joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458f68
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004588a0
xor eax, eax
push ebp
push 0x4590d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4590c3
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x458fb3
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x458fbd
call fcn.00403ae0
jmp 0x4590e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00416548
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4590b8
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x45906b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x459058
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004034a4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00458f20
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4590ec]
cmp dl, byte [eax + 0x28]
je 0x4590bf
call fcn.0040b704
jmp 0x4590bf
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00416568
jmp 0x4590bf
cmp ecx, ebx
jge 0x459087
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00416568
jmp 0x458fbd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00416548
cmp edx, dword [esp + 4]
jne 0x4590a7
cmp eax, dword [esp]
pop edx
pop eax
jne 0x458fbd
push ebp
call fcn.00458f20
pop ecx
jmp 0x4590bf
push ebp
call fcn.00458f20
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4590e0
mov eax, dword [ebp - 4]
call fcn.004588ac
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4590f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459212
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004588a0
xor eax, eax
push ebp
push 0x4591f5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x459140
call fcn.00403ae0
jmp 0x4591fc
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4591df
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4591df
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004034a4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4591df
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040aef8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x45922c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x470a84]
mov dl, 1
mov eax, dword [0x457bb4]
call fcn.0040b81c
call fcn.00403a34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4591fc
mov eax, dword [ebp - 4]
call fcn.004588ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459219
lea eax, [ebp - 0x28]
call fcn.00403ff8
ret
Function at 0x459278
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4593c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004588a0
xor eax, eax
push ebp
push 0x4593a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4592dd
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4592dd
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x45938f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4592f0
call fcn.00403ae0
jmp 0x4593ac
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x45938f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x45938f
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004034a4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x45938f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040aef8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4593dc
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x470a84]
mov dl, 1
mov eax, dword [0x457bb4]
call fcn.0040b81c
call fcn.00403a34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4593ac
mov eax, dword [ebp - 4]
call fcn.004588ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4593c9
lea eax, [ebp - 0x28]
call fcn.00403ff8
ret
Function at 0x45d18c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x45d1ba
mov eax, ebx
call fcn.0045dc40
cmp dword [ebx + 0x40], 0
je 0x45d1b3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45d22b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45d21d
cmp dword [ebx + 8], 0
je 0x45d1dc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45d1ee
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45d21d
cmp dword [ebx + 8], 0
je 0x45d1cf
cmp eax, 3
je 0x45d201
dec eax
jne 0x45d1cf
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45d1cf
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45d1cf
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x45d249
cmp dword [ebx + 0x14], 0xcc
je 0x45d249
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045d254
pop ebx
ret
Function at 0x41ab80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ecx + 4]
xor eax, eax
push esi
push edi
mov edi, dword [ecx]
xor esi, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edi
mov dword [edi + 0x16], eax
test ebx, ebx
jle 0x41abbd
nop
movzx edx, byte [edi + esi]
mov ecx, eax
shr ecx, 0x18
inc esi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x529540]
cmp esi, ebx
jl 0x41aba0
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx + 0xc]
xor esi, esi
test ebx, ebx
jle 0x41abed
mov edi, dword [ecx + 8]
nop dword [eax]
movzx edx, byte [edi + esi]
mov ecx, eax
shr ecx, 0x18
inc esi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x529540]
cmp esi, ebx
jl 0x41abd0
mov edi, dword [ebp - 8]
mov byte [edi + 0x16], al
mov ecx, eax
shr ecx, 8
mov byte [edi + 0x17], cl
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 0x18], cl
shr eax, 0x18
mov byte [edi + 0x19], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ecx + 0x64]
xor ebx, ebx
imul edi, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], ecx
test edi, edi
je 0x42228b
nop dword [eax]
mov edx, dword [ebp + 0xc]
mov eax, esi
shr eax, 1
movzx edx, byte [eax + edx]
lea eax, [ecx + 0xa8]
lea eax, [eax + ebx*8]
mov ecx, esi
push eax
mov eax, edx
shr edx, 4
and eax, 0xf
and cl, 1
cmove edx, eax
push edx
call fcn.004248c0
mov ecx, dword [ebp + 8]
add esp, 8
mov word [ecx + esi*2], ax
mov eax, ebx
mov ecx, dword [ebp - 4]
xor eax, 1
inc esi
cmp dword [ecx + 0x64], 2
cmovne eax, ebx
mov ebx, eax
cmp esi, edi
jb 0x422240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x422c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor esi, esi
mov eax, dword [edi + 0x64]
imul eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x422c8b
nop word [eax + eax]
push dword [edi + 0x8c]
lea eax, [edi + 0xa8]
lea eax, [eax + ebx*8]
push eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [esi + eax]
push eax
call fcn.00424940
mov ecx, dword [ebp + 8]
add esp, 0xc
mov word [ecx + esi*2], ax
mov eax, ebx
xor eax, 1
inc esi
cmp dword [edi + 0x64], 2
cmovne eax, ebx
mov ebx, eax
cmp esi, dword [ebp + 0x10]
jb 0x422c50
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x424350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506d66
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5472f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWaveStreamCtrl.0
call fcn.004487b0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x30]
call fcn.0041e870
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov eax, dword [ebp + 8]
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
mov dword [edi + 0x24], 0
mov dword [edi + 0x2c], eax
call fcn.0041ef10
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x43c6da
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x50d20c]
test eax, eax
je 0x43c719
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43c719
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43c719
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43c719
cmp dword [ecx + 0x74], 0xe
jbe 0x43c719
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44a2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, edx
test edi, edi
je 0x44a2e8
imul edx, dword [ecx], 0xe9
movzx eax, byte [esi + ebx]
add eax, edx
mov dword [ecx], eax
add byte [ecx + 4], al
xor byte [ecx + 5], al
movzx eax, byte [esi + ebx]
add byte [ecx + 6], al
movzx eax, byte [esi + ebx]
inc esi
xor byte [ecx + 7], al
cmp esi, edi
jb 0x44a2c1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44eb60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov eax, edx
mov dword [ebp - 8], ecx
mov ecx, dword [0x55fe10]
push edi
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00457540
test eax, eax
je 0x44ec89
call fcn.0044f6a0
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0044f3c0
test eax, eax
je 0x44ec78
mov ecx, dword [eax + 0x20]
mov ebx, 1
call fcn.004fee00
test eax, eax
jne 0x44ebc5
mov ecx, edi
call fcn.0044ef10
test eax, eax
jne 0x44ebc5
xor ebx, ebx
mov esi, 0x80000009
jmp 0x44ebc8
mov esi, dword [ebp - 8]
call fcn.0044f690
test ebx, ebx
je 0x44ec6f
push 0x1c
call fcn.00424b2d
add esp, 4
mov esi, eax
push 0
push 0
push 0
push 0
call dword [0x50d2d4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
push esi
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
push 0
push 0x44eca0
mov dword [esi + 8], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0
call fcn.00435f2f
add esp, 0xc
cmp eax, 0xffffffff
je 0x44ec58
push 2
push eax
mov dword [esi], eax
call dword [0x50d2e4]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [0x50d2e0]
push dword [esi + 4]
call dword [0x50d2d8]
mov eax, dword [ebp - 8]
mov dword [esi + 4], 0
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1c
push esi
call fcn.00424b5d
add esp, 8
mov eax, 0x80000008
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0044f690
mov eax, 0x80000003
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80000005
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x14]
pop ebp
jmp fcn.0047fa80

Function at 0x497fd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x7c
push esi
mov esi, ecx
mov eax, ebx
xor ecx, ecx
mul edx
push edi
mov dword [esi], vtable.DCDstrbtdPrcssng.0
seto cl
mov dword [esi + 4], ebx
neg ecx
mov dword [esi + 8], ebx
or ecx, eax
mov dword [esi + 0xc], 2
push ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
call fcn.00424b6b
imul ecx, ebx, 0x7c
mov dword [esi + 0x24], eax
push ecx
push 0
push eax
call fcn.0042fd40
add esp, 0x10
lea eax, [esi + 0x28]
push 0xfa0
push eax
call dword [0x50d250]
mov eax, dword [esi + 0x24]
push 0
push 0
push 1
mov dword [eax], 1
mov eax, dword [esi + 0x24]
push 0
mov dword [eax + 8], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0xc], 0
call dword [0x50d2d4]
mov ecx, dword [esi + 0x24]
mov edi, 1
mov dword [ebp - 4], edi
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0x18], esi
cmp ebx, edi
jbe 0x4981ab
mov ebx, 0x7c
mov dword [ebp - 8], ebx
mov eax, dword [esi + 0x24]
push 0
push 1
push 1
mov dword [ebx + eax], 0
mov eax, dword [esi + 0x24]
push 0
mov dword [ebx + eax + 8], edi
mov edi, dword [0x50d2d4]
call edi
mov ecx, dword [esi + 0x24]
push 0
push 0
push 1
push 0
mov dword [ebx + ecx + 0xc], eax
call edi
mov ecx, dword [esi + 0x24]
mov edi, ebx
mov dword [ebx + ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x18], esi
mov ebx, 4
nop dword [eax + eax]
mov eax, dword [esi + 0x24]
add eax, 0x1c
push 0xfa0
add eax, edi
push eax
call dword [0x50d250]
add edi, 0x18
sub ebx, 1
jne 0x498100
mov edi, dword [ebp - 4]
mov ecx, esi
push 2
push edi
call fcn.00497ad0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x24]
push ebx
mov ebx, dword [ebp - 8]
add eax, ebx
push eax
push 0x4978b0
push 0
push 0
call fcn.00435fbd
mov ecx, dword [esi + 0x24]
add esp, 0x18
push 0
push eax
mov dword [ebx + ecx + 4], eax
call dword [0x50d2e4]
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x7c
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
cmp edi, eax
jb 0x4980a6
mov ebx, dword [0x50d2ec]
lea ecx, [eax - 1]
mov edi, 0x7c
mov dword [ebp + 8], ecx
nop
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
jne 0x4981a0
nop dword [eax]
push 1
call ebx
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
je 0x498190
mov ecx, dword [ebp + 8]
add edi, 0x7c
sub ecx, 1
mov dword [ebp + 8], ecx
jne 0x498180
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4be490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x474
mov eax, dword [0x5472f8]
xor eax, esp
mov dword [esp + 0x470], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, edx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
cmp edi, 1
jb 0x4be665
mov ecx, 1
call fcn.004b7e40
mov ecx, 1
call fcn.004f6810
push 0x30c
push 0
push ebx
call fcn.0042fd40
add esp, 0xc
mov byte [esp + 0x78], 0
lea ebx, [esp + 0x78]
test edi, edi
je 0x4be56e
mov edi, dword [esp + 0xc]
sub edi, esi
mov dword [esp + 0xc], edi
push dword [edi + esi]
push dword [esi]
push str._s__s
push ebx
call fcn.00401420
mov ecx, dword [esi]
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4be530
sub ecx, edx
mov byte [ecx + ebx], al
mov edx, dword [esi]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4be541
mov eax, dword [edi + esi]
sub edx, ecx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4be550
sub eax, edi
add ebx, 2
mov edi, dword [esp + 0xc]
add eax, edx
add ebx, eax
add esi, 4
sub dword [esp + 0x10], 1
jne 0x4be515
push 0x58
lea eax, [esp + 0x24]
mov byte [ebx], 0
push 0
push eax
call fcn.0042fd40
mov eax, dword [0x55faa0]
xor ecx, ecx
mov edx, dword [ebp + 0x18]
add esp, 0xc
mov dword [esp + 0x24], eax
cmp edx, 1
lea eax, [esp + 0x78]
mov dword [esp + 0x20], 0x58
mov dword [esp + 0x2c], eax
sete cl
mov eax, dword [esp + 0x14]
mov esi, 0x1000
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
lea ecx, [ecx*2 + 0x804]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
xor eax, eax
test edx, edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x40], 0x30c
cmove eax, esi
mov dword [esp + 0x5c], 0x52a5dc
or ecx, eax
mov dword [esp + 0x54], ecx
sub edx, 0
je 0x4be62e
sub edx, 1
je 0x4be621
mov esi, 4
call fcn.004f6860
xor ecx, ecx
call fcn.004b7e40
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00424b17
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x20]
push eax
call dword [0x50d048]
jmp 0x4be639
lea eax, [esp + 0x20]
push eax
call dword [0x50d044]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
call fcn.004f6860
xor ecx, ecx
call fcn.004b7e40
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00424b17
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x47c]
mov eax, 7
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00424b17
mov esp, ebp
pop ebp
ret
Function at 0x4beda0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.004c4820
movzx ecx, word [edi + 0xe]
call fcn.004eddc0
xor esi, esi
xor bh, bh
xor bl, bl
cmp dword [0x55fdb4], esi
jle 0x4bedde
add bh, byte [esi + edi + 0x40]
xor bl, byte [esi + edi + 0x40]
call fcn.004eddd0
movzx eax, ax
sub byte [esi + edi + 0x40], al
inc esi
cmp esi, dword [0x55fdb4]
jl 0x4bedc1
call fcn.004c4810
cmp byte [edi + 0x38], bh
jne 0x4bedf6
cmp byte [edi + 0x39], bl
jne 0x4bedf6
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x4bef00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.004c4820
movzx ecx, word [esi + 0xe]
call fcn.004eddc0
mov ebx, dword [0x55fdb4]
xor edi, edi
mov word [esi + 0x38], 0
test ebx, ebx
jle 0x4bef46
call fcn.004eddd0
movzx eax, ax
add byte [edi + esi + 0x40], al
movzx eax, byte [edi + esi + 0x40]
add byte [esi + 0x38], al
movzx eax, byte [edi + esi + 0x40]
inc edi
xor byte [esi + 0x39], al
cmp edi, ebx
jl 0x4bef25
call fcn.004eddd0
mov byte [esi + 0x3a], al
call fcn.004eddd0
pop edi
mov byte [esi + 0x3b], al
mov byte [esi + 0x3c], 1
pop esi
pop ebx
jmp fcn.004c4810

Function at 0x4c1b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor cl, cl
mov dword [ebp - 0x10], esi
xor bl, bl
mov dword [ebp - 0xc], edi
xor eax, eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x4c1c39
cmp esi, 0x20
jb 0x4c1c39
mov ecx, esi
xorps xmm2, xmm2
and ecx, 0xffffffe0
xorps xmm4, xmm4
xorps xmm3, xmm3
xorps xmm5, xmm5
nop
movups xmm1, xmmword [edi + eax]
movaps xmm0, xmm1
pxor xmm5, xmm1
movups xmm1, xmmword [edi + eax + 0x10]
add eax, 0x20
paddb xmm2, xmm0
movaps xmm0, xmm1
pxor xmm3, xmm1
paddb xmm4, xmm0
cmp eax, ecx
jb 0x4c1ba0
pxor xmm3, xmm5
paddb xmm4, xmm2
movaps xmm0, xmm3
psrldq xmm0, 8
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 2
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 1
pxor xmm3, xmm0
movaps xmm0, xmm4
psrldq xmm0, 8
paddb xmm4, xmm0
movd ebx, xmm3
movups xmm0, xmm4
psrldq xmm0, 4
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 2
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 1
paddb xmm4, xmm0
movd ecx, xmm4
mov dword [ebp - 8], ecx
xor dh, dh
mov byte [ebp - 1], 0
cmp eax, esi
jae 0x4c1c84
mov ecx, esi
sub ecx, eax
cmp ecx, 2
mov ch, byte [ebp - 1]
jb 0x4c1c71
lea edi, [esi - 1]
mov esi, dword [ebp - 0xc]
mov dl, byte [esi + eax]
mov cl, byte [esi + eax + 1]
add ch, dl
xor dl, cl
add eax, 2
add dh, cl
xor bl, dl
cmp eax, edi
jb 0x4c1c55
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
cmp eax, esi
jae 0x4c1c7d
mov al, byte [eax + edi]
add byte [ebp - 8], al
xor bl, al
add dh, ch
mov ecx, dword [ebp - 8]
add cl, dh
cmp byte [ebp + 8], cl
jne 0x4c1c9a
cmp byte [ebp + 0xc], bl
jne 0x4c1c9a
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ebc00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b3d9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5472f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esi + 0x28]
mov eax, dword [esi + 0x30]
sub eax, dword [esi + 0x24]
sub ebx, dword [esi + 0x1c]
cmp dword [esi + 0x50], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
jle 0x4ebce2
nop word [eax + eax]
push 0x1c
call fcn.00424b2d
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
mov dword [edi], 1
mov dword [ebp - 4], 0xffffffff
call fcn.0043224e
xor edx, edx
div ebx
mov eax, dword [esi + 0x1c]
add eax, edx
mov dword [edi + 0x10], eax
call fcn.0043224e
cdq
mov ecx, 0x64
idiv ecx
mov eax, dword [esi + 0x20]
sub eax, edx
mov dword [edi + 0x14], eax
call fcn.0043224e
xor edx, edx
mov ecx, esi
div dword [ebp - 0x14]
mov eax, dword [esi + 0x24]
add eax, edx
mov dword [edi + 0x18], eax
movq xmm0, qword [edi + 0x10]
movq qword [edi + 4], xmm0
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x68]
sub dword [edi + 4], eax
mov eax, dword [esi + 0x6c]
sub dword [edi + 8], eax
mov eax, dword [esi + 0x70]
sub dword [edi + 0xc], eax
push edi
call fcn.00408f80
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [esi + 0x50]
jl 0x4ebc50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ebd90
Capabilities:
Get number of processors

Disassembly:
push esi
mov esi, ecx
call fcn.004ebd40
mov ecx, esi
pop esi
jmp fcn.004ebc00