joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475028
Capabilities:
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
mov byte [ebp - 0x70], 0x16
call fcn.00474b4d
xchg edi, eax
stosd dword es:[edi], eax
xor byte [ebx], bh
lea eax, [ebp - 0x84]
push eax
call fcn.00474b5d
push eax
push esi
push dword [ebp + 8]
call fcn.00474b12
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
dec dword [ebx + 0xff33bf0]
test bh, dl
add al, byte [eax]
invalid
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00474abe
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x4750bd
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00474abe
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
cmp eax, dword [edi + 6]
invalid

Function at 0x475064
Capabilities:
Inspect section memory permissions

Disassembly:
mov byte [ebp - 0x70], 0x16
call fcn.00474b4d
xchg edi, eax
stosd dword es:[edi], eax
xor byte [ebx], bh
lea eax, [ebp - 0x84]
push eax
call fcn.00474b5d
push eax
push esi
push dword [ebp + 8]
call fcn.00474b12
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
dec dword [ebx + 0xff33bf0]
test bh, dl
add al, byte [eax]
invalid
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00474abe
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x4750bd
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00474abe
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
cmp eax, dword [edi + 6]
invalid

Function at 0x475130
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 0x10], edi
jmp 0x47513a
call fcn.00474b4d
out dx, al
xchg ebp, eax
or dword [ebx + ecx*4 + 0x8b1045], esi
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x475183
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x47515e
and eax, 0xffff
push eax
jmp 0x475162
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00474b12
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x47533c
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x475143
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x4750e4
Function at 0x475240
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
cmp eax, dword [edi + 6]
jne 0x475224
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x475242
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
js 0x475266
js 0x475266
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4752a0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
or byte gs:[eax], al
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x475287
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x475290
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x47529a
add ecx, eax
or byte [ecx], 4
invalid
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x47527c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x475206
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4752ed
dec eax
je 0x4752e4
sub eax, 3
je 0x4752db
mov dword [ebp - 4], 0x40
jmp 0x47530a
mov dword [ebp - 4], 4
jmp 0x4752f0
mov dword [ebp - 4], 0x20
jmp 0x4752f0
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x47533c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4752bc
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00474b4d
mov ah, 0x4a
stosd dword es:[edi], eax
mov dword [0x6a1475ff], eax
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x475348
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4753bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + 0x56fffffc], edi
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00474b5d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00474b12
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
invalid
test dword [esp + edi*8 - 1], edi

Function at 0x475f3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00474abe
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x475f5a
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
invalid
mov ebp, 0xfffff900
Function at 0x47c043
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x504b36
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47c09b
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x504b57
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47c091
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47c09f
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x401170
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x64
fldz
xor eax, eax
mov dword [esp + 4], eax
xor ecx, ecx
mov word [esp], cx
fstp qword [esp + 8]
fld qword [esp + 8]
mov ecx, 1
fsubr qword [0x41f370]
push esi
fsub qword [0x41f368]
fmul dword [0x423f1c]
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
fstp dword [0x423f1c]
mov dword [esp + 0x30], eax
add word [0x423ea8], cx
mov dx, word [esp + 4]
mov si, word [0x423ea8]
movsx edx, dx
movsx esi, si
sub edx, 0x6a74f39f
cmp edx, esi
jne 0x4011f0
fld dword [0x423f18]
fsub qword [0x41f360]
fstp dword [0x423f18]
mov dx, word [esp + 4]
mov esi, dword [esp + 8]
movsx edx, dx
sub edx, 0x5311dbf8
imul edx, esi
mov dword [esp + 0x50], ecx
mov dword [esp + 8], edx
xor edx, edx
mov word [esp + 0x54], cx
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x70]
mov word [esp + 0x5a], dx
lea edx, [esp + 0x28]
push edx
push eax
push eax
push 8
push eax
push eax
push eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x90]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
add esp, 0x64
ret
Function at 0x401c80
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x140
mov eax, dword [0x426110]
xor eax, esp
mov dword [esp + 0x13c], eax
xor eax, eax
mov word [esp + 0xc], ax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
xor ecx, ecx
mov word [esp + 4], cx
movzx edx, word [esp + 4]
push ebp
push esi
add edx, 0x1c50ea21
mov word [esp + 0xc], dx
push 0x104
mov dword [esp + 0xc], eax
call fcn.0040af5c
add esp, 4
push 0
mov esi, eax
push 2
mov dword [esp + 0x14], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
fld dword [0x4240d8]
mov ebp, eax
fmul qword [0x424090]
fstp qword [0x424090]
fld dword [0x4240d8]
fadd qword [0x41f348]
fstp dword [0x4240d8]
test ebp, ebp
je 0x401e90
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401e89
push edi
mov edi, esi
lea ecx, [esp + 0x44]
sub edi, ecx
mov edi, edi
mov dword [esp + 0x14], 0xc003abd0
lea eax, [esp + 0x44]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x401d40
push esi
call fcn.0041e123
mov ecx, dword [esp + 0x154]
add esp, 4
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d80
test dl, dl
je 0x401d7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d80
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d60
xor eax, eax
jmp 0x401d85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401e5d
cmp dword [esp + 0x154], eax
je 0x401e84
mov edx, dword [esp + 0x28]
push edx
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401e59
fld dword [0x424924]
inc dword [esp + 0xc]
fcomp dword [0x41f430]
fnstsw ax
test ah, 0x44
jp 0x401de0
mov ax, word [esp + 0x18]
mov edx, dword [esp + 0x1c]
movsx ecx, ax
lea eax, [ecx + edx + 0x663d2ad6]
mov dword [esp + 0x1c], eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov cx, word [0x423e4c]
movsx edx, cx
cmp edx, 0x3d1af0cf
jl 0x401e52
inc word [0x425a40]
fld qword [0x424838]
mov ax, word [0x425a40]
fsubr qword [0x41f428]
movsx ecx, ax
add ecx, 0x56f98330
fsub qword [0x41f420]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x401e52
mov edx, dword [esp + 0x1c]
add edx, 0x525e8ea0
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul dword [0x425568]
fstp dword [0x425568]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ebp
mov dword [esp + 0x28], 0x128
call sub.KERNEL32.dll_Process32Next
mov ecx, 0xffff87d9
mov word [esp + 0x18], cx
test eax, eax
jne 0x401d30
jmp 0x401e88
inc dword [esp + 0xc]
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040ae7f
mov ecx, dword [esp + 0x148]
mov eax, dword [esp + 0xc]
add esp, 4
pop esi
pop ebp
xor ecx, esp
call fcn.0040b4ca
add esp, 0x140
ret
Function at 0x402370
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
fldz
push ebx
push esi
fst dword [esp + 8]
push edi
fstp dword [esp + 0x14]
mov edi, dword [esp + 0x20]
xor eax, eax
mov word [esp + 0x10], ax
push edi
call fcn.0040af5c
mov ebx, dword [esp + 0x20]
push edi
mov esi, eax
push ebx
push esi
call fcn.0040b0e0
fld dword [esp + 0x1c]
fld dword [esp + 0x1c]
mov eax, 0xb55b70da
fsub dword [esp + 0x24]
add esp, 0x10
add edi, esi
fadd qword [0x41f478]
fsubp st(1)
fstp dword [esp + 0xc]
fld dword [esp + 0x14]
fld1
fsub st(1), st(0)
fxch st(1)
fstp dword [esp + 0x14]
fsubr dword [esp + 0xc]
fstp dword [esp + 0xc]
mov cx, word [esp + 0x10]
movsx edx, cx
sub eax, edx
mov dword [esp + 0x20], eax
mov ecx, esi
fild dword [esp + 0x20]
fmul qword [0x4255e8]
fstp qword [0x4255e8]
inc dword [esp + 0x10]
fld dword [esp + 0xc]
mov edx, dword [0x427924]
fsub qword [0x41f470]
add edx, ebx
fstp dword [esp + 0xc]
movzx eax, word [str.vctG4_]
movzx ebx, word [0x42574c]
movsx ebx, bx
cwde
sub ebx, eax
movzx eax, word [0x425734]
sub ebx, 0x22d89ef3
mov dword [esp + 0x20], ebx
movzx ebx, word [esp + 0x10]
fild dword [esp + 0x20]
cwde
movsx ebx, bx
add ebx, eax
mov dword [esp + 0x20], ebx
fild dword [esp + 0x20]
fsub dword [esp + 0xc]
inc dword [esp + 0x10]
inc word [0x42574c]
fcompp
fnstsw ax
test ah, 0x41
jne 0x402481
fld dword [0x4230cc]
mov ax, word [esp + 0x10]
cwde
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fsubp st(1)
fstp dword [0x4230cc]
sub edx, 0x423004
cmp esi, edi
je 0x40249a
jmp 0x402490
mov al, byte [edx]
xor byte [ecx], al
inc ecx
inc edx
cmp ecx, edi
jne 0x402490
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x403b70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
fldz
push ebx
push esi
fst qword [esp + 0x10]
push edi
fstp qword [esp + 0x14]
xor eax, eax
push 3
push 0x424080
mov word [esp + 0x14], ax
call fcn.00402370
mov ebx, dword [esp + 0x28]
mov esi, eax
push esi
push ebx
call fcn.0040bc1e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x403bc4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
call fcn.0040bc1e
mov edi, eax
add esp, 8
test edi, edi
je 0x403bdc
push edi
push 1
lea ecx, [esp + 0x2c]
push 4
push ecx
call fcn.0040be46
push edi
call fcn.0040b7c4
add esp, 0x14
fldz
xor eax, eax
mov word [esi], ax
fstp qword [esp + 0xc]
mov dword [esp + 0xc], 0
push esi
mov byte [esi + 2], al
call fcn.0040ae7f
fld dword [0x423120]
fsub qword [0x41f570]
add esp, 4
fld qword [esp + 0x14]
pop edi
pop esi
fsubp st(1)
pop ebx
fsubr qword [esp + 8]
fstp qword [esp + 8]
fld qword [esp + 8]
fadd qword [0x41f348]
fstp qword [esp + 8]
add esp, 0x10
ret

Function at 0x403f30
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
fldz
push ebp
fst qword [esp + 8]
push 0x2e
fst qword [esp + 0xc]
push 0x425594
fstp qword [esp + 0x10]
call fcn.00402370
add esp, 8
mov ebp, eax
lea eax, [esp + 4]
push eax
push ebp
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403fc2
push esi
push edi
push 0x34
push 0x423fa8
call fcn.00402370
mov edx, dword [esp + 0x24]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403f84
mov ecx, dword [esp + 0xc]
sub eax, edi
push eax
push edx
push 1
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
fldz
push 0x34
fstp qword [esp + 0x14]
push 0
push esi
mov dword [esp + 0x1c], 0
call fcn.0040b450
push esi
call fcn.0040ae7f
add esp, 0x10
pop edi
pop esi
fldz
push 0x2e
push 0
fstp qword [esp + 0x10]
push ebp
mov dword [esp + 0x14], 0
call fcn.0040b450
push ebp
call fcn.0040ae7f
mov edx, dword [esp + 0x14]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
add esp, 0xc
ret
Function at 0x40b4ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426110]
jne 0x40b4d4
repz ret
jmp fcn.0040f6f6

Function at 0x416514
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040f876
and dword [ebp - 4], 0
cmp dword [0x428394], 0
mov ebx, eax
jne 0x4165c5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416676
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420a70
push edi
call esi
test eax, eax
je 0x416676
push eax
call fcn.0040f804
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428394], eax
call esi
push eax
call fcn.0040f804
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428398], eax
call esi
push eax
call fcn.0040f804
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42839c], eax
call esi
push eax
call fcn.0040f804
pop ecx
mov dword [0x4283a4], eax
test eax, eax
je 0x4165c5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f804
pop ecx
mov dword [0x4283a0], eax
mov eax, dword [0x4283a0]
cmp eax, ebx
je 0x41661d
cmp dword [0x4283a4], ebx
je 0x41661d
push eax
call fcn.0040f87f
push dword [0x4283a4]
mov esi, eax
call fcn.0040f87f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41661d
test edi, edi
je 0x41661d
call esi
test eax, eax
je 0x416614
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416614
test byte [ebp - 0xc], 1
jne 0x41661d
or dword [ebp + 0x10], 0x200000
jmp 0x416656
mov eax, dword [0x428398]
cmp eax, ebx
je 0x416656
push eax
call fcn.0040f87f
pop ecx
test eax, eax
je 0x416656
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416656
mov eax, dword [0x42839c]
cmp eax, ebx
je 0x416656
push eax
call fcn.0040f87f
pop ecx
test eax, eax
je 0x416656
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428394]
call fcn.0040f87f
pop ecx
test eax, eax
je 0x416676
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416678
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421cb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040fd10
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.0040fd10
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 0x1c]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], edx
call fcn.0040fd10
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0x48]
mov dword [esi + 0x48], edx
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov ecx, dword [edi + 0x50]
mov dword [esi + 0x50], ecx
mov edx, dword [edi + 0x54]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x54], edx
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x402290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [esi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
xor edi, edi
mov byte [ebx + esi], 0
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], ebx
je 0x402316
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push str.Browns_Lake_derives_its_name_from_Henry_Brown__a_pioneer_settler.
call esi
push str.Tiffany_Alexandra_Brymer__born_January_21__1981__is_an_American_former_tennis_player.
call esi
push str.Andrea_Robin_Wood__born_March_2__1973__is_an_American_attorney_serving_as_a_United_States_district_judge_of_the_United_States_District_Court_for_the_Northern_District_of_Illinois.
call esi
push str.Richard_Marston__1847_1917__was_an_English_scenic_designer_who_had_a_prominent_career_as_a_designer_for_Broadway_productions_from_the_1860s_into_the_early_20th_century.
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
call esi
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
push str.Cristina_Garmendia_y_Mendiz_bal__born_1962_in_San_Sebasti_n__is_a_Spanish_biologist_and_businesswoman.
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push str.Kosse_is_a_town_in_southern_Limestone_County__Texas__United_States._The_population_was_464_at_the_2010_census
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x4022c5
push str.The_2017_Argentina_Open_was_a_mens_tennis_tournament_played_on_outdoor_clay_courts.
call esi
push str.Vigia_is_a_municipality_in_the_northeastern_part_of_the_state_of_Par___Brazil._The_town_was_founded_on_16_January_1616.
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404b20
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fa00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x594
push ebx
push esi
push edi
sub esp, 0xc
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 4], 1
call fcn.0040fd10
lea ecx, [ebp - 0xa0]
push ecx
call fcn.00404350
add esp, 0x10
push 0x5f5e0ff
mov esi, eax
mov ecx, 0xf
lea edi, [ebp - 0x64]
push 0
rep movsd dword es:[edi], dword [esi]
call dword [0x640164]
push eax
call dword [0x6400fc]
xor edi, edi
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0x14]
mov ebx, eax
mov dword [ebp - 0x14], 1
call fcn.0040ff70
push eax
call dword [0x640060]
mov edx, dword [0x62f338]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x60]
push edx
push eax
xor esi, esi
call dword [0x64013c]
test eax, eax
jne 0x404bc3
lea esi, [edi + 1]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404d28
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x54]
push 0
push 0
push 3
push 0
push 0
push ecx
push edx
push eax
call dword [0x640160]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x404d1e
mov edx, dword [ebp - 0x38]
mov eax, esi
neg eax
sbb eax, eax
push 0
and eax, 0x800000
add eax, 0x400100
push eax
mov eax, dword [0x62f188]
push 0
push 0
push eax
push edx
push 0x426714
push ecx
call dword [0x640194]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x404d14
test esi, esi
je 0x404c49
or dword [ebp - 0x18], 0x10300
push 4
lea ecx, [ebp - 0x18]
push ecx
push 0x1f
push eax
call dword [0x63ff68]
mov eax, dword [ebp - 0x10]
push 0
push 0
push 0
push 0
push eax
call dword [0x640128]
mov ecx, dword [ebp - 0x10]
push 0
lea edx, [ebp - 0x28]
push edx
mov esi, eax
lea eax, [ebp - 0x1a0]
push eax
push 0x13
push ecx
mov dword [ebp - 0x28], 0x100
call dword [0x6401ac]
test eax, eax
jne 0x404cb1
lea ecx, [ebp + 8]
xor esi, esi
mov byte [ebp - 4], 0
call fcn.0040fd50
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0040fd50
mov eax, dword [ebp - 0x24]
mov edx, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1a0]
push edx
call fcn.00411210
add esp, 4
cmp eax, 0xc8
jne 0x404c7e
test esi, esi
je 0x404d11
cmp dword [ebp - 0x14], edi
jbe 0x404d11
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x400
lea ecx, [ebp - 0x5a0]
push ecx
push edx
call dword [0x640088]
xor esi, esi
cmp dword [ebp - 0x14], esi
jbe 0x404d11
push 1
lea eax, [ebp + esi - 0x5a0]
push eax
lea ecx, [edi + ebx]
push ecx
call fcn.00411290
mov eax, dword [ebp - 0x14]
inc esi
inc edi
cmp esi, eax
jb 0x404cf1
test eax, eax
jne 0x404cd0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x64005c]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [0x64005c]
mov eax, dword [ebp - 0x1c]
push eax
call dword [0x64005c]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.0040fd50
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0040fd50
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406480
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x40
push 0
push esi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x40649a
mov eax, 1
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x406548
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x406548
push edi
push ebx
push 0xf8
push eax
lea edi, [esi + 0x40]
push edi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x4064d1
mov eax, 1
pop edi
pop ebp
ret
cmp dword [edi], 0x4550
jne 0x406540
mov ecx, 0x10b
cmp word [esi + 0x58], cx
jne 0x406540
movzx eax, word [esi + 0x46]
test ax, ax
je 0x406540
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
mov dword [esi + 0x140], eax
call fcn.004112d0
add esp, 4
mov dword [esi + 0x138], eax
test eax, eax
jne 0x406517
mov eax, 3
pop edi
pop ebp
ret
movzx edx, word [esi + 0x54]
mov ecx, dword [esi + 0x3c]
lea ecx, [edx + ecx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call dword [ebp + 8]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
pop ebp
ret
mov eax, 2
pop edi
pop ebp
ret
mov eax, 2
pop ebp
ret

Function at 0x406c40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x406c7c
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x406c7c
mov edx, 0x10b
cmp word [eax + ecx + 0x18], dx
jne 0x406c7c
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + ecx + 0x78]
push edx
push ecx
push eax
call fcn.00406b80
add esp, 0xc
pop ebp
ret
xor eax, eax
pop ebp
ret