joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f260
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [eax + 0xc]
push ebp
mov ebp, dword [eax + 8]
mov eax, dword [ecx + 8]
cdq
sub eax, edx
push esi
mov esi, eax
push edi
mov edi, dword [ecx + 0xc]
mov eax, edi
cdq
sub eax, edx
sar esi, 1
sar eax, 1
cmp ebp, esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebx
jle 0x42f29b
mov ebp, esi
mov dword [esp + 0x28], ebp
cmp ebx, eax
jle 0x42f2a5
mov dword [esp + 0x2c], eax
mov ebx, eax
xor esi, esi
mov dword [esp + 0x1c], esi
test ebx, ebx
jle 0x42f3a5
mov dword [esp + 0x10], 1
jmp 0x42f2c0
mov eax, dword [ecx + 4]
mov edi, dword [ecx + 0x10]
mov edx, eax
imul edx, esi
lea ebx, [edi + edx*8]
mov edx, dword [esp + 0x10]
imul edx, eax
lea edi, [edi + edx*4]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0
test ebp, ebp
jle 0x42f391
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov eax, ecx
and eax, 0xff00ff
mov ebp, edi
and ebp, 0xff00ff
add eax, ebp
shr ecx, 8
mov ebp, esi
and ebp, 0xff00ff
add eax, ebp
and ecx, 0xff00ff
shr edi, 8
mov ebp, edx
and edi, 0xff00ff
add ecx, edi
mov edi, dword [esp + 0x14]
shr esi, 8
shr edx, 8
and esi, 0xff00ff
add ecx, esi
mov esi, dword [esp + 0x1c]
and ebp, 0xff00ff
add eax, ebp
and edx, 0xff00ff
add ecx, edx
mov edx, dword [esp + 0x34]
mov ebp, dword [edx + 4]
mov edx, dword [edx + 0x10]
imul ebp, esi
shl ecx, 6
shr eax, 2
xor eax, ecx
and eax, 0xff00ff
xor eax, ecx
mov ecx, dword [esp + 0x18]
add ebp, ecx
mov dword [edx + ebp*4], eax
mov ebp, dword [esp + 0x28]
inc ecx
add edi, 8
add ebx, 8
cmp ecx, ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
jl 0x42f2ec
mov ecx, dword [esp + 0x38]
add dword [esp + 0x10], 2
inc esi
cmp esi, dword [esp + 0x2c]
mov dword [esp + 0x1c], esi
jl 0x42f2c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x42f3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 0xc]
mov eax, dword [ebx + 8]
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
push edi
mov edi, dword [ebx + 0xc]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
jle 0x42f3e5
mov ecx, eax
mov dword [esp + 0x18], ecx
cmp esi, edi
jle 0x42f3ef
mov dword [esp + 0x1c], edi
mov esi, edi
xor edx, edx
mov dword [esp + 0xc], edx
test esi, esi
jle 0x42f472
mov eax, dword [ebx + 4]
mov esi, dword [ebx + 0x10]
imul eax, edx
xor edi, edi
lea esi, [esi + eax*4]
test ecx, ecx
jle 0x42f467
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, ecx
shr ecx, 8
mov ebx, edx
and eax, 0xff00ff
and ecx, 0xff00ff
and ebx, 0xff00ff
add eax, ebx
shr edx, 8
and edx, 0xff00ff
add ecx, edx
mov edx, dword [esp + 0xc]
shl ecx, 7
shr eax, 1
xor eax, ecx
and eax, 0xff00ff
xor eax, ecx
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx + 0x10]
imul ebx, edx
add ebx, edi
mov dword [ecx + ebx*4], eax
mov ecx, dword [esp + 0x18]
inc edi
add esi, 8
cmp edi, ecx
jl 0x42f40b
mov ebx, dword [ebp + 0xc]
inc edx
cmp edx, dword [esp + 0x1c]
mov dword [esp + 0xc], edx
jl 0x42f3f9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42f730
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
push edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
cmp byte [esi + 0x84], 0
mov esi, dword [esp + 0xc]
mov edi, eax
je 0x42f782
cmp dword [esi + 4], 0x102
je 0x42f782
cmp byte [esi + 8], 9
jne 0x42f782
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0
shr eax, 0xf
and al, 1
movsx ecx, al
push ecx
push 0x28
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
mov eax, 0xf4240
pop esi
ret 4
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call ebx
shr eax, 0xf
test al, 1
jne 0x42f7aa
push 0x12
call ebx
shr eax, 0xf
test al, 1
jne 0x42f7aa
pop ebx
pop edi
mov eax, 0xf4241
pop esi
ret 4
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebx
pop edi
pop esi
ret 4
Function at 0x42fdc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x4eec64]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x59c]
push esi
push 1
lea eax, [esp + 0x13]
push 1
push eax
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x42fe0a
mov al, byte [esp + 0xb]
cmp al, 0x38
je 0x42fe26
movsx ecx, al
push esi
push ecx
call fcn.0045fbd6
add esp, 8
mov eax, 3
pop edi
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0045c0ce
add esp, 0x114
ret
mov esi, dword [edi + 0x59c]
push esi
push 1
lea edx, [esp + 0x13]
push 1
push edx
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x42fe0a
mov al, byte [esp + 0xb]
cmp al, 0x42
je 0x42fe52
movsx eax, al
push esi
push eax
jmp 0x42fe02
mov esi, dword [edi + 0x59c]
push esi
push 1
lea ecx, [esp + 0x13]
push 1
push ecx
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x42fe0a
mov al, byte [esp + 0xb]
cmp al, 0x49
je 0x42fe7e
movsx edx, al
push esi
push edx
jmp 0x42fe02
mov esi, dword [edi + 0x59c]
push 0x4d
call fcn.00431650
add esp, 4
test al, al
je 0x42fe0a
mov eax, dword [edi + 0x59c]
push eax
push 1
lea eax, [esp + 0x18]
push 2
push eax
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x42fe0a
mov eax, dword [edi + 0x59c]
mov cx, word [esp + 0x10]
push eax
rol cx, 8
push 1
movzx edx, cx
lea eax, [esp + 0x1c]
push 1
push eax
mov dword [esp + 0x20], edx
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x42fe0a
mov al, byte [esp + 0x14]
mov ecx, dword [edi + 0x59c]
push ecx
or al, 1
movzx ecx, al
push ecx
lea edx, [esp + 0x1d]
push 1
push edx
mov byte [esp + 0x24], al
call fcn.0045e149
movzx ecx, byte [esp + 0x24]
add esp, 0x10
cmp eax, ecx
jne 0x42fe0a
mov eax, dword [edi + 0x59c]
push eax
push 1
lea eax, [esp + 0x14]
push 4
push eax
mov byte [esp + ecx + 0x25], 0
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x42fe0a
lea ecx, [esp + 0xc]
call fcn.00431600
test eax, eax
jne 0x42fe0f
mov eax, dword [esp + 0xc]
mov edi, dword [edi + 0x59c]
inc eax
and eax, 0xfffffffe
push 1
push eax
push edi
mov dword [esp + 0x18], eax
call fcn.0045dd31
mov ecx, dword [esp + 0x124]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.0045c0ce
add esp, 0x114
ret
Function at 0x430700
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x59c]
push ebp
push edi
push eax
call fcn.0045fa77
mov dword [esi + 0x164], eax
xor eax, eax
add esp, 4
mov dword [esp + 0xc], 0
cmp ax, word [esi + 0x10]
jae 0x430810
mov eax, dword [ebx + 0x59c]
push eax
push 1
push 2
lea edi, [esi + 0x154]
push edi
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x430819
mov cx, word [edi]
rol cx, 8
movzx eax, cx
mov word [edi], cx
cmp ax, 1
jne 0x4307c8
mov edx, dword [esi + 0xc]
xor ebp, ebp
xor edi, edi
sub edx, dword [esi + 4]
je 0x4307b4
mov eax, dword [ebx + 0x59c]
push eax
push 1
lea eax, [esp + 0x1c]
push 2
push eax
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x430819
mov cx, word [esp + 0x14]
rol cx, 8
movzx eax, cx
movzx edx, ax
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
inc edi
add ebp, edx
cmp edi, eax
jb 0x430773
mov ecx, dword [ebx + 0x59c]
push 1
push ebp
push ecx
call fcn.0045dd31
add esp, 0xc
jmp 0x4307fb
test ax, ax
jne 0x4307fb
mov edi, dword [esi + 0xc]
mov edx, dword [esi + 8]
sub edi, dword [esi + 4]
sub edx, dword [esi]
mov eax, dword [ebx + 0x59c]
push eax
imul edi, edx
call fcn.0045fa77
add eax, edi
push 0
push eax
mov eax, dword [ebx + 0x59c]
push eax
call fcn.0045dd31
add esp, 0x10
mov eax, dword [esp + 0xc]
movzx ecx, word [esi + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x430731
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
pop edi
pop ebp
mov eax, 3
pop ebx
pop ecx
ret 4

Function at 0x430870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4eec64]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 0x10]
push ebx
push esi
push edi
mov esi, ecx
call fcn.00472bc0
mov edi, esp
test edi, edi
jne 0x43089d
lea eax, [esp + 4]
jmp 0x43095d
cmp dword [ebp + 0x14], 0
mov dword [ebp - 8], 0
jbe 0x43095b
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x59c]
movzx ecx, word [ebx]
push eax
push ecx
push 1
push edi
call fcn.0045e149
movzx ecx, word [ebx]
add esp, 0x10
cmp eax, ecx
jne 0x430973
xor eax, eax
test ecx, ecx
jle 0x430945
mov edi, edi
mov dl, byte [eax + edi]
xor ecx, ecx
test dl, dl
jge 0x43090e
neg dl
movzx edx, dl
inc edx
test edx, edx
jle 0x43093b
movzx edx, byte [eax + edi + 1]
mov byte [esi], dl
movzx edx, byte [eax + edi]
neg dl
movzx edx, dl
inc ecx
inc edx
add esi, 4
cmp ecx, edx
jl 0x4308f3
jmp 0x43093b
movsx edx, dl
inc edx
test edx, edx
jle 0x430935
lea edx, [eax + edi + 1]
lea ebx, [ebx]
mov bl, byte [edx + ecx]
mov byte [esi], bl
movsx ebx, byte [eax + edi]
inc ecx
inc ebx
add esi, 4
cmp ecx, ebx
jl 0x430920
mov ebx, dword [ebp - 0xc]
movsx ecx, byte [eax + edi]
add eax, ecx
movzx edx, word [ebx]
add eax, 2
cmp eax, edx
jl 0x4308e0
mov eax, dword [ebp - 8]
inc eax
add ebx, 2
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
cmp eax, dword [ebp + 0x14]
jb 0x4308b4
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045c0ce
mov esp, ebp
pop ebp
ret 0x10
mov eax, 3
jmp 0x43095d
Function at 0x430980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4eec64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov eax, esi
mov edi, ecx
call fcn.00472bc0
cmp dword [ebp + 0xc], 0
mov ebx, esp
mov dword [ebp - 8], 0
jbe 0x4309e9
lea ebx, [ebx]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x59c]
push eax
push esi
push 1
push ebx
call fcn.0045e149
add esp, 0x10
cmp eax, esi
jne 0x430a00
xor eax, eax
test esi, esi
jbe 0x4309dd
mov cl, byte [eax + ebx]
mov byte [edi], cl
inc eax
add edi, 4
cmp eax, esi
jb 0x4309d0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0xc]
jb 0x4309b0
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045c0ce
mov esp, ebp
pop ebp
ret 8
mov eax, 3
jmp 0x4309eb
Function at 0x431630
Capabilities:
Read file on windows

Disassembly:
push eax
push 1
push 1
push ecx
call fcn.0045e149
dec eax
add esp, 0x10
neg eax
sbb eax, eax
and eax, 3
ret

Function at 0x431650
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push 1
lea eax, [esp + 0xb]
push 1
push eax
call fcn.0045e149
add esp, 0x10
cmp eax, 1
jne 0x43167f
mov al, byte [esp + 3]
cmp byte [esp + 8], al
je 0x431683
movsx ecx, al
push esi
push ecx
call fcn.0045fbd6
add esp, 8
xor al, al
pop ecx
ret
mov al, 1
pop ecx
ret
Function at 0x437c20
Capabilities:
Encode data using xor

Disassembly:
push ecx
test edx, edx
je 0x437c92
push esi
jmp 0x437c30
mov eax, dword [0x4f8ed8]
mov ecx, dword [eax*4 + 0x4f92c8]
mov dword [0x4f8ed8], ecx
mov ecx, dword [0x4f8edc]
mov esi, dword [ecx*4 + 0x4f92c8]
mov dword [0x4f8edc], esi
mov ecx, dword [ecx*4 + 0x4f8ee0]
xor dword [eax*4 + 0x4f8ee0], ecx
lea eax, [eax*4 + 0x4f8ee0]
mov eax, dword [eax]
and eax, 0x70307
dec edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
movd mm0, dword [eax]
movd mm1, dword [esp + 4]
paddusb mm0, mm1
movd dword [eax], mm0
add dword [esp + 0xc], 4
test edx, edx
jne 0x437c30
pop esi
emms
pop ecx
ret
Function at 0x43ceb0
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x477c68
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4eec64]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x1c], esi
test edi, edi
je 0x43cefd
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cee5
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x24]
call fcn.004017a0
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0
call fcn.00401190
mov dword [esp + 0x14], 0xffffffff
test esi, esi
je 0x43cf44
mov eax, dword [esi]
and eax, 0xff
cmp eax, 0x80
jae 0x43cf37
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
test eax, eax
jne 0x43cf44
push esi
call fcn.00402770
add esp, 4
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cf50
add ebx, 4
push ebx
push SysReAllocString
sub eax, edx
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x43d0c0
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, eax
cmp dword [esi], 0
push edi
je 0x43d0df
mov eax, dword [esi + 4]
test eax, eax
je 0x43d0df
push eax
call fcn.00402770
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ebx + 4]
test eax, eax
jne 0x43d0ff
mov eax, 2
pop edi
pop esi
pop ebx
pop ecx
ret 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
setne al
dec eax
and eax, 2
jne 0x43d13d
test edi, edi
jne 0x43d123
pop edi
pop esi
pop ebx
pop ecx
ret 4
push 0
push edi
mov ecx, esi
call fcn.0041a060
test eax, eax
jne 0x43d13d
mov esi, dword [esi + 4]
push edi
push esi
mov eax, ebx
call fcn.0043d150
pop edi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x43d150
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [eax + 4]
test eax, eax
je 0x43d178
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43d178
xor eax, eax
ret 8
or eax, 0xffffffff
ret 8
Function at 0x43e030
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x477908
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
xor ebx, ebx
push ebx
push 0x4001
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ebx
call fcn.004012c0
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x43e0a2
mov ecx, dword [eax]
mov esi, ecx
movzx ecx, cl
shr esi, 8
cmp ecx, 1
jbe 0x43e099
lea ecx, [esp + 0x18]
call fcn.004013f0
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x43e0a4
add eax, 4
jmp 0x43e0a6
xor esi, esi
xor eax, eax
mov edx, dword [edi + 0x58]
push esi
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [edi + 0x8c]
cmp eax, ebx
je 0x43e12d
mov ecx, dword [eax + 0x170]
cmp ecx, ebx
je 0x43e0d5
or dword [eax + 8], 7
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [esp + 0x18]
push edx
call eax
mov ecx, dword [edi + 0x8c]
mov eax, dword [ecx + 0x154]
cmp byte [ecx + 0x12a], bl
jne 0x43e0f2
cmp eax, ebx
je 0x43e12d
call fcn.004130b0
cmp eax, ebx
je 0x43e12d
mov eax, ecx
call fcn.004130b0
fldz
mov ebx, dword [eax]
or ecx, 0xffffffff
push ecx
fstp dword [esp]
push 1
push 1
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
or esi, ecx
or edi, ecx
mov dword [edx + 4], esi
or ebp, ecx
mov dword [edx + 8], edi
mov dword [edx + 0xc], ebp
mov edx, dword [ebx + 0x4c]
mov ecx, eax
call edx
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x18]
mov esi, eax
test ecx, ecx
je 0x43e173
mov eax, dword [ecx]
and eax, 0xff
cmp eax, 0x80
jae 0x43e166
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [esp + 0x18]
and eax, 0xff
test eax, eax
jne 0x43e173
push ecx
call fcn.00402770
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x43e940
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x43e969
call fcn.00441e40
cmp byte [esi + 0x40], 0
je 0x43e962
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x43e9e4
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x43e9d4
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x43e98f
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x190]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x43e9d0
cmp eax, 2
je 0x43e9d4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43e980
cmp eax, 3
je 0x43e9b7
cmp eax, 1
jne 0x43e980
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x43e980
mov edx, dword [esi + 0x11c]
add dword [eax + 8], edx
jmp 0x43e980
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.0043ea10
pop esi
ret
cmp eax, 0xcc
je 0x43ea06
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.0043ea10
pop esi
ret

Function at 0x4448b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [esp + 0x18], esi
jne 0x4448d7
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x4448e3
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0xc], ecx
jle 0x4449d9
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x18], edx
jmp 0x44492c
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebp, dword [edx]
cdq
idiv ebp
cmp dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
je 0x44494d
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov edi, dword [edx + ecx*4]
dec ebp
mov ecx, ebp
xor eax, eax
xor ebx, ebx
call fcn.00444720
mov ecx, eax
xor esi, esi
cmp esi, ecx
jle 0x444977
inc ebx
mov ecx, ebp
mov eax, ebx
call fcn.00444720
mov ecx, eax
cmp esi, ecx
jg 0x444967
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + edi], al
inc esi
cmp esi, 0xff
jle 0x444963
cmp dword [esp + 0x10], 0
je 0x4449bc
mov eax, 1
lea ecx, [edi - 1]
jmp 0x4449a0
movzx edx, byte [edi]
mov byte [ecx], dl
movzx edx, byte [edi + 0xff]
mov byte [edi + eax + 0xff], dl
inc eax
dec ecx
cmp eax, 0xff
jle 0x4449a0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add dword [esp + 0x18], 4
inc eax
cmp eax, dword [ecx + 0x64]
mov dword [esp + 0x14], eax
jl 0x444920
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x44a2c0
Capabilities:
Contain obfuscated stackstrings
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x474f08
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4eec64]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov eax, dword [0x4eec64]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
cmp dword [0x4f1bd8], 0
mov esi, dword [esp + 0x64]
jne 0x44a31e
push 0xf0000000
push 1
push 0
push 0
push 0x4f1bd8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x44a31e
or eax, 0xffffffff
jmp 0x44a429
mov ecx, dword [0x4f1bd8]
lea eax, [esp + 0x40]
push eax
push 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov byte [esp + 0xc], 0x30
mov byte [esp + 0xd], 0x31
mov byte [esp + 0xe], 0x32
mov byte [esp + 0xf], 0x33
mov byte [esp + 0x10], 0x34
mov byte [esp + 0x11], 0x35
mov byte [esp + 0x12], 0x36
mov byte [esp + 0x13], 0x37
mov byte [esp + 0x14], 0x38
mov byte [esp + 0x15], 0x39
mov byte [esp + 0x16], 0x41
mov byte [esp + 0x17], 0x42
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x44
mov byte [esp + 0x1a], 0x45
mov byte [esp + 0x1b], 0x46
xor eax, eax
movzx ecx, byte [esp + eax + 0x40]
mov edx, ecx
shr edx, 4
mov dl, byte [esp + edx + 0xc]
and ecx, 0xf
mov cl, byte [esp + ecx + 0xc]
mov byte [esp + eax*2 + 0x1c], dl
mov byte [esp + eax*2 + 0x1d], cl
inc eax
cmp eax, 0x10
jb 0x44a384
lea eax, [esp + 0x1c]
mov byte [esp + 0x3c], 0
mov dword [esp + 8], 0
lea edx, [eax + 1]
jmp 0x44a3c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44a3c0
sub eax, edx
push eax
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.004017a0
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x60], 0
call fcn.00401190
mov ecx, dword [esp + 8]
mov dword [esp + 0x5c], 0xffffffff
test ecx, ecx
je 0x44a427
mov eax, dword [ecx]
and eax, 0xff
cmp eax, 0x80
jae 0x44a41a
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [esp + 8]
and eax, 0xff
test eax, eax
jne 0x44a427
push ecx
call fcn.00402770
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0045c0ce
add esp, 0x58
ret