55c0e1
cmp edx, ebx
jae 0x55c12b
mov eax, edi
and eax, 0x8000001f
jns 0x55c0ef
dec eax
or eax, 0xffffffe0
inc eax
mov edx, edi
mov esi, ebx
sub edx, eax
mov eax, ebp
sub esi, ebp
nop dword [eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + ecx + 0x10]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, edx
jl 0x55c100
cmp ecx, edi
jge 0x55c14e
mov esi, ebx
lea eax, [ecx + ebp]
mov edx, edi
sub esi, ebp
sub edx, ecx
nop word [eax + eax]
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x55c140
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
inc eax
push ecx
push eax
mov dword [esp + 0x2c], eax
call fcn.005432c0
add esp, 0xc
test eax, eax
jne 0x55c050
pop ebp
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 0x14
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.004d5da0
add esp, 0x14
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.004d5da0
add esp, 0x14
xor eax, eax
pop edi
pop esi
add esp, 0x14
ret
Function at 0x575a95
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5a8348
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005a81c7

Function at 0x5ab9e2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ab6a2

Function at 0x5b2fc0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.004c99c0
add esp, 8
test esi, esi
jg 0x5b3017
je 0x5b2ff9
cmp esi, 0xffffffff
jne 0x5b3017
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.005b3220
add esp, 4
test eax, eax
je 0x5b3017
push 0xa
push edi
call fcn.004ca0b0
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x5b3380
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 6
je 0x5b339b
push eax
push esi
call fcn.005b3a30
add esp, 8
test eax, eax
jle 0x5b33e3
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.004c99c0
add esp, 8
test edi, edi
jg 0x5b33e0
push edi
call fcn.005b32e0
add esp, 4
test eax, eax
je 0x5b33e0
push 0xa
push esi
call fcn.004ca0b0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x5b52f0
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, 1
push edi
push ebx
push esi
call fcn.005b57b0
mov edi, eax
add esp, 8
test edi, edi
jns 0x5b532b
push 0x7b
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.004d5da0
add esp, 0x14
jmp 0x5b53ec
call fcn.005b56e0
cmp eax, 1
jne 0x5b53fc
test edi, edi
jle 0x5b5344
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
push 0x8e
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.004dc6b0
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
jne 0x5b5381
push 0x92
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.004d5da0
add esp, 0x14
jmp 0x5b53d2
cmp word [ecx + 8], 2
je 0x5b53a2
push 0x99
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.004d5da0
add esp, 0x14
jmp 0x5b53d2
mov eax, dword [ecx + 0xc]
xor ebp, ebp
mov eax, dword [eax]
movzx eax, byte [eax]
mov byte [ebx], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 1]
mov byte [ebx + 1], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 2]
mov byte [ebx + 2], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 3]
mov byte [ebx + 3], al
push 0xa2
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.004dc6b0
add esp, 0x10
test ebp, ebp
je 0x5b5403
push esi
push str.host
push 2
call fcn.004d53c0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x5b5760
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x5b57a0
push 0x233
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.004d5da0
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
ret
Function at 0x41eeba
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41eef9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41eef9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41eef9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41eef9
cmp dword [ecx + 0x74], 0xe
jbe 0x41eef9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x424eaf
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x475298
push 0x475290
push str.FlsAlloc
push 0x1f
call fcn.00424d6e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424ee3
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d144]
call esi
jmp 0x424ee9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x424f2d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4752a8
push 0x4752a0
push str.FlsGetValue
push 0x21
call fcn.00424d6e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424f64
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x424f6c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4752b0
push 0x4752a8
push str.FlsSetValue
push 0x22
call fcn.00424d6e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424fa6
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42d144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x42675e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4267fb
push ebx
push esi
call fcn.00426727
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004266bb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4267a8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4267fa
push edi
push eax
call fcn.00425171
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4267c8
call fcn.004251bf
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4267f9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004266bb
add esp, 0x20
test eax, eax
jne 0x4267e7
push edi
call fcn.004251bf
jmp 0x4267ef
push ebx
call fcn.004251bf
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42ca40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42ca6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42ca6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x415124
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
jmp 0x4151e3
cmp dword [esi + 0x10], 0x1000
jne 0x4151cf
test byte [esi + 0x15], 1
jne 0x4151cf
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x415180
cmp ebp, 2
je 0x415180
cmp ebp, 0x10
je 0x415180
cmp ebp, 0x20
jne 0x41519c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41519c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4151ad
mov eax, dword [esi]
add eax, ebx
call fcn.0041511c
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4151a0
cmp byte [esp + 4], 0
je 0x4151cf
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x415155
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3b742f42
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2f45226e
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x5541b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00554140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00554140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00554140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00554140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x554bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x554c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x56687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x554c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x554c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x7003f91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x7003fa0
pop dword [ebp - 0x30]
mov eax, 0x7003fa0
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x5488364
sub dword [ebp - 0x40], 0xb6f63e19
mov dword [ebp - 0x3c], 0xcf11c01c
sub dword [ebp - 0x3c], 0x9cde73d7
mov dword [ebp - 0x38], 0x18ce7b5e
sub dword [ebp - 0x38], 0xcc823730
mov dword [ebp - 0x34], 0x9f6bb362
sub dword [ebp - 0x34], 0x9f6bb362
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x5033cf1f
sub dword [ebp - 0x40], 0xdbc165c9
mov dword [ebp - 0x3c], 0x575a73d5
add dword [ebp - 0x3c], 0xea11eda0
mov dword [ebp - 0x38], 0xbcc46877
add dword [ebp - 0x38], 0xa6ab03f5
mov dword [ebp - 0x34], 0x786cd57f
sub dword [ebp - 0x34], 0x786cd57f
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x767612f3
add eax, 0x908b0d41
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39295
push 0
call eax
mov ecx, 0x4222
xor edi, edi
add edi, eax
mov edx, 0x4198a688
sub edx, 0x3a96c688
add edx, dword [ebp - 0x30]
mov esi, 0x568ab26b
add dword [ebp - 0x24], ebx
mov ebx, dword [edx]
xor ebx, esi
add dword [ebp - 8], ebx
mov dword [edi], ebx
add dword [ebp - 0x20], edx
add edi, 4
add edx, 0xdc54db29
add edx, 0x23ab24db
loop 0x70040ae
add eax, 0xfb5b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x93563c10
sub ecx, 0x8c563c10
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003f91
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003f91
int3
Function at 0x47e203
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esi + 0x44]
test ebx, ebx
je 0x47e26e
cmp ebx, 0x10f88312
jae 0x47e26e
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
push ebp
mov ebp, dword [esi + 0x66]
add ecx, eax
mov dword [eax], ecx
mov ecx, ebx
sub edx, eax
push edi
mov edi, dword [esi + 0x10]
cmp edx, ecx
jae 0x47e230
mov ecx, edx
cmp dword [esi + 0x2c], 0
jne 0x47e246
mov edx, dword [esi + 4]
sub edx, dword [esi + 0x28]
cmp edx, ecx
ja 0x47e246
mov edx, dword [esi + 4]
mov dword [esi + 0x2c], edx
add dword [esi + 0x28], ecx
sub ebx, ecx
mov dword [esi + 0x44], ebx
test ecx, ecx
je 0x47e269
nop
cmp eax, ebp
sbb edx, edx
and eax, dword [eax]
mov ecx, dword [ebx + ebp]
aad 3
ror byte [edx + 0x14883a14], 1
cmp byte [eax + 0x49], al
jne 0x47e253
pop edi
mov dword [esi + 0x18], eax
pop esi
call [ecx - 0x3d]
scasb al, byte es:[edi]
add al, 0xff
jb 0x47e2e2
sub ecx, dword [eax]
push esi
push edi
mov esi, eax
lea esp, [ecx + ecx*8 - 0x38097b00]
cmp dword [esi + 0x2c], 0
mov edi, ebx
jne 0x47e2b2
mov edx, dword [esi + 0x28]
and al, 0x3c
cmp ecx, ebp
dec esi
sbb byte [ebx + 0x2bc22beb], cl
jmp 0x3becad9
push ebp
push edi
push esi
call 0x565ccea3
push eax
call 0x46810f6a
sub al, 0x75
or ecx, dword [ebx + 0x46390446]
sub byte [edx + 3], dh
mov dword [esi + 0x2c], eax
mov edx, ebx
call fcn.0047e203
cmp dword [esi + 0x18], ebx
jae 0x47e2e8
cmp dword [esi + 0x1c], ebp
jae 0x47e2e8
cmp dword [esi + 0x44], 0x10f88312
jb 0x47e283
adc al, byte [ebx - 0x648def08]
add edi, eax
sub ebx, eax
pop ebp
xor ebx, dword [ebx + 0x5f]
pop edi
pop esi
inc ecx
xor al, 0xeb
dec esp
push edi
pop ebp
xor ebx, dword [ebx + 0x5f]
scasb al, byte es:[edi]
add al, 0x8b
ror dword [ebp - 0x6f3333b8], 0x90
nop
nop
push ecx
push ebx
mov ebx, dword [esp - 0x73]
push esp
and al, 0x28
and byte [edi + 0x40], ch
mov edx, dword [edi + 0x20]
mov esi, dword [edi + 0x24]
add ecx, eax
mov eax, dword [edi + 0xc]
adc al, 0x74
add edx, dword [eax]
mov cl, byte [edi + 2]
mov ebx, 0x74ca3b04
shl ebx, cl
mov dword [esi - 0x75], ebx
invalid
Function at 0x490f51
Capabilities:
Encode data using xor

Disassembly:
rcr byte [ecx + edi], cl
xor ebx, edx
xor ebx, dword [ebp + esi*8 + 0x57b71800]
mov edx, dword [ebp + esi*8 + 0x57b71804]
adc byte [esi + 0x10e8c1f4], dh
call 0x104a04e0
or al, 0x89
xor edx, dword [ebp + esi*8 + 0x57b71004]
adc byte [esi - 0x3b49f010], dh
mov dh, 0xc4
mov dh, 0xc4
call 0x84a04f4
or al, 0x89
xor edx, dword [ebp + esi*8 - 0x76f3f7fc]
xor ebx, dword [ebp + eax*8]
xor edx, dword [ebp + eax*8 + 4]
movzx esi, bl
mov eax, ebx
add ecx, 4
jne 0x490f26
sub edi, 4
xor eax, dword [ecx + edi]
mov ecx, edi
mov eax, ecx
invalid
Function at 0x418487
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x3c]
xor ebx, ebx
cmp esi, 1
je 0x4184b7
cmp esi, 2
je 0x4184b7
cmp esi, 4
je 0x4184b7
cmp esi, 8
je 0x4184b7
cmp esi, 0x18
je 0x4184b7
cmp esi, 0x20
je 0x4184b7
xor eax, eax
jmp 0x418681
mov ecx, dword [0x4219d3c]
push ebp
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ecx, ecx
jle 0x41867d
mov edx, dword [esp + 0x28]
mov eax, dword [edi*4 + 0x4219f48]
cmp dword [eax], edx
je 0x4184ea
inc edi
mov dword [esp + 0x10], edi
cmp edi, ecx
jl 0x4184d1
jmp 0x41867d
cmp dword [esp + 0x38], 0x20
jne 0x418654
mov eax, dword [eax + 8]
test eax, eax
je 0x41852a
cmp esi, 0x20
je 0x418506
cmp esi, 0xffffffff
jne 0x41852a
push esi
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
jmp 0x41867b
mov eax, dword [esp + 0x2c]
inc eax
imul ebp, eax, 3
and ebp, 0xfffffffc
mov eax, ebp
mov dword [esp + 0x14], ebp
imul eax, dword [esp + 0x30]
push eax
push 0
push dword [0x4218cd8]
call dword [0x4216ae4]
mov dword [esp + 0x18], eax
test eax, eax
je 0x41867d
mov ebx, dword [esp + 0x30]
test ebx, ebx
jle 0x41861f
mov edx, dword [esp + 0x24]
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov esi, edx
test eax, eax
jle 0x4185ff
mov ebp, ecx
mov edi, eax
mov ecx, 0xff
movzx eax, byte [esi + 2]
sub eax, ecx
movzx ecx, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp + 2], al
movzx eax, byte [esi + 1]
sub eax, ecx
movzx ecx, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp + 1], al
movzx eax, byte [esi]
lea esi, [esi + 4]
sub eax, ecx
movzx ecx, byte [esi - 1]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp], al
lea ebp, [ebp + 3]
dec edi
jne 0x418590
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
add edx, dword [esp + 0x34]
add ecx, ebp
dec dword [esp + 0x24]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ecx
jne 0x41857d
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x4219f48]
push esi
push dword [esp + 0x44]
mov esi, dword [esp + 0x20]
push dword [esp + 0x44]
push ebp
push ebx
push dword [esp + 0x40]
push esi
push dword [esp + 0x3c]
call dword [eax + 4]
push esi
push 0
push dword [0x4218cd8]
mov ebx, eax
call dword [0x4216ae8]
jmp 0x41867d
cmp dword [esp + 0x38], 0x18
jne 0x41867d
push esi
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [eax + 4]
mov ebx, eax
pop edi
mov eax, ebx
pop ebp
pop esi
pop ebx
add esp, 0xc
ret 0x28