joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2068
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x820f08
jb 0x8c1aab7d
or al, byte [ebx + 0x128b04c2]

Function at 0x4b3fc0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b4142
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004b43b4
mov eax, ebx
call fcn.0042d88c
dec al
je 0x4b4004
dec al
je 0x4b400a
jmp 0x4b4010
mov byte [ebp - 0x77], 2
jmp 0x4b4014
mov byte [ebp - 0x77], 1
jmp 0x4b4014
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.0042d818
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x4b4061
cmp edi, 0x20000000
jne 0x4b406d
or dword [ebp - 0x88], reloc.kernel32.dll_DeleteCriticalSection
jmp 0x4b4077
mov eax, edi
call fcn.0042d08c
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.0042d854
test al, 1
je 0x4b4089
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.0042d854
test al, 2
je 0x4b409b
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.0042d854
test al, 4
je 0x4b40ad
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.0042d854
test al, 8
je 0x4b40bf
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.0042d7a4
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040c3b8
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.0042d8bc
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.0042d5a8
push eax
call fcn.0040804c
test eax, eax
je 0x4b411c
or dword [ebp - 0x8c], reloc.kernel32.dll_DeleteCriticalSection
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004b43e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4149
lea eax, [ebp - 0x94]
call fcn.00405140
ret
Function at 0x4b5f70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - reloc.kernel32.dll_DeleteCriticalSection]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4b5f94
cmp eax, 0
jbe 0x4b609d
jmp 0x4b5f9a
jle 0x4b609d
mov eax, dword [ebp + 8]
add eax, 0xffffff04
xor ecx, ecx
mov edx, 0xf8
call fcn.0040398c
mov eax, dword [ebp + 8]
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov eax, dword [ebp + 8]
mov eax, dword [eax - reloc.kernel32.dll_DeleteCriticalSection]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x40
jne 0x4b609d
mov eax, dword [ebp + 8]
cmp word [eax - 0x13c], 0x5a4d
jne 0x4b609d
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x100]
mov eax, dword [ebp + 8]
mov eax, dword [eax - reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x100]
jne 0x4b609d
mov eax, dword [ebp + 8]
lea edx, [eax - 0xfc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - reloc.kernel32.dll_DeleteCriticalSection]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x4b609d
mov eax, dword [ebp + 8]
cmp dword [eax - 0xfc], 0x4550
jne 0x4b609d
mov eax, dword [ebp + 8]
lea edx, [eax - 0xf8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - reloc.kernel32.dll_DeleteCriticalSection]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x14
jne 0x4b609d
mov eax, dword [ebp + 8]
cmp word [eax - 0xf8], 0x14c
jne 0x4b609d
mov eax, dword [ebp + 8]
movzx ecx, word [eax - 0xe8]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - reloc.kernel32.dll_DeleteCriticalSection]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp + 8]
movzx edx, word [edx - 0xe8]
cmp eax, edx
jne 0x4b609d
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x4b6728
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov eax, dword [ebp + 8]
mov ax, word [eax - 0xf6]
test ax, ax
jbe 0x4b6808
mov edx, dword [ebp + 8]
movzx eax, ax
dec eax
test eax, eax
jl 0x4b6806
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 0xc]
xor edx, edx
test eax, 0x20000000
je 0x4b679e
test eax, 0x40000000
je 0x4b678a
test eax, 0x80000000
je 0x4b6785
or edx, 0x40
jmp 0x4b67c5
or edx, 0x20
jmp 0x4b67c5
test eax, 0x80000000
je 0x4b6799
or edx, 0x80
jmp 0x4b67c5
or edx, 0x10
jmp 0x4b67c5
test eax, 0x40000000
je 0x4b67b6
test eax, 0x80000000
je 0x4b67b1
or edx, 4
jmp 0x4b67c5
or edx, 2
jmp 0x4b67c5
test eax, 0x80000000
je 0x4b67c2
or edx, 8
jmp 0x4b67c5
or edx, 1
test eax, 0x4000000
je 0x4b67d2
or edx, 0x200
mov eax, dword [ebp + 8]
add eax, 0xfffffebc
push eax
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8]
push eax
call fcn.00407ebc
inc ebx
dec dword [ebp - 4]
jne 0x4b6758
mov dl, 1
mov eax, edx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b709c
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x82384c
mov ecx, 0x48
call fcn.00403150
lea edx, [ebp + 0x48]
mov eax, 0x823894
mov ecx, 0x1000
call fcn.00403150
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
xor ecx, ecx
mov cl, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x4b70f7
xor edi, edi
dec eax
jne 0x4b70e4
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x4b70dd
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004b7178
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x4b7115
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004b7178
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x4b7140
add ebx, 0x400
dec edi
jne 0x4b713e
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b7178
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.00403150
cmp byte [esp], 0
je 0x4b722b
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x4b71aa
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x4b72b0
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x4b7236
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4b7a94
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.00403150
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.00403150
add esp, 0x58
pop ebx
ret
Function at 0x4b80f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edi, esp
mov ebp, 0x8248d4
mov eax, dword [ebp]
mov dword [ebx + 4], eax
push edi
call fcn.00407cfc
mov ecx, dword [ebp]
and ecx, 0xf
mov esi, dword [ebx + 4]
shl esi, cl
mov ax, word [edi + 8]
or ax, word [edi + 0xc]
movzx eax, ax
shl eax, 0x10
mov dx, word [edi + 0xa]
or dx, word [edi + 0xe]
movzx edx, dx
or eax, edx
xor esi, eax
mov dword [ebx + 4], esi
mov dword [ebp], esi
inc dword [ebp]
cmp dword [ebx + 4], 0
je 0x4b8100
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4bb1e8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.0040398c
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4bb36b
mov edi, 1
xor esi, esi
jmp 0x4bb2ab
mov al, byte [esp + edi + 0xb]
xor edx, edx
mov dl, al
shr edx, 2
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x826918]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
xor eax, eax
mov al, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x826918]
mov byte [esp + esi + 0x3a], al
mov dl, byte [esp + edi + 0xc]
shl edx, 2
xor eax, eax
mov al, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x826918]
mov byte [esp + esi + 0x3b], al
mov dl, byte [esp + edi + 0xd]
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x826918]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x4bb22e
cmp edi, dword [esp + 8]
jg 0x4bb351
mov al, byte [esp + edi + 0xb]
xor edx, edx
mov dl, al
shr edx, 2
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x826918]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x4bb308
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x826918]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x4bb349
mov edx, eax
shl edx, 4
and dl, 0x30
xor eax, eax
mov al, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x826918]
mov byte [esp + esi + 0x3a], al
mov dl, byte [esp + edi + 0xc]
shl edx, 2
and dl, 0x3c
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x826918]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
lea edx, [esp + 0x39]
mov ecx, esi
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x4bb205
add esp, 0x78
pop edi
pop esi
pop ebx
ret
Function at 0x4bba74
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - reloc.kernel32.dll_DeleteCriticalSection], ebx
mov dword [ebp - reloc.kernel32.dll_DeleteCriticalSection], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4bbbaa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], reloc.kernel32.dll_DeleteCriticalSection
jle 0x4bbad3
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov eax, dword [0x839308]
call fcn.00407698
mov ecx, dword [ebp - reloc.kernel32.dll_DeleteCriticalSection]
mov dl, 1
mov eax, dword [0x40a578]
call fcn.0040fbdc
call fcn.00404a94
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov al, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x4bbb2a
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x4bbaff
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x4bbb25
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x4bbb12
inc esi
add ecx, esi
jmp 0x4bbb34
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], reloc.kernel32.dll_DeleteCriticalSection
jle 0x4bbb6a
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov eax, dword [0x839308]
call fcn.00407698
mov ecx, dword [ebp - reloc.kernel32.dll_DeleteCriticalSection]
mov dl, 1
mov eax, dword [0x40a578]
call fcn.0040fbdc
call fcn.00404a94
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00403150
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, reloc.kernel32.dll_DeleteCriticalSection
call fcn.00403150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbbb1
lea eax, reloc.kernel32.dll_DeleteCriticalSection
mov edx, 2
call fcn.00405164
ret

Function at 0x4bdd3c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], reloc.kernel32.dll_DeleteCriticalSection
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00408830
ret
Function at 0x4c8248
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4c8262
add esp, 0xfffffff0
call fcn.00404568
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405600
xor eax, eax
push ebp
push 0x4c83d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 4]
mov edx, dword [ebp - 4]
call fcn.00405194
mov dl, 1
mov eax, dword [0x41ed6c]
call fcn.004041c0
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x41ed6c]
call fcn.004041c0
mov dword [esi + 0xc], eax
mov dl, 1
mov eax, dword [0x41ed6c]
call fcn.004041c0
mov dword [esi + 0x10], eax
mov dl, 1
mov eax, dword [0x41e708]
call fcn.004041c0
mov dword [esi + 0x14], eax
mov dl, 1
mov eax, dword [0x41ed6c]
call fcn.004041c0
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x28], eax
mov byte [esi + 0x2c], 0
xor eax, eax
mov dword [esi + 0x18], eax
mov byte [esi + 0x1c], 0
mov byte [esi + 0x24], 0
xor eax, eax
mov dword [esi + 0x54], eax
xor eax, eax
mov dword [esi + 0x58], eax
xor eax, eax
mov dword [esi + 0x5c], eax
xor eax, eax
mov dword [esi + 0x60], eax
xor eax, eax
mov dword [esi + 0x64], eax
mov byte [esi + 0x44], 0
lea eax, [esi + 0x68]
call fcn.00405140
mov al, byte [0x4c83fc]
mov byte [esi + 0x38], al
mov dword [esi + 0x3c], 1
lea eax, [esi + 0x40]
mov edx, 0x4c8408
call fcn.00405194
mov eax, dword [0x83a4b8]
mov eax, dword [eax + reloc.kernel32.dll_DeleteCriticalSection]
mov dword [esi + 0x34], eax
mov dl, 1
mov eax, dword [0x41e708]
call fcn.004041c0
mov dword [esi + 0x30], eax
mov dl, 1
mov eax, dword [0x41ed6c]
call fcn.004041c0
mov dword [esi + 0x48], eax
mov dl, 1
mov eax, dword [0x41ed6c]
call fcn.004041c0
mov dword [esi + 0x4c], eax
mov eax, dword [0x83a4b8]
push dword [eax + 0xbc]
push dword [ebp - 4]
push 0x4c843c
lea eax, [ebp - 8]
mov edx, 3
call fcn.004054d0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x47f530]
call fcn.0047f5e0
mov dword [esi + 0x50], eax
mov eax, dword [ebp - 8]
call fcn.0040be8c
test al, al
jne 0x4c83bb
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi + 0x50]
mov ecx, 0x4c844c
mov edx, 0x4c8460
mov edi, dword [eax]
call dword [edi + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c83dd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405164
ret
Function at 0x5547c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + reloc.kernel32.dll_DeleteCriticalSection]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x5547f3
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x5f4124
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5f4152
mov eax, ebx
call fcn.005f4bd8
cmp dword [ebx + 0x40], 0
je 0x5f414b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5f41c3
mov edx, dword [ebx + reloc.kernel32.dll_DeleteCriticalSection]
cmp dword [edx + 0x10], 0
je 0x5f41b5
cmp dword [ebx + 8], 0
je 0x5f4174
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + reloc.kernel32.dll_DeleteCriticalSection]
call dword [edx]
test eax, eax
jne 0x5f4186
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5f41b5
cmp dword [ebx + 8], 0
je 0x5f4167
cmp eax, 3
je 0x5f4199
dec eax
jne 0x5f4167
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5f4167
mov edx, dword [ebx + reloc.kernel32.dll_DeleteCriticalSection]
add dword [eax + 8], edx
jmp 0x5f4167
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5f41e1
cmp dword [ebx + 0x14], 0xcc
je 0x5f41e1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005f41ec
pop ebx
ret

Function at 0x627e7c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x829f4c
test eax, eax
je 0x627e8b
test edx, edx
jg 0x627e90
xor eax, eax
pop esi
pop ebx
ret
mov ecx, 0xb58e8e00
xor ecx, reloc.kernel32.dll_DeleteCriticalSection
cmp edx, 8
jl 0x627f65
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
sub edx, 8
cmp edx, 8
jge 0x627ea1
test edx, edx
je 0x627f85
xor ebx, ebx
mov bl, byte [eax]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [esi + ebx*4]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
dec edx
test edx, edx
jne 0x627f69
mov eax, ecx
xor eax, reloc.kernel32.dll_DeleteCriticalSection
pop esi
pop ebx
ret
Function at 0x6a3234
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00405600
mov eax, dword [ebp + 8]
call fcn.00405600
xor eax, eax
push ebp
push 0x6a336b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xc]
mov eax, 0x6a322c
call fcn.00407698
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0xb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0xb
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x78], 0xb
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 0xb
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebx + 0x48]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebx + 0x50]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x8c]
mov ecx, 0xf
pop eax
call fcn.0040ca34
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0077bfe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a3372
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405164
lea eax, [ebp + 8]
call fcn.00405140
ret