joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c3136
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push dword [ebp + 0x10]
push 0x50
call fcn.010c2068
test eax, eax
mov dword [ebp - 4], eax
jne 0x10c3151
leave
ret
push ebx
push esi
push edi
cld
mov edi, dword [ebp - 4]
mov eax, 0
mov ecx, 0x50
or ecx, ecx
je 0x10c3168
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
push 0x14
xor esi, esi
pop ebx
mov eax, esi
shr eax, 2
mov edx, eax
mov eax, dword [ebp - 4]
shl edx, 2
add eax, edx
mov ecx, esi
sub ecx, edx
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
shl ecx, 3
shl edx, cl
or dword [eax], edx
inc esi
cmp esi, ebx
jb 0x10c3170
and dword [ebp - 0x24], 0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], 0x123174bb
mov dword [ebp - 0x48], 0x86521ff8
mov dword [ebp - 0x44], 0x98d2438b
mov dword [ebp - 0x40], 0x7966ce12
mov dword [ebp - 0x3c], 0xc5d92014
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov esi, 0x10eef54
mov ecx, dword [ebp - 8]
mov eax, edi
cld
or ecx, ecx
je 0x10c31e3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
xor edx, edx
push 5
mov eax, ecx
pop esi
div esi
mov eax, dword [ebp + edx*4 - 0x4c]
xor dword [ebp + ecx*4 - 0x24], eax
inc ecx
cmp ecx, esi
jb 0x10c31e5
lea eax, [ebp - 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
cld
or ecx, ecx
je 0x10c321c
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push dword [ebp + 0xc]
push 0
push 0x10ef9e4
push dword [0x10eef68]
push eax
push ebx
push dword [ebp - 4]
call fcn.010caeeb
lea eax, [ebp - 0x38]
mov byte [eax], 0
inc eax
dec ebx
jne 0x10c323f
mov eax, dword [ebp - 4]
push 0x50
pop ecx
pop edi
pop esi
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x10c324f
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.010c2088
xor eax, eax
inc eax
leave
ret
Function at 0x10c5d00
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x10c5e3b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x10c5e10
test eax, eax
jne 0x10c5e10
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x10c5d50
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x10c5e3b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x10c5e10
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc
Function at 0x10c6e25
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x10c6e72
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov esi, dword [edi + edx]
mov ecx, dword [edx]
lea ebx, [ecx + esi]
add eax, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + edx], eax
mov ebx, ecx
xor ebx, esi
and ebx, eax
or ecx, esi
xor ebx, ecx
shr ebx, 0x1f
add edx, 4
dec dword [ebp + 0x14]
mov eax, ebx
jne 0x10c6e49
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x10c706a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x10c70b7
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
sub ecx, esi
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], edx
mov edi, dword [ebx + esi]
mov edx, dword [esi]
mov ecx, edi
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + esi], ecx
xor ecx, edi
xor edx, edi
or ecx, edx
xor ecx, edi
shr ecx, 0x1f
add esi, 4
dec dword [ebp + 0x14]
mov eax, ecx
jne 0x10c708e
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x10cc2b0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.010cc22f
test eax, eax
je 0x10cc2f1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push 0x1026bbc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8

Function at 0x10cdad6
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
call fcn.010a0c79
push 2
call sub.msvcrt.dll___set_app_type
or dword [0x10f2af4], 0xffffffff
or dword [0x10f2af8], 0xffffffff
mov dword [esp], 0x10016f0
push 0x10016ec
call sub.msvcrt.dll__initterm
push 0x10016e8
push 0x1001604
call sub.msvcrt.dll__initterm
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [ebp - 0x44]
xor esi, esi
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
je 0x10cdb40
movzx eax, word [ebp - 0x14]
jmp 0x10cdb43
push 0xa
pop eax
push eax
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.01028c5d
mov esi, eax
call sub.msvcrt.dll__cexit
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x10d0355
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x10d0396
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x10d036f
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x10d03b4
dec esi
je 0x10d03ab
dec esi
jne 0x10d03b9
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10d18a9
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
and dword [ebx + 0x28], 0
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], 0
mov word [ebx + 0xc], ax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x24], ecx
mov esi, 0x8000
jne 0x10d18f9
push esi
push eax
add eax, esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
and dword [ebx + 0x30], eax
mov word [ebx + 0x2c], ax
call fcn.010d12e0
and dword [ebx + 0x20], 0
mov eax, esi
push 2
mov word [ebx + 0x3c], ax
mov eax, dword [ebx + 0x14]
pop ecx
mov dword [ebx + 0x34], esi
add eax, esi
push edi
movzx edi, byte [eax]
mov edx, dword [ebx + 0x20]
shl edx, 5
xor edx, edi
and edx, 0x7fff
inc eax
dec ecx
mov dword [ebx + 0x20], edx
jne 0x10d191d
cmp byte [ebp + 0x24], cl
je 0x10d1943
mov edi, ebx
call fcn.010d1121
jmp 0x10d1955
xor eax, eax
mov ecx, esi
mov edx, dword [ebx + 0x18]
xor edi, edi
mov word [eax + edx], di
inc eax
inc eax
dec ecx
jne 0x10d1947
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.010d04e1
push 0x4b
pop edx
call fcn.010d04e1
call fcn.010d1626
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
pop edi
je 0x10d1994
mov eax, dword [ebx + 0x14]
push esi
lea ecx, [eax + 0x8000]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebx + 0x28]
neg eax
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x10d3f07
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc9c
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0xc8c], eax
mov eax, dword [esi + 0x870]
add eax, 0x20
mov ecx, eax
shl ecx, 3
mov dword [ebp - 0xc9c], ecx
cmp ecx, 0x320
jb 0x10d3f54
xor eax, eax
jmp 0x10d4136
push ebx
push edi
mov edi, eax
shl edi, 4
push edi
lea eax, [ebp - 0xc84]
push 0
push eax
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x644]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0x18]
add esp, 0x18
test ecx, ecx
jbe 0x10d40b3
mov eax, dword [ebp + 0x14]
mov ebx, dword [esi + 0x34]
mov edi, dword [esi + 0x30]
shl eax, 2
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp + 0x10]
shl eax, 2
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xc98], ecx
jmp 0x10d3fb3
mov eax, dword [ebp - 0xc94]
mov ecx, dword [ebp - 0xc88]
and ecx, 7
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 0xc88]
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x10d3fdd
mov eax, dword [ebp - 0xc88]
movzx eax, byte [edi + eax]
jmp 0x10d4021
mov ecx, dword [ebp - 0xc88]
cmp byte [edi + ecx], 7
mov ecx, dword [esi + 0x2c]
push dword [ecx + eax]
push esi
jae 0x10d400b
call fcn.010d2191
mov ecx, dword [ebp - 0xc88]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x10d401a
call fcn.010d2191
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc94], 4
inc dword [ebp - 0xc88]
lea eax, [ebp + eax*2 - 0xc84]
inc word [eax]
mov eax, dword [ebp - 0xc8c]
xor edx, edx
mov ecx, eax
and ecx, 7
inc edx
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x10d4053
movzx eax, byte [edi + eax]
jmp 0x10d4097
cmp byte [edi + eax], 7
mov ecx, dword [ebp - 0xc90]
mov eax, dword [esi + 0x2c]
push dword [eax + ecx]
push esi
jae 0x10d4081
call fcn.010d2191
mov ecx, dword [ebp - 0xc8c]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x10d4090
call fcn.010d2191
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc90], 4
inc dword [ebp - 0xc8c]
lea eax, [ebp + eax*2 - 0x644]
inc word [eax]
dec dword [ebp - 0xc98]
jne 0x10d3fad
xor esi, esi
xor ebx, ebx
cmp dword [ebp - 0xc9c], esi
jbe 0x10d4132
mov edi, 0x100
movzx eax, word [ebp + esi*2 - 0xc84]
mov ecx, edi
cmp ax, cx
movzx eax, ax
jae 0x10d40df
movzx eax, byte [eax + 0x1026eb0]
jmp 0x10d40ec
shr eax, 8
movzx eax, byte [eax + 0x1026eb0]
add eax, 8
movzx ecx, word [ebp + esi*2 - 0x644]
mov edx, edi
cmp cx, dx
movzx ecx, cx
jae 0x10d4107
movzx ecx, byte [ecx + 0x1026eb0]
jmp 0x10d4114
shr ecx, 8
movzx ecx, byte [ecx + 0x1026eb0]
add ecx, 8
mov eax, dword [eax*4 + 0x1026e68]
sub eax, dword [ecx*4 + 0x1026e68]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
inc esi
cmp esi, dword [ebp - 0xc9c]
jb 0x10d40c4
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010a0b37
leave
ret 0x14
Function at 0x44c66f
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x44c723
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0044c5ff
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x44c6fc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c72f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x44c74a
test ebp, ebp
je 0x44c74a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44c752
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x44c792
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x44c7ee
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44c7e9
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44c7d4
test dl, dl
je 0x44c7d0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44c7d4
add ecx, 2
add eax, 2
test dl, dl
jne 0x44c7b4
xor eax, eax
jmp 0x44c7d9
sbb eax, eax
or eax, 1
test eax, eax
je 0x44c7f8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x44c7a1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x44c80f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0044c66f
test eax, eax
jne 0x44c827
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0044c72f
mov esi, eax
test esi, esi
jne 0x44c85d
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x44c877
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x44c96f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0044c66f
mov esi, eax
test esi, esi
jne 0x44c98d
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0044c72f
mov dword [esp + 0x18], eax
test eax, eax
je 0x44c985
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0044c72f
mov dword [esp + 0x34], eax
test eax, eax
je 0x44c985
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0044c72f
mov dword [esp + 0x28], eax
test eax, eax
je 0x44c985
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0044c72f
mov dword [esp + 0x30], eax
test eax, eax
je 0x44c985
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x44cb54
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x44cb54
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x44cab7
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x44cb38
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x44cada
movzx esi, ax
jmp 0x44cadf
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x44cafe
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x44cb0d
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x44cb61
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x44cacf
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x44ca94
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x44cb8a
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x44cb8a
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x44cb6f
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x44cb9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0044c66f
mov esi, eax
test esi, esi
je 0x44cc5b
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0044c72f
mov ebp, eax
test ebp, ebp
je 0x44cc5a
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0044c72f
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x44cc5a
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x44cc5a
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x44cc59
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x44cc3f
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x4a2c39
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x4a2cec
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x4a4558
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret
Function at 0x4a49d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4a49fc
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4a49fc
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4a4a06
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4a4a48
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4a4aaa
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4a4aa5
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4a4a90
test dl, dl
je 0x4a4a8c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4a4a90
add ecx, 2
add eax, 2
test dl, dl
jne 0x4a4a70
xor eax, eax
jmp 0x4a4a95
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a4ab6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4a4a5d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x4a4ad9
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x4a4afb
mov eax, 0xfffffffd
jmp 0x4a4bcd
cmp dword [0xe5364c], 0
je 0x4a4ba6
cmp dword [0xe53650], 5
jl 0x4a4b29
cmp dword [0xe53650], 7
jg 0x4a4b29
mov eax, 1
jmp 0x4a4b2e
mov eax, 0
test eax, eax
jne 0x4a4b47
cmp dword [0xe53650], 0xfffffffb
je 0x4a4b47
xor eax, eax
jmp 0x4a4b4c
mov eax, 1
test eax, eax
je 0x4a4b78
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x4a4b61
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0xe5364c], 0
jne 0x4a4bc3
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x4a4bcd
mov esp, ebp
pop ebp
ret 4