joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401caa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop eax
call 0x401caa
dec eax
pop eax
add eax, ebx
xor eax, eax
pop eax
mov al, byte [ebp + 0xc]
lea ebx, [edi + 0xc]
mov esi, dword [ebp + 8]
xor edx, edx
mov byte [edi], al
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp + 0xc], ebx
mov edi, edi
mov al, byte [edx + esi]
mov byte [ebx + edx], al
inc edx
cmp edx, 0x14
jb 0x401cd0
mov eax, dword [esi + 0x14]
push eax
mov dword [edi + 4], eax
call fcn.00401ff0
xor edx, edx
mov dword [edi + 8], eax
add esp, 4
cmp dword [edi + 4], edx
jbe 0x401d05
mov ecx, dword [edi + 8]
mov al, byte [edx + esi + 0x18]
mov byte [edx + ecx], al
inc edx
cmp edx, dword [edi + 4]
jb 0x401cf5
cmp byte [edi], 0
je 0x401e03
mov eax, dword [edi + 4]
xor ecx, ecx
mov edx, dword [edi + 8]
mov dword [ebp + 8], eax
test eax, eax
je 0x401e03
lea edi, [eax - 1]
add edi, edx
jmp 0x401d30
movzx esi, byte [0x404001]
xor edx, edx
add esi, 2
movzx ebx, byte [ebx]
mov eax, ecx
div esi
test edx, edx
je 0x401da1
mov eax, dword [ebp + 0xc]
movzx esi, byte [eax + 2]
add esi, 4
je 0x401d80
xor edx, edx
mov eax, ecx
div esi
test edx, edx
je 0x401d80
mov eax, 0xcccccccd
mul ecx
mov eax, ecx
shr edx, 4
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
mov edx, ecx
movzx eax, byte [eax + section..data]
sub edx, eax
add ebx, edx
jmp 0x401df0
mov eax, 0xcccccccd
mul ecx
mov eax, ecx
shr edx, 4
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
mov edx, dword [ebp + 0xc]
movzx eax, byte [eax + edx]
add eax, ecx
add ebx, eax
jmp 0x401df0
movzx esi, byte [0x404003]
xor edx, edx
add esi, 4
mov eax, ecx
div esi
mov eax, 0xcccccccd
test edx, edx
je 0x401dd6
mul ecx
mov eax, ecx
shr edx, 4
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
mov edx, dword [ebp + 0xc]
movzx eax, byte [eax + edx]
sub eax, ecx
add ebx, eax
jmp 0x401df0
mul ecx
mov eax, ecx
shr edx, 4
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
movzx eax, byte [eax + section..data]
add eax, ecx
sub ebx, eax
xor byte [edi], bl
inc ecx
mov ebx, dword [ebp + 0xc]
dec edi
cmp ecx, dword [ebp + 8]
jb 0x401d30
mov edi, dword [ebp - 4]
push ebx
call 0x401e0a
dec ebx
pop ebx
call 0x401e11
dec ebx
pop ebx
or ebx, ebp
sbb ebx, ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ecx + 4]
lea eax, [ecx + 0xc]
push esi
mov esi, dword [ecx + 8]
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edx, edx
je 0x401fb2
push ebx
push edi
lea edi, [edx - 1]
add edi, esi
jmp 0x401ee0
movzx ebx, byte [eax]
xor edx, edx
movzx esi, byte [0x404001]
mov eax, ecx
add esi, 2
div esi
test edx, edx
je 0x401f51
mov eax, dword [ebp - 4]
movzx esi, byte [eax + 2]
add esi, 4
je 0x401f30
xor edx, edx
mov eax, ecx
div esi
test edx, edx
je 0x401f30
mov eax, 0xcccccccd
mul ecx
mov eax, ecx
shr edx, 4
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
mov edx, ecx
movzx eax, byte [eax + section..data]
sub edx, eax
add ebx, edx
jmp 0x401fa0
mov eax, 0xcccccccd
mul ecx
mov eax, ecx
shr edx, 4
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
mov edx, dword [ebp - 4]
movzx eax, byte [eax + edx]
add eax, ecx
add ebx, eax
jmp 0x401fa0
movzx esi, byte [0x404003]
xor edx, edx
add esi, 4
mov eax, ecx
div esi
mov eax, 0xcccccccd
test edx, edx
je 0x401f86
mul ecx
mov eax, ecx
shr edx, 4
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
mov edx, dword [ebp - 4]
movzx eax, byte [eax + edx]
sub eax, ecx
add ebx, eax
jmp 0x401fa0
mul ecx
mov eax, ecx
shr edx, 4
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
movzx eax, byte [eax + section..data]
add eax, ecx
sub ebx, eax
xor byte [edi], bl
inc ecx
mov eax, dword [ebp - 4]
dec edi
cmp ecx, dword [ebp - 8]
jb 0x401ee0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push eax
call 0x402422
inc eax
pop eax
pop eax
call fcn.00402040
movzx eax, al
test eax, eax
jne 0x40243a
mov eax, 1
jmp 0x4024d3
call fcn.004021b0
movzx ecx, al
test ecx, ecx
jne 0x4024bf
push 1
push 0x403060
lea ecx, [ebp - 0x5c]
call fcn.00401c90
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
push 1
push 0x403080
lea ecx, [ebp - 0x3c]
call fcn.00401c90
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
push 0x10
mov ecx, dword [ebp - 0x18]
call fcn.00401000
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00401000
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00401e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00401e30
mov eax, 2
jmp 0x4024d3
call fcn.00402280
call fcn.004020b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x402422
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push eax
call 0x402422
inc eax
pop eax
pop eax
call fcn.00402040
movzx eax, al
test eax, eax
jne 0x40243a
mov eax, 1
jmp 0x4024d3
call fcn.004021b0
movzx ecx, al
test ecx, ecx
jne 0x4024bf
push 1
push 0x403060
lea ecx, [ebp - 0x5c]
call fcn.00401c90
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
push 1
push 0x403080
lea ecx, [ebp - 0x3c]
call fcn.00401c90
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
push 0x10
mov ecx, dword [ebp - 0x18]
call fcn.00401000
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00401000
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00401e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00401e30
mov eax, 2
jmp 0x4024d3
call fcn.00402280
call fcn.004020b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x406d8b
Capabilities:
Encode data using xor

Disassembly:
add esp, dword [ecx]
pop ds
cld
adc byte [ebx], al
adc eax, 0x4ffc4562
cmp ecx, dword [ebp - 8]
adc byte [ebx], al
cmp dword [edi + 0x5b], ebx
pop esi
adc al, 1
add bh, 5
dec esp
inc esp
add byte [eax], dl
push eax
inc esp
mov dword [0x5c73310], eax
ror byte [eax + eax], 1
and bh, al
add eax, 6
add dword [edi], ecx
push eax
add al, byte [eax]
clc
add bh, bh
jne 0x406dcb
push 0
push dword [0x100044d4]
call dword [0x10003010]
arpl word [ecx], ax
or al, 0x20
add byte [ebx], bl
adc al, 0x20
add byte [edx], ch
xor eax, eax
push edx
add al, dl
Function at 0x5ced9f
Capabilities:
Encode data using xor

Disassembly:
adc ecx, esi
push ecx
insb byte es:[edi], dx
or al, 0x20
dec esi
or byte [edi + 0x29], ah
pop ss
cmc
and byte [esi - 0x2e], cl
mov bl, 0x25
dec esi
pop esi
jnp 0x5ced82
scasd eax, dword es:[edi]
xchg esp, eax
aaa
sub ecx, ebx
or dword [edi - 0x1f], esi
ja 0x5ced65
pop ebp
lea eax, [edx]
and byte [esi + 9], cl
jge 0x5cee05
push edx
pop ecx
invalid
jne 0x5ced78
out dx, al
je 0x5cedb1
push ebx
imul ebx, dword [ebp + ebp + 0x36], 0x4e20f3ba
xchg edx, eax
aaa
sbb eax, 0xa400c9d4
or edx, esi
and cl, bl
leave
add byte [edi - 0x26df0df7], ah
jle 0x5cedb9
lodsd eax, dword [esi]
xchg dl, al
stc
and byte [esi + 9], cl
in eax, 0xc5
fldenv [esi - 6]
stosd dword es:[edi], eax
pop ecx
xchg edx, eax
cmp ch, byte [ecx]
xlatb
or al, 0x7b
dec dx
imul edi, dword [ebp + 0x66], 0x4a
sal dword [ebx + 0x7b5e4e29], cl
pop esi
jnp 0x5cede2
sal ch, cl
cmc
sbb cl, 0x4e
cli
stosd dword es:[edi], eax
dec esi
xchg edx, eax
aaa
sbb eax, 0xa400c9d4
or edx, esi
and cl, bl
or dword [0x76185a66], ebp
sub al, 0x4e
or edx, esi
stosd dword es:[edi], eax
xchg ebx, eax
add eax, 0xf256617d
shl byte [eax], 1
dec esi
or dword [ebx - 0x54], edx
xchg ebx, eax
add eax, 0x956e3bb
inc edi
stosb byte es:[edi], al
jecxz 0x5cee63
or dword [edi - 0x56], eax
xor edx, dword [ebp + 0x7a4d2937]
neg byte [edi]
jg 0x5cee0b
imul eax, dword [eax + 0x4e], 9
int1
xchg esi, eax
push esi
int1
dec ebp
and ecx, dword [esi + 9]
mov ebx, 0x470952e3
inc edi
and cl, bl
dec esi
out dx, al
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
adc ebx, ebx
cmp al, 0x4e
or edx, esi
stosd dword es:[edi], eax
xchg ebx, eax
adc dword [ebx + 0x39], edi
aaa
sbb esi, edx
and byte [esi - 0x6c], cl
aaa
sbb eax, ebx
dec esi
out dx, al
lodsb al, byte [esi]
mov ss, word [ecx]
jnp 0x5ceeea
inc esi
repe cmpsd dword [esi], dword es:[edi]
and byte [esi + 9], cl
push ebx
ljmp 0xeed7
jne 0x5cee68
out dx, al
repne stosd dword es:[edi], eax
xchg ebx, eax
add eax, 0xf256617d
shl byte [eax], 1
dec esi
or dword [ebx - 0x54], edx
xchg ebx, eax
add eax, 0x956e3bb
inc edi
stosb byte es:[edi], al
jecxz 0x5cef53
or dword [edi - 0x56], eax
xor edx, dword [ebp + 0x7a4d2937]
neg byte [edi]
jg 0x5ceefb
xchg ebx, eax
aas
dec esi
or ecx, esi
xchg esi, eax
push esi
int1
pop ebp
and cl, byte [esi + 9]
invalid
jecxz 0x5cef6b
invalid
Function at 0x5cee8f
Capabilities:
Encode data using xor

Disassembly:
adc ecx, esi
push ecx
insb byte es:[edi], dx
or al, 0x20
dec esi
or byte [edi + 0x29], ah
pop ss
cmc
and byte [esi - 0x2e], cl
mov bl, 0x25
dec esi
pop esi
jnp 0x5ced82
scasd eax, dword es:[edi]
xchg esp, eax
aaa
sub ecx, ebx
or dword [edi - 0x1f], esi
ja 0x5ced65
pop ebp
lea eax, [edx]
and byte [esi + 9], cl
jge 0x5cee05
push edx
pop ecx
invalid
jne 0x5ced78
out dx, al
je 0x5cedb1
push ebx
imul ebx, dword [ebp + ebp + 0x36], 0x4e20f3ba
xchg edx, eax
aaa
sbb eax, 0xa400c9d4
or edx, esi
and cl, bl
leave
add byte [edi - 0x26df0df7], ah
jle 0x5cedb9
lodsd eax, dword [esi]
xchg dl, al
stc
and byte [esi + 9], cl
in eax, 0xc5
fldenv [esi - 6]
stosd dword es:[edi], eax
pop ecx
xchg edx, eax
cmp ch, byte [ecx]
xlatb
or al, 0x7b
dec dx
imul edi, dword [ebp + 0x66], 0x4a
sal dword [ebx + 0x7b5e4e29], cl
pop esi
jnp 0x5cede2
sal ch, cl
cmc
sbb cl, 0x4e
cli
stosd dword es:[edi], eax
dec esi
xchg edx, eax
aaa
sbb eax, 0xa400c9d4
or edx, esi
and cl, bl
or dword [0x76185a66], ebp
sub al, 0x4e
or edx, esi
stosd dword es:[edi], eax
xchg ebx, eax
add eax, 0xf256617d
shl byte [eax], 1
dec esi
or dword [ebx - 0x54], edx
xchg ebx, eax
add eax, 0x956e3bb
inc edi
stosb byte es:[edi], al
jecxz 0x5cee63
or dword [edi - 0x56], eax
xor edx, dword [ebp + 0x7a4d2937]
neg byte [edi]
jg 0x5cee0b
imul eax, dword [eax + 0x4e], 9
int1
xchg esi, eax
push esi
int1
dec ebp
and ecx, dword [esi + 9]
mov ebx, 0x470952e3
inc edi
and cl, bl
dec esi
out dx, al
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
adc ebx, ebx
cmp al, 0x4e
or edx, esi
stosd dword es:[edi], eax
xchg ebx, eax
adc dword [ebx + 0x39], edi
aaa
sbb esi, edx
and byte [esi - 0x6c], cl
aaa
sbb eax, ebx
dec esi
out dx, al
lodsb al, byte [esi]
mov ss, word [ecx]
jnp 0x5ceeea
inc esi
repe cmpsd dword [esi], dword es:[edi]
and byte [esi + 9], cl
push ebx
ljmp 0xeed7
jne 0x5cee68
out dx, al
repne stosd dword es:[edi], eax
xchg ebx, eax
add eax, 0xf256617d
shl byte [eax], 1
dec esi
or dword [ebx - 0x54], edx
xchg ebx, eax
add eax, 0x956e3bb
inc edi
stosb byte es:[edi], al
jecxz 0x5cef53
or dword [edi - 0x56], eax
xor edx, dword [ebp + 0x7a4d2937]
neg byte [edi]
jg 0x5ceefb
xchg ebx, eax
aas
dec esi
or ecx, esi
xchg esi, eax
push esi
int1
pop ebp
and cl, byte [esi + 9]
invalid
jecxz 0x5cef6b
invalid
Function at 0x401dab
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
je 0x401db9
call dword [0x10070]
test eax, eax
jne 0x401dbb
inc ebx
add byte [eax + 0x129e902], dh
add byte [eax], al
add byte [ecx], al
or byte [ebp + 0x4c3274c9], al
add byte [eax + ebx + 0x50], dh
mov eax, ecx
call dword [0x870100]
pop ecx
or eax, eax
clc
add byte [ecx + 0x2b0c301], cl
jmp 0x411deb
mov al, 2
jmp fcn.00401eeb
sbb al, 0x5c
and dword [ebx - 0xf], 0x2845758b
xchg ebp, eax
cld
dec ebp
lahf
sub al, 0x4e
xchg ecx, eax
movsb byte es:[edi], byte [esi]
or al, 0x21
movsb byte es:[edi], byte [esi]
sub al, 0
in eax, 0xf
movsb byte es:[edi], byte [esi]
adc byte [esp + ebx*8 + 0x45], dl
invalid

Function at 0x44b6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov cl, byte [0x65f042]
mov al, byte [0x65f041]
or cl, 0x10
push ebx
shr cl, 3
and ecx, 0xff

Function at 0x456f8f
Capabilities:
Encode data using xor

Disassembly:
loop 0x456fa6
ljmp 0xcde0:0xb8c39dbe
inc esi
dec edi
adc dword [ecx], ecx
call 0xb23b57de
popal
fdivr qword [0x6dcb6aab]
inc esi
mov ebp, 0xce2793a9
dec ebp
test esp, esp
jl 0x456fdb
in eax, 0x16
jne 0x457019
sub dl, byte [edx + 0x1e55f9b4]
rol byte [edi], 0x76
adc byte [ebx + eax - 0x61], ch
cmp dword [ebp - 0xd], eax
cmc
scasb al, byte es:[edi]
lodsb al, byte [esi]
cmp esp, ebx
mov bh, 0x9c
pushfd
inc edi
cmp edx, ebx
sbb ecx, ebp
sbb al, 0x72
loop 0x457057
clc
inc esi
js 0x45705b
sub al, 0xf4
insd dword es:[edi], dx
or byte [eax + 0x1d], cl
mov esp, 0xbc0a9ac1
pop es
test al, 0x54
sbb cl, byte [esi + 0x11]
les eax, [edi + 0x3482fcd7]
shr dword [eax], cl
xor al, 0xc
adc dl, bh
dec esi
inc edx
xchg esi, eax
fbld tbyte [edi + esi*2 - 0x2b9c8ea5]
adc al, byte [edi - 0x40fb6fd9]
lds esi, [edx - 0x31]
lds edx, [0x2878ec50]
shl dword [0xb7e9769b], 1
push 0x3c
mov cl, 0x16
test byte [ebp + 0x22], 0x28
sbb al, 0x97
pushal
fistp qword [eax*2 + 0x1968d70c]
push ebx
pop ecx
mov byte [edx - 0x5e63d353], 0xa9
scasb al, byte es:[edi]
jbe 0x4570bf
adc dl, al
invalid
in al, dx
sbb eax, 0xc5cc4744
test byte [esi], ah
and eax, 0xcc677ac7
inc esi
int1
xchg ebp, eax
in al, 0x33
jb 0x4570d2
int3
insd dword es:[edi], dx
and dword [ecx - 0x2539291], edx
outsd dx, dword [esi]
insd dword es:[edi], dx
lodsb al, byte [esi]
std
clc
xchg byte [ebx + esi*4], cl
call 0x9c1bc95e
in al, 9
sub al, 0x47
cmp al, 0x32
sbb dword [esi], edi
in al, dx
in al, dx
xchg edi, eax
xor ebx, dword [edx + ecx*4 - 0x59]
outsd dx, dword [esi]
inc esi
xchg esi, eax
and ch, byte [ebx + esi*4 + 0x311fad67]
cmp al, 0xd1
jg 0x45706e
out 0x80, al
rcl byte [edi + 0x20198a6f], 0x92
mov bh, bh
out 0xdd, eax
invalid
or eax, 0x92750c23
pop ebx
xor bl, ch
imul esp, dword [ebx], 0x46
mov dl, 0x49
invalid
cmp al, 0x7d
jg 0x457082
aad 0x9e
xchg edi, eax
iretd
Function at 0x60abd3
Capabilities:
Encode data using xor

Disassembly:
or esp, dword [eax + 0x58]
wait
cmp eax, dword [esi - 0x12]
dec ebp
sahf
inc ebp
pop edx
daa
stosb byte es:[edi], al
sahf
cli
je 0x60ab8c
ja 0x60ab8e
imul ebx, dword [eax + 0x4f478789], 0xffffffca
adc dword [ebp + 0x33], esp
sbb edi, esi
mov fs, ebp
scasb al, byte es:[edi]
les ebx, [edi + 0x32]
dec ebx
loope 0x60ab96
xor ebx, dword [ecx]
test dword [esi + 0x5fc4aee5], 0xfce14b32
xor cl, byte [ebx - 0x1f]
cld
imul ebx, dword [eax], 0xba5d5ab7
aaa
sbb dl, byte [esi - 0x25]
dec edi
sbb dl, byte [0xc87a4627]
imul esi, dword [edi], 0xf7e9009a
push edx
or cl, al
int1
dec ecx
jle 0x60ab41
test byte [ebx], cl
stosd dword es:[edi], eax
and bl, byte [ebx - 0x64d598c7]
push eax
sub byte [edx + 0x34], bl
in al, 0x81
sbb edx, dword [ebx + esi*2 + 0x22]
xor dword [ecx + 0x324a385d], edx
pop ebp
cmp byte [edx + 0x32], cl
push esp
adc eax, 0x72effd52
push edx
std
out dx, eax
jb 0x60abcd
push edx
std
out dx, eax
jb 0x60abcd
jne 0x60aba1
cmpsd dword [esi], dword es:[edi]

Function at 0x65794d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f3f8
cmp edx, dword [eax]
je 0x65796f
add eax, 8
inc ecx
cmp eax, 0x65f488
jl 0x657960
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f3f8]
jne 0x657a9d
mov eax, dword [0xa5bdd4]
cmp eax, 1
je 0x657a77
test eax, eax
jne 0x6579a0
cmp dword [0x65f324], 1
je 0x657a77
cmp edx, 0xfc
je 0x657a9d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6579d7
lea eax, [ebp - 0x1a4]
push 0x65c9e0
push eax
call fcn.00658330
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006587c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657a1a
lea eax, [ebp - 0x1a4]
push eax
call fcn.006587c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c9dc
push edi
call fcn.0065a690
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65c9c0
push eax
call fcn.00658330
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658340
lea eax, [ebp - 0xa0]
push 0x65c9bc
push eax
call fcn.00658340
push dword [esi + 0x65f3fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658340
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c994
push eax
call fcn.0065a604
add esp, 0x2c
pop edi
jmp 0x657a9d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f3fc]
push 0
push eax
push dword [esi]
call fcn.006587c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x44ce3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4284c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0044cc44
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0047a1d8
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0044c9a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4284ca
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0048dddc
ret

Function at 0x44d76c
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x44d78f
and ecx, ecx
jle 0x44d78f
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x428d95]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x44d77f
pop edi
pop ebx
ret

Function at 0x44dd70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x44ddcd
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.0044dcc0
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.0044dc28
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x44dd92
mov esp, ebp
pop ebp
ret
Function at 0x44de28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
call fcn.0048e070
dec eax
test eax, eax
jl 0x44de9e
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.0048e268
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.0044dc28
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x44de81
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.0044dcc0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.0044dc28
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x44dea3
mov esp, ebp
pop ebp
ret

Function at 0x48c9a0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4cfad8], 0x8088405
inc edx
mov dword [ebx + 0x4cfad8], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x49df60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x49df66
ret
Function at 0x4b4ef4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4906a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0048e458
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4906bc
call fcn.0048e0bc
mov eax, ebx
call fcn.004763f8
mov edi, eax
dec edi
test edi, edi
jl 0x4b4fac
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004763cc
mov edx, dword [0x4704bc]
call fcn.0048d214
test al, al
je 0x4b4fa8
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004763cc
lea edx, [ebp - 0x14]
call fcn.004bafc0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0048e458
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0048e130
inc esi
dec edi
jne 0x4b4f5a
mov al, byte [0x4906c0]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4906cc
mov eax, dword [ebp - 0xc]
call fcn.0047fb0c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0048de50
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004bafc0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4906bc
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.004bafc0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4906bc
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4906bc
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4906d8
call fcn.0047b984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4906ac
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0048dddc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0048dddc
lea eax, [ebp - 0x14]
call fcn.0048ddb8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0048dddc
ret