joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c660
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5bd8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x66ee94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
test esi, esi
je 0x40c7d6
mov ecx, esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c6d0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.004033e0
push 0x5102ac
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00402540
push edi
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
call fcn.00402540
add esp, 0x18
lea ecx, [ebp - 0x28]
push eax
call fcn.0040a490
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x40c748
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c73e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c85d
push edx
push ecx
call fcn.004ba5b1
add esp, 8
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x40c78e
mov ecx, dword [ebp - 0x70]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c784
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c862
push edx
push ecx
call fcn.004ba5b1
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp edx, 0x10
jb 0x40c7f3
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c7ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c867
push edx
push ecx
call fcn.004ba5b1
add esp, 8
jmp 0x40c7f3
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c7e0
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.004033e0
push dword [ebp + 0x14]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push 0x5102b0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40c841
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c837
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c86c
push edx
push ecx
call fcn.004ba5b1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ba87e
mov esp, ebp
pop ebp
ret
call fcn.004c0839
call fcn.004c0839
call fcn.004c0839
call fcn.004c0839
int3
Function at 0x411890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4118e9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4118e9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4118d8
cmp esi, edx
jae 0x4118e9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4118c6
cmp esi, edx
jae 0x4118e9
cmp word [esi], 0
je 0x4118e9
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x411dc0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 8], ecx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
xor esi, esi
mov edx, ecx
test ebx, ebx
jle 0x411ec4
mov cl, byte [esi + edx]
movzx ebx, cl
cmp cl, 0x3d
jne 0x411dfe
inc eax
cmp eax, 2
jle 0x411e03
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
mov esp, ebp
pop ebp
ret
cmp cl, 0x7f
ja 0x411df2
mov cl, byte [ebx + 0x50e9e0]
cmp cl, 0x7f
je 0x411df2
cmp cl, 0x40
jae 0x411e17
test eax, eax
jne 0x411df2
inc esi
inc edi
cmp esi, dword [ebp - 4]
jl 0x411de1
test edi, edi
je 0x411ec4
mov ecx, dword [ebp + 0xc]
lea eax, [edi + edi*2]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x411e48
pop edi
pop esi
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp - 4], ecx
mov edi, 3
test esi, esi
jle 0x411ebc
nop dword [eax + eax]
movzx ecx, byte [edx]
mov dl, byte [ecx + 0x50e9e0]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub edi, ecx
movzx ecx, dl
and ecx, 0x3f
or ebx, ecx
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 4
jne 0x411eb0
xor ecx, ecx
mov dword [ebp - 4], ecx
test edi, edi
jle 0x411e9b
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jle 0x411ea8
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jle 0x411eb0
mov byte [eax], bl
inc eax
mov edx, dword [ebp - 8]
dec esi
inc edx
mov dword [ebp - 8], edx
test esi, esi
jg 0x411e60
mov ecx, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x516c68
push 0x4bd750
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x66ee94]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x4c], edx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0x54004e
mov dword [ebp - 0x2c], 0x4c0044
mov dword [ebp - 0x28], 0x2e004c
mov dword [ebp - 0x24], 0x4c0044
mov dword [ebp - 0x20], 0x4c
movaps xmm0, xmmword [0x510530]
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x6d654d6c
mov dword [ebp - 0x34], 0x79726f
mov eax, dword [0x673330]
test eax, eax
jne 0x41281b
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x673330], eax
mov dword [ebp - 4], 0
push 4
push esi
lea ecx, [ebp + 8]
push ecx
push 0
lea ecx, [ebp - 0x4c]
push ecx
push 0xffffffffffffffff
call eax
mov ecx, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x412854
mov eax, dword [ebp - 0x4c]
xor edx, edx
test ecx, ecx
cmovne eax, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004ba87e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413760
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x40
push esi
push edi
mov esi, 0x50ea80
mov byte [ebp - 1], 0
mov edi, ebx
mov dword [ebx + 0x200], 1
mov dword [ebx + 0x204], 1
mov word [ebx + 0x208], 0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x10]
xor esi, esi
nop
xor edx, edx
mov cl, byte [esi + ebx]
mov eax, esi
div edi
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
mov dl, byte [ebp - 1]
add al, cl
add dl, al
mov byte [ebp - 1], dl
movzx edx, dl
movzx eax, byte [edx + ebx]
mov byte [esi + ebx], al
inc esi
mov byte [edx + ebx], cl
cmp esi, 0x100
jb 0x4137a0
lea edi, [ebx + 0x100]
mov esi, ebx
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4137f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x204]
lea esi, [edi + 0x100]
mov bh, byte [edi + 0x209]
add ecx, eax
mov dword [ebp - 4], esi
sub edx, eax
mov esi, dword [ebp + 0x10]
sub esi, eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x10], esi
cmp eax, ecx
jae 0x41386a
sub edx, esi
mov edi, edx
nop dword [eax]
mov edx, dword [ebp - 4]
movzx esi, al
add esi, edx
mov bl, byte [esi]
add bh, bl
movzx ecx, bh
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx ecx, byte [esi]
mov edx, dword [ebp + 0x10]
add cl, bl
mov esi, dword [ebp - 4]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + esi]
xor cl, byte [edi + edx]
mov byte [edx], cl
cmp eax, dword [ebp + 0x14]
jb 0x413830
mov edi, dword [ebp + 8]
mov byte [edi + 0x209], bh
mov dword [edi + 0x204], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e60a0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x66ee94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], edi
push eax
push 0xf003f
mov dword [ebp - 0x30], reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov ecx, dword [ebp - 0x30]
test eax, eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
push eax
push 0xf003f
push edi
mov edx, reloc.WS2_32.dll_accept
cmovne ecx, edx
push esi
push ecx
mov dword [ebp - 0x30], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4146ae
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x41467e
cmp dword [ebp - 0x34], 3
jne 0x41467e
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
call fcn.0040c000
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push ebx
push edi
call esi
push dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x28]
push eax
call fcn.004146f0
mov edx, dword [ebp - 0x14]
mov bl, al
cmp edx, 0x10
jb 0x4146b0
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414672
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4146db
push edx
push ecx
call fcn.004ba5b1
add esp, 8
jmp 0x4146b0
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4146ae
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4146a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4146e0
push edx
push ecx
call fcn.004ba5b1
add esp, 8
xor bl, bl
test edi, edi
je 0x4146bb
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ba87e
mov esp, ebp
pop ebp
ret 0xc
call fcn.004c0839
call fcn.004c0839
int3
Function at 0x4149b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000c
call fcn.004ba890
mov eax, dword [0x66ee94]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ebx
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x4149df
mov eax, dword [ebx]
push 0x40
push 0x5104e4
push ecx
mov byte [eax], 0
call fcn.004c26fb
add esp, 0xc
mov dword [ebp - 0x10008], eax
test eax, eax
jne 0x414a0f
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ba87e
mov esp, ebp
pop ebp
ret 8
push edi
push eax
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.004cab57
mov edi, eax
add esp, 0x10
test edi, edi
je 0x414aa7
push esi
nop
mov esi, dword [ebx + 0x14]
mov ecx, esi
mov edx, dword [ebx + 0x10]
sub ecx, edx
cmp edi, ecx
ja 0x414a67
lea eax, [edx + edi]
mov dword [ebx + 0x10], eax
mov eax, ebx
cmp esi, 0x10
jb 0x414a4d
mov eax, dword [ebx]
lea esi, [eax + edx]
push edi
lea eax, [ebp - 0x10004]
push eax
push esi
call fcn.004bcbd0
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x414a84
push edi
lea eax, [ebp - 0x10004]
mov byte [ebp - 0x1000c], 0
push eax
push dword [ebp - 0x1000c]
mov ecx, ebx
push edi
call fcn.004031d0
push dword [ebp - 0x10008]
lea eax, [ebp - 0x10004]
push 0x10000
push 1
push eax
call fcn.004cab57
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x414a30
pop esi
push dword [ebp - 0x10008]
call fcn.004c9a0c
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop ebx
call fcn.004ba87e
mov esp, ebp
pop ebp
ret 8
Function at 0x416e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
mov eax, dword [0x66ee94]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 8]
push edi
mov edx, dword [eax]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi]
mov dword [esi], 0
mov dword [eax], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [edi], 0
cmp ecx, 5
jae 0x416eef
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.004ba87e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], 5
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
jb 0x41703c
mov edx, dword [ebp + 0x10]
movzx ecx, byte [edx + 4]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, 0x1000
cmp ecx, eax
cmovb ecx, eax
mov al, byte [edx]
mov dword [esp + 0x2c], ecx
cmp al, 0xe1
jae 0x41703c
xor edx, edx
movzx eax, al
mov ecx, 9
div ecx
mov ecx, 5
mov dword [esp + 0x20], edx
xor edx, edx
movzx eax, al
div ecx
push ecx
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], eax
call fcn.00416e20
add esp, 4
test eax, eax
jne 0x417041
mov ecx, dword [esp + 0x10]
mov edx, ecx
movups xmm0, xmmword [esp + 0x20]
mov eax, dword [esp + 0xc]
push edi
push ecx
push esi
push dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x48]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x94], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x98], 1
mov dword [esi], eax
call fcn.00416b60
mov ecx, dword [esp + 0x6c]
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov dword [eax], ecx
test esi, esi
jne 0x417014
cmp dword [edi], 3
mov eax, 6
cmove esi, eax
push dword [esp + 0x48]
push 0x66f7d4
call dword [0x66f7d8]
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.004ba87e
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [esp + 0xac]
pop edi
pop esi
xor ecx, esp
call fcn.004ba87e
mov esp, ebp
pop ebp
ret
Function at 0x417fb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x66ee94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403550
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.0040a270
mov edx, dword [ebp - 8]
add esp, 8
cmp edx, 0x10
jb 0x418011
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x418007
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418061
push edx
push ecx
call fcn.004ba5b1
add esp, 8
cmp dword [0x51f014], 0
je 0x418047
cmp dword [0x51f018], 0x10
mov eax, 0x51f004
cmovae eax, dword [0x51f004]
push eax
call fcn.00413d40
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ba87e
mov esp, ebp
pop ebp
ret 0x10
push esi
call fcn.004178e0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.004ba87e
mov esp, ebp
pop ebp
ret 0x10
call fcn.004c0839
int3

Function at 0x4182f0
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
push edi
push 2
mov edi, ecx
call fcn.00420e00
call fcn.00420d30
push 1
mov esi, eax
push 0x29
push esi
call fcn.00420d90
push str.User_Agent:Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_42.0.2311.90_Safari_537.36
push 0
call fcn.00421160
push str.Accept:_
push eax
call fcn.00421160
mov ebx, eax
push ebx
push 0x2727
push esi
call fcn.00420d90
add esp, 0x2c
mov ecx, edi
cmp dword [edi + 0x14], 0x10
jb 0x41833f
mov ecx, dword [edi]
push ecx
push 0x2712
push esi
call fcn.00420d90
push 0x4182a0
push 0x4e2b
push esi
call fcn.00420d90
push edi
push 0x2711
push esi
call fcn.00420d90
push 1
push 0x34
push esi
call fcn.00420d90
push 0
push 0x2b
push esi
call fcn.00420d90
push edi
push 0x2749
push esi
call fcn.00420d90
add esp, 0x48
push 0x418260
push 0x4e58
push esi
call fcn.00420d90
mov eax, dword [edi + 0x1c]
add esp, 0xc
test eax, eax
je 0x4183bb
push eax
push 0x13
push esi
call fcn.00420d90
push dword [edi + 0x20]
push 0x14
push esi
call fcn.00420d90
add esp, 0x18
push esi
call fcn.00420d70
add esp, 4
test eax, eax
jne 0x4183de
lea eax, [edi + 0x28]
push eax
push 0x200002
push esi
call fcn.00420d10
add esp, 0xc
test eax, eax
je 0x418413
push eax
call fcn.004212e0
add esp, 4
lea ecx, [edi + 0x2c]
push eax
call fcn.00403520
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x4183fd
mov eax, dword [ecx]
push edi
call dword [eax + 4]
push esi
call fcn.00420cf0
push ebx
call fcn.004211a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
push esi
call fcn.00420cf0
push ebx
call fcn.004211a0
mov ecx, dword [edi + 0x24]
add esp, 8
test ecx, ecx
je 0x41842e
mov eax, dword [ecx]
push edi
call dword [eax]
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x418450
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov eax, ecx
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x41a330
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x41a38e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x41a350
mov eax, dword [edi]
jmp 0x41a479
cmp eax, 0x4e0
jb 0x41a479
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x41a3b0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x41a400
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ad30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 8], ecx
push edi
nop dword [eax]
mov edi, dword [ecx]
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x41ad96
lea eax, [edi + 8]
mov esi, 0x270
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x41ad56
mov eax, dword [edi]
jmp 0x41ae78
cmp eax, 0x4e0
jb 0x41ae78
mov eax, dword [edi + 0x9c4]
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x41adb2
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x41ae00
mov edi, dword [ebp - 4]
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
mov ecx, dword [ebp - 8]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [ecx + 8]
ja 0x41ad40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret