joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472ee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0046f4d0
lea ecx, [esp + 0x54]
push ecx
call fcn.0046f4d0
mov ebx, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
mov edi, ebx
lea edx, [esp + 0x1c]
add esp, 8
sub edi, esi
sub ebx, edx
lea eax, [esi + 0x14]
xor ecx, ecx
mov dword [esp + 0x10], 5
lea edx, [esp + ecx + 0x14]
mov ebp, dword [ebx + edx]
xor ebp, dword [eax - 0x14]
add eax, 4
mov dword [edx], ebp
mov edx, dword [edi + eax - 4]
mov ebp, dword [eax - 4]
xor edx, ebp
mov dword [esp + ecx + 0x50], edx
mov edx, dword [esp + 0x10]
add ecx, 4
dec edx
mov dword [esp + 0x10], edx
jne 0x472f23
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0046fcc0
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x74]
push ecx
call fcn.0046f930
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.0046f4f0
lea ecx, [esp + 0x44]
push ecx
call fcn.0046f450
mov ecx, dword [esp + 0xa8]
add esp, 0x20
cmp word [ecx], 0
mov eax, esi
je 0x472fe5
mov ebp, dword [esp + 0x84]
lea edx, [esp + 0x28]
lea ebx, [esp + 0x3c]
add ecx, 2
sub edx, esi
sub ebx, esi
sub ebp, esi
mov dword [esp + 0x88], 5
mov edi, edi
mov esi, dword [ebx + eax]
xor esi, dword [edx + eax]
add eax, 4
xor esi, dword [eax + edi - 4]
add ecx, 4
xor esi, dword [eax - 4]
xor esi, dword [ecx - 4]
mov dword [eax + ebp - 4], esi
dec dword [esp + 0x88]
jne 0x472fc0
jmp 0x473017
mov ebx, dword [esp + 0x84]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x3c]
sub ecx, esi
sub edx, esi
sub ebx, esi
mov esi, 5
nop
mov ebp, dword [eax + edi]
xor ebp, dword [eax + edx]
add eax, 4
xor ebp, dword [eax + ecx - 4]
xor ebp, dword [eax - 4]
dec esi
mov dword [eax + ebx - 4], ebp
jne 0x473000
mov edi, dword [esp + 0x84]
mov esi, dword [esp + 0x7c]
lea ecx, [esp + 0x14]
sub esi, edi
mov eax, edi
sub ecx, edi
mov edx, 5
mov ebx, dword [esi + eax]
xor ebx, dword [eax]
mov dword [ecx + eax], ebx
add eax, 4
dec edx
jne 0x473031
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0046f930
add esp, 0xc
lea ecx, [esp + 0x28]
lea eax, [edi + 0x14]
mov edx, 5
mov edi, dword [esi + eax]
mov ebp, dword [eax - 0x14]
mov ebx, dword [ecx]
xor edi, ebp
xor edi, ebx
mov dword [eax], edi
add ecx, 4
add eax, 4
dec edx
jne 0x473062
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret

Function at 0x473090
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x34]
lea eax, [esp + 4]
push eax
push esi
call fcn.0046f4f0
lea ecx, [esp + 0x20]
push ecx
call fcn.0046f4d0
lea ecx, [esp + 0x24]
add esp, 0xc
mov eax, esi
sub ecx, esi
mov edx, 5
lea ecx, [ecx]
mov esi, dword [eax + 0x14]
xor esi, dword [eax]
mov dword [ecx + eax], esi
add eax, 4
dec edx
jne 0x4730c0
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call fcn.00472ee0
add esp, 0x10
pop esi
add esp, 0x28
ret
Function at 0x473140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
lea eax, [esp + 0x38]
push eax
push edi
call fcn.0046fcc0
lea ecx, [esp + 0x18]
push ecx
lea edx, [edi + 0x14]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.0046f930
mov edx, edi
lea ecx, [esp + 0x24]
add esp, 0x14
sub edx, ecx
xor eax, eax
mov esi, 5
jmp 0x473180
mov ebp, dword [esp + eax + 0x10]
lea ecx, [esp + eax + 0x10]
mov ebx, dword [edx + ecx]
xor ebx, ebp
mov dword [esp + eax + 0x24], ebx
add eax, 4
dec esi
jne 0x473180
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0046f4f0
lea ecx, [esp + 0x54]
push ecx
call fcn.0046f450
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x88]
add esp, 0xc
cmp word [eax], 0
je 0x4731eb
lea ecx, [eax + 2]
xor eax, eax
mov edx, 5
mov ebp, dword [esp + eax + 0x24]
mov ebx, dword [esp + eax + 0x4c]
xor ebx, ebp
xor ebx, dword [ecx]
mov dword [eax + esi], ebx
add ecx, 4
add eax, 4
dec edx
jne 0x4731d1
jmp 0x473203
xor eax, eax
mov ecx, 5
mov edx, dword [esp + eax + 0x4c]
xor edx, dword [esp + eax + 0x24]
mov dword [eax + esi], edx
add eax, 4
dec ecx
jne 0x4731f2
or ecx, 0xffffffff
mov eax, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
and eax, 0x3fffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
xor eax, eax
mov ecx, 5
jmp 0x473230
mov ebp, dword [esp + eax + 0x10]
mov edx, dword [esp + eax + 0x24]
xor ebp, edx
mov dword [esp + eax + 0x10], ebp
add eax, 4
dec ecx
jne 0x473230
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.0046f930
lea edx, [esp + 0x44]
push edx
push edi
call fcn.0046f4f0
lea eax, [esp + 0x4c]
push eax
call fcn.0046f450
add esp, 0x18
lea ecx, [esi + 0x14]
xor eax, eax
mov edx, 5
mov esi, dword [esp + eax + 0x60]
xor esi, dword [esp + eax + 0x38]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x473276
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret

Function at 0x4752c2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49fbb8]
jne 0x4752cc
repz ret
jmp fcn.00475837
Function at 0x401491
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x7a1d10]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401526
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e3
cmp dword [ebp + 0x10], ebx
jne 0x40151a
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401491
test eax, eax
jne 0x4014f5
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00405b77
cmp eax, ebx
je 0x40152d
push ebx
push dword [0x7a1d10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401526
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x7a1d10], ebx
jne 0x401523
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401523
jmp 0x401526
Function at 0x402f1d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
jl 0x402f47
mov ecx, dword [0x7a1c78]
push esi
add eax, ecx
push esi
push eax
push dword [0x409014]
mov dword [0x79cdd8], eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 4
call fcn.00402db6
cmp eax, esi
jl 0x403024
push 4
lea eax, [ebp + 8]
push eax
push dword [0x409014]
call fcn.004058af
test eax, eax
jne 0x402f73
push 0xfffffffffffffffd
pop eax
jmp 0x403024
add dword [0x79cdd8], 4
push ebx
push dword [ebp + 8]
call fcn.00402db6
mov ebx, eax
cmp ebx, esi
jl 0x403021
cmp dword [ebp + 0x10], esi
jne 0x402fef
cmp dword [ebp + 8], esi
jle 0x403021
mov esi, 0x798dd8
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x402fb1
mov eax, 0x4000
push eax
push esi
push dword [0x409014]
mov dword [ebp - 4], eax
call fcn.004058af
test eax, eax
je 0x403013
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.004058de
test eax, eax
je 0x402feb
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x79cdd8], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x402fa0
jmp 0x403021
push 0xfffffffffffffffe
jmp 0x403015
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x402ffa
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409014]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x403018
push 0xfffffffffffffffd
pop eax
jmp 0x403023
mov ebx, dword [ebp - 4]
add dword [0x79cdd8], ebx
mov eax, ebx
pop ebx
pop esi
leave
ret 0x10
Function at 0x405593
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x407664
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov byte [ebp - 0x20], 1
mov byte [ebp - 0x1f], 0
mov dword [ebp - 0x10], 0x407654
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x4055e4
xor eax, eax
jmp 0x405611
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405610
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
je 0x40560e
xor eax, eax
jmp 0x405610
call esi
pop esi
leave
ret 4

Function at 0x405632
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x79f228
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x79f228], 0x44
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x405671
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405812
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405832
and eax, 0xfffffffe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405838
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
ret 0xc

Function at 0x405867
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
jne 0x4058ab
test edi, edi
jne 0x405872
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4058a5
Function at 0x40590d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40597e
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x400
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40596d
cmp dword [ebp + 0x14], 1
je 0x40596f
cmp dword [ebp + 0x14], 2
je 0x40596f
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x405b09
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405b2d
xor eax, eax
test eax, eax
je 0x405b3f
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405b3f
xor ecx, ecx
jmp 0x405b42
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x407298]
push ecx
lea eax, [ebp + eax - 0x120]
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 8
push 0
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
leave
ret 4

Function at 0x405c02
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405812
mov edi, eax
cmp edi, 0xffffffff
je 0x405c43
test byte [esp + 0x10], 1
push esi
je 0x405c2c
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
je 0x405c34
xor eax, eax
inc eax
jmp 0x405c45
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x405c23
test byte [esp + 0x10], 4
jne 0x405c43
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x405c9e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x79f270
push esi
call fcn.00405a26
push esi
call fcn.00405743
mov edi, eax
test edi, edi
jne 0x405cbf
xor eax, eax
jmp 0x405d17
push edi
call fcn.00405a48
test byte [0x7a1c88], 0x80
je 0x405cd8
mov al, byte [edi]
test al, al
je 0x405cbb
cmp al, 0x5c
je 0x405cbb
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenA]
sub edi, esi
jmp 0x405cf8
push esi
call fcn.00405ae2
test eax, eax
je 0x405cf2
test byte [eax], 0x10
je 0x405d1c
push esi
call fcn.00405c77
push esi
call ebx
cmp eax, edi
jg 0x405ce3
push esi
call fcn.00405c4a
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405d16
Function at 0x405f72
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x407718
mov edi, 0x79f670
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
mov ebx, 0x400
test esi, esi
je 0x405fc0
push 1
push 0
push esi
call fcn.00405838
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x4060df
cmp eax, ebx
jg 0x4060df
push ebx
mov esi, 0x7a03b0
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x4060df
cmp eax, ebx
jg 0x4060df
push esi
push edi
push str._s_s_r_n
push 0x79fbb0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x7a1c2c]
push dword [eax + 0x128]
push esi
call fcn.00405d20
push 4
push 0xc0000000
push esi
call fcn.00405838
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, 0xffffffff
je 0x4060df
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4060d8
push edi
push esi
push ebp
call fcn.004058af
test eax, eax
je 0x4060d8
push str._Rename__r_n
push esi
call fcn.00405798
test eax, eax
jne 0x406076
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
add edi, 0xa
jmp 0x4060ab
push 0x407700
add eax, 0xa
push eax
call fcn.00405798
mov ebp, eax
test ebp, ebp
je 0x4060a7
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406098
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406092
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x4060ad
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
push 0x79fbb0
add eax, esi
push eax
call fcn.004057ee
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.004058de
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4060e4
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
test eax, eax
jne 0x406107
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405f72
pop ecx
pop ecx
inc dword [0x7a1cf0]
ret 8
Function at 0x406110
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
and esi, 4
push ebx
mov dword [ebp - 4], esi
call fcn.00405c9e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test cl, 8
je 0x40614f
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7a1ce8], eax
jmp 0x4062da
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push edi
je 0x40616a
test eax, eax
je 0x406288
test cl, 2
je 0x406288
push ebx
mov esi, 0x79ffb0
push esi
call fcn.00405a26
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
je 0x40618c
push str..
push esi
call edi
jmp 0x406192
push ebx
call fcn.00405c77
cmp byte [ebx], 0
jne 0x4061a0
cmp byte [0x79ffb0], 0x5c
jne 0x4061a8
push 0x407298
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40627b
lea esi, [ebp - 0x120]
push 0x3f
mov eax, esi
push eax
call fcn.004056fd
cmp byte [eax], 0
je 0x4061eb
cmp byte [ebp - 0x1c], 0
je 0x4061eb
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x406201
mov al, byte [esi + 1]
test al, al
je 0x40625a
cmp al, 0x2e
jne 0x406201
cmp byte [esi + 2], 0
je 0x40625a
push esi
push edi
call fcn.00405a26
test byte [ebp - 0x14c], 0x10
je 0x406226
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40625a
push dword [ebp + 0xc]
push ebx
call fcn.00406110
jmp 0x40625a
push dword [ebp - 4]
push ebx
call fcn.00405c02
test eax, eax
jne 0x406252
cmp dword [ebp - 4], eax
je 0x40624a
push ebx
push 0xfffffffffffffff1
call fcn.00404957
push 0
push ebx
call fcn.004060e4
jmp 0x40625a
inc dword [0x7a1ce8]
jmp 0x40625a
push ebx
push 0xfffffffffffffff2
call fcn.00404957
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4061cd
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp dword [ebp + 8], 0
mov esi, dword [ebp - 4]
je 0x406288
mov byte [edi - 1], 0
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4062d9
cmp dword [ebp - 0xc], edi
je 0x4062c9
push ebx
call fcn.00405ae2
test eax, eax
je 0x4062d9
push ebx
call fcn.00405c4a
mov eax, esi
or eax, 1
push eax
push ebx
call fcn.00405c02
test eax, eax
jne 0x4062d1
cmp esi, edi
je 0x4062c9
push ebx
push 0xfffffffffffffff1
call fcn.00404957
push edi
push ebx
call fcn.004060e4
jmp 0x4062d9
inc dword [0x7a1ce8]
jmp 0x4062d9
push ebx
push 0xffffffffffffffe5
call fcn.00404957
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4062e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7a07b4], 0
jne 0x40631e
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4062f4
mov dword [ecx*4 + 0x7a07b0], eax
inc ecx
cmp ecx, 0x100
jl 0x4062ef
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40634b
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7a07b0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40632c
not eax
pop ebp
ret 0xc
Function at 0x43b658
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop eax
add esi, 0xe77b520b
push esi
pop ecx
sub esi, 0x52a20b0e
call fcn.0043b6aa
add ecx, 0xacaf990d
xor dword [edi], eax
add esi, 1
push 0xa9bd3660
pop ecx
sub esi, esi
add edi, 1
and ecx, ecx
push 0x5018de64
pop ecx
cmp edi, edx
jne fcn.0043b658
push 0xb62dabc3
pop esi
ret
Function at 0x8cc3ca40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor eax, eax
mov ecx, 0xffff
mov dword [ebp - 0xc], eax
push edi
mov ebx, eax
mov word [ebp - 0x10], cx
mov dword [esi + 0x20], 0x86218512
mov dword [esi + 0x24], 0x8621853e
cmp dword [esi + 0x70], eax
jne 0x8cc45f05
push ecx
lea ecx, [ebp - 0x10]
mov dword [esi + 0x6c], eax
call fcn.8cc3d084
mov edi, eax
test edi, edi
jne 0x8cc3cb50
mov eax, dword [esi]
lea edx, [esi + 0x40]
mov dword [ebp - 4], eax
lea ecx, [esi + 0x2c]
lea eax, [esi + 0x190]
push eax
sub esp, 0xc
call fcn.8cc3cf2e
mov edi, eax
test edi, edi
jne 0x8cc45f16
mov eax, dword [esi + 0x1f0]
test eax, eax
je 0x8cc3cac1
mov ebx, eax
mov ecx, ebx
call fcn.8cc387aa
mov dword [esi + 0x1ec], 1
lea eax, [ebp - 8]
xor ecx, ecx
lock or dword [eax], ecx
cmp dword [esi + 0x78], ecx
jne 0x8cc45f21
mov edx, dword [ebp - 4]
lea eax, [esi + 0x1b4]
sub esp, 0xc
lea ecx, [esi + 0x188]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
sub esp, 0x10
neg edx
sbb edx, edx
and edx, eax
call fcn.8cc3ced0
mov edi, eax
test edi, edi
jne 0x8cc45f54
cmp dword [ebp - 4], eax
jne 0x8cc45f79
mov dword [esi + 0x1ec], 0
test ebx, ebx
je 0x8cc3cb2d
mov ecx, ebx
call fcn.8cc387d8
mov ecx, esi
call fcn.8cc3c914
mov ebx, 0xc0021018
mov edi, eax
cmp edi, ebx
je 0x8cc3cb71
test edi, edi
jne 0x8cc3cb50
mov ecx, esi
call fcn.8cc3c7f0
mov edi, eax
test edi, edi
je 0x8cc3cb91
mov ebx, 0xc0020036
cmp edi, ebx
jne 0x8cc3cb9a
cmp dword [esi + 0x7c], 0
je 0x8cc45f98
push dword [ebp + 0x28]
mov ecx, esi
call fcn.8cc3c7ae
mov edi, eax
mov ebx, edi
mov eax, 0xffff
cmp word [ebp - 0x10], ax
je 0x8cc3cb86
lea eax, [ebp - 0x10]
push eax
call dword [0x86202cd8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov ecx, esi
call fcn.8cc3c914
jmp 0x8cc3cb39
test edi, edi
je 0x8cc3cb59
jmp 0x8cc45f37
test dword [ecx + eax - 0x417cffff], eax
test al, 0
add byte [eax], al
add byte [esp + 0xf], dh
mov dh, 7
add al, 0x88
dec ebp
or esi, esi
ror dword [eax], 0x8b
dec ebp
clc
xchg dword [eax], edx
add dword [ecx], eax
add byte [ebx - 0x49f00bbb], cl
dec esi
cmp byte [ebx - 0x3efcf940], al
add byte [ecx], al
add byte [ebx], bh
ror dword [edi], 0x82
ljmp 0xf855

Function at 0x8cc41fd2
Capabilities:
Authenticate hmac

Disassembly:
fcmovu st(0), st(0)
add byte [eax], al
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 0x28]
and edi, 0x8000
test byte [esi + 0xcc], 1
je 0x8cc420a8
test edi, edi
jne 0x8cc420c9
cmp dword [0x8622f040], 0
je 0x8cc4f8c2
mov ecx, esi
call fcn.8cc429b2
mov dword [ebp - 4], eax
test eax, eax
je 0x8cc41fef
jmp 0x8cc42069
test dword [ebx + 0x28], 0x2000
jne 0x8cc420e7
mov eax, dword [esi + 0x30]
test eax, eax
je 0x8cc42100
mov eax, dword [eax + 0x24]
mov dword [ebp - 4], 0
test eax, eax
je 0x8cc42100
mov eax, dword [esi + 0x108]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp esp, 0xda81e7f6
cmp dword [esi], edx
and byte [eax], 0x3f
sbb byte [edx - 0x7de0e244], al
cmp al, 0x41
test byte [ecx - 0x7dee8722], 0