joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539790
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x80
push eax
lea ebp, [esi + 0x18]
push ebp
call dword [sym.imp.MSVCR80.dll_strncpy]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
lea edi, [esi + 4]
add esp, 0xc
cmp dword [edi], 0
mov dword [esi + 0xc], ecx
jne 0x5397cf
push ebx
push edi
call fcn.005395c0
mov edx, dword [edi]
add esp, 8
mov dword [esi + 8], edx
mov eax, dword [esp + 0x18]
push eax
push ebx
push ebp
lea edi, [esi + 0x9c]
push str._MemoryPooltempl__s_
push edi
mov dword [esi + 0x98], ebx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x98]
mov edx, dword [esi + 0x14]
lea ecx, [eax*4]
push ecx
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
push ebx
push ebp
push str.__s__Init_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR80.dll_sprintf]
push edi
call fcn.004135c0
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x53adb0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x80
push eax
lea ebp, [esi + 0x18]
push ebp
call dword [sym.imp.MSVCR80.dll_strncpy]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
lea edi, [esi + 4]
add esp, 0xc
cmp dword [edi], 0
mov dword [esi + 0xc], ecx
jne 0x53adef
push ebx
push edi
call fcn.0053aba0
mov edx, dword [edi]
add esp, 8
mov dword [esi + 8], edx
mov eax, dword [esp + 0x18]
push eax
push ebx
push ebp
lea edi, [esi + 0x9c]
push str._MemoryPooltempl__s_
push edi
mov dword [esi + 0x98], ebx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x98]
mov edx, dword [esi + 0x14]
lea ecx, [eax*4]
push ecx
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
push ebx
push ebp
push str.__s__Init_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR80.dll_sprintf]
push edi
call fcn.004135c0
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x53afb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55eeae
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6397d4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
push 1
call fcn.00536720
xor ebx, ebx
mov dword [esi], vtable.CObjectEffectUnitDesc.0
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
cmp dword [0x66e034], ebx
mov byte [esp + 0x18], 2
jne 0x53b049
push 0x19c
call fcn.00551850
add esp, 4
cmp eax, ebx
je 0x53b032
mov dword [eax], vtable.CMemoryPoolTempl_class_CObjectEffectUnit_.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], ebx
mov byte [eax + 0x18], bl
mov dword [eax + 0x98], ebx
jmp 0x53b034
xor eax, eax
push str.CObjectEffectUnit
push 5
push 0x32
mov ecx, eax
mov dword [0x66e034], eax
call fcn.0053adb0
fldz
sub esp, 0xc
fst dword [esi + 0x18]
lea ecx, [esi + 0x5c]
fst dword [esi + 0x1c]
mov dword [esi + 0x40], ebx
fst dword [esi + 0x20]
mov dword [esi + 0x48], 1
fld1
mov word [esi + 0x56], bx
fst dword [esi + 0x34]
mov word [esi + 0x4c], bx
fst dword [esi + 0x38]
mov word [esi + 0x4e], 0xffff
fst dword [esi + 0x3c]
mov word [esi + 0x54], bx
fstp dword [esi + 0x44]
mov dword [esi + 0x58], ebx
fst dword [esi + 0x50]
fst dword [esp + 8]
fst dword [esp + 4]
fstp dword [esp]
push ecx
call fcn.00509910
fldz
fstp dword [esi + 0x68]
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x53b4a0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x80
push eax
lea ebp, [esi + 0x18]
push ebp
call dword [sym.imp.MSVCR80.dll_strncpy]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
lea edi, [esi + 4]
add esp, 0xc
cmp dword [edi], 0
mov dword [esi + 0xc], ecx
jne 0x53b4df
push ebx
push edi
call fcn.0053b2d0
mov edx, dword [edi]
add esp, 8
mov dword [esi + 8], edx
mov eax, dword [esp + 0x18]
push eax
push ebx
push ebp
lea edi, [esi + 0x9c]
push str._MemoryPooltempl__s_
push edi
mov dword [esi + 0x98], ebx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x98]
mov edx, dword [esi + 0x14]
lea ecx, [eax*4]
push ecx
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
push ebx
push ebp
push str.__s__Init_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR80.dll_sprintf]
push edi
call fcn.004135c0
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x53dd20
Capabilities:
Set current directory

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp edi, dword [esi + 0x50]
je 0x53dd40
cmp edi, 0x11
je 0x53dd40
mov eax, dword [esi + edi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [esi + 0x50], edi
pop edi
pop esi
ret 4

Function at 0x53e720
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x80
push eax
lea ebp, [esi + 0x18]
push ebp
call dword [sym.imp.MSVCR80.dll_strncpy]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
lea edi, [esi + 4]
add esp, 0xc
cmp dword [edi], 0
mov dword [esi + 0xc], ecx
jne 0x53e75f
push ebx
push edi
call fcn.0053e550
mov edx, dword [edi]
add esp, 8
mov dword [esi + 8], edx
mov eax, dword [esp + 0x18]
push eax
push ebx
push ebp
lea edi, [esi + 0x9c]
push str._MemoryPooltempl__s_
push edi
mov dword [esi + 0x98], ebx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x98]
mov edx, dword [esi + 0x14]
lea ecx, [eax*4]
push ecx
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
push ebx
push ebp
push str.__s__Init_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR80.dll_sprintf]
push edi
call fcn.004135c0
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x53e7c0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x53e7cc
pop esi
ret
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x53e7e7
add ecx, 0xffffffff
mov dword [eax + 0x10], ecx
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
test eax, eax
jne 0x53e8d0
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x14]
test eax, eax
push ebx
push ebp
push edi
jne 0x53e861
mov edx, dword [esi + 0xc]
push edx
lea edi, [esi + 4]
push edi
call fcn.0053e550
mov eax, dword [edi]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
add dword [esi + 0x10], 1
mov ebp, dword [sym.imp.MSVCR80.dll_sprintf]
push ecx
push edx
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
push eax
lea ebx, [esi + 0x18]
push ebx
lea edi, [esi + 0x9c]
push str.___s_alloc_Band
push edi
call ebp
add esp, 0x20
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
add dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
lea edx, [ecx*4]
push edx
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push ecx
push eax
push edx
push ebx
push str.__s__Increse_t_d_t_d_t_d_t_d_t_d_n
jmp 0x53e8b9
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov ebp, dword [sym.imp.MSVCR80.dll_sprintf]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
push eax
push ecx
push edx
lea ebx, [esi + 0x18]
push ebx
lea edi, [esi + 0x9c]
push 0x5640ac
push edi
call ebp
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
sub dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
lea edx, [ecx*4]
push edx
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push ecx
push eax
push edx
push ebx
push str.__s__Decrese_t_d_t_d_t_d_t_d_t_d_n
push edi
call ebp
push edi
call fcn.004135c0
add esp, 0x24
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
jmp fcn.0053e7c0
add dword [esi + 0x14], 1
pop esi
ret

Function at 0x53e8e0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x80
push eax
lea ebp, [esi + 0x18]
push ebp
call dword [sym.imp.MSVCR80.dll_strncpy]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
lea edi, [esi + 4]
add esp, 0xc
cmp dword [edi], 0
mov dword [esi + 0xc], ecx
jne 0x53e91f
push ebx
push edi
call fcn.0053e660
mov edx, dword [edi]
add esp, 8
mov dword [esi + 8], edx
mov eax, dword [esp + 0x18]
push eax
push ebx
push ebp
lea edi, [esi + 0x9c]
push str._MemoryPooltempl__s_
push edi
mov dword [esi + 0x98], ebx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x98]
mov edx, dword [esi + 0x14]
lea ecx, [eax*4]
push ecx
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
push ebx
push ebp
push str.__s__Init_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR80.dll_sprintf]
push edi
call fcn.004135c0
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x53e980
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x53e98c
pop esi
ret
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x53e9a7
add ecx, 0xffffffff
mov dword [eax + 0x10], ecx
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
test eax, eax
jne 0x53ea90
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x14]
test eax, eax
push ebx
push ebp
push edi
jne 0x53ea21
mov edx, dword [esi + 0xc]
push edx
lea edi, [esi + 4]
push edi
call fcn.0053e660
mov eax, dword [edi]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
add dword [esi + 0x10], 1
mov ebp, dword [sym.imp.MSVCR80.dll_sprintf]
push ecx
push edx
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
push eax
lea ebx, [esi + 0x18]
push ebx
lea edi, [esi + 0x9c]
push str.___s_alloc_Band
push edi
call ebp
add esp, 0x20
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
add dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
lea edx, [ecx*4]
push edx
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push ecx
push eax
push edx
push ebx
push str.__s__Increse_t_d_t_d_t_d_t_d_t_d_n
jmp 0x53ea79
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov ebp, dword [sym.imp.MSVCR80.dll_sprintf]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
push eax
push ecx
push edx
lea ebx, [esi + 0x18]
push ebx
lea edi, [esi + 0x9c]
push 0x5640ac
push edi
call ebp
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
sub dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
lea edx, [ecx*4]
push edx
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push ecx
push eax
push edx
push ebx
push str.__s__Decrese_t_d_t_d_t_d_t_d_t_d_n
push edi
call ebp
push edi
call fcn.004135c0
add esp, 0x24
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
jmp fcn.0053e980
add dword [esi + 0x14], 1
pop esi
ret
Function at 0x545930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55f74e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x6397d4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0041b6c0
lea edi, [esi + 0x264]
mov ecx, edi
mov dword [esp + 0x38], 0
mov dword [esi], vtable.CTitanDissolutionDlg.0
call fcn.004a9bd0
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
mov dword [esi + 0x260], 0
call fcn.0041fed0
push 0
lea eax, [esp + 0x14]
push eax
push 0x3f
mov ecx, 0x648290
mov byte [esp + 0x44], 2
call fcn.00425560
push 0x33517d
lea ecx, [esp + 0x14]
push ecx
push 0xffffff
push 0x562815
mov ecx, edi
call fcn.004321d0
lea ecx, [esp + 0x10]
mov dword [esi + 0x288], 0
mov byte [esp + 0x38], 1
call fcn.0041fee0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x54c810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55fb8e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x6397d4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0041b6c0
lea edi, [esi + 0x264]
mov ecx, edi
mov dword [esp + 0x38], 0
mov dword [esi], vtable.CTitanRegisterDlg.0
call fcn.004a9bd0
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
mov dword [esi + 0x260], 0
call fcn.0041fed0
push 0
lea eax, [esp + 0x14]
push eax
push 0x3f
mov ecx, 0x648290
mov byte [esp + 0x44], 2
call fcn.00425560
push 0x33517d
lea ecx, [esp + 0x14]
push ecx
push 0xffffff
push 0x562815
mov ecx, edi
call fcn.004321d0
lea ecx, [esp + 0x10]
mov dword [esi + 0x288], 0
mov byte [esp + 0x38], 1
call fcn.0041fee0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x54dbf0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x55fc6a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6397d4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
xor esi, esi
push edi
mov ecx, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], 1
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
test eax, eax
jbe 0x54dc89
lea ecx, [ecx]
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_char____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator___unsigned_int_]
mov ecx, eax
mov eax, 0x88888889
mul esi
shr edx, 3
mov eax, edx
shl eax, 4
sub eax, edx
mov edx, esi
sub edx, eax
mov al, byte [edx + 0x573950]
not al
xor byte [ecx], al
mov ecx, edi
add esi, 1
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
cmp esi, eax
jb 0x54dc50
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x54dca0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x55fcaa
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6397d4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
xor esi, esi
push edi
mov ecx, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], 1
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
test eax, eax
jbe 0x54dd39
lea ecx, [ecx]
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_char____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator___unsigned_int_]
mov ecx, eax
mov eax, 0x88888889
mul esi
shr edx, 3
mov eax, edx
shl eax, 4
sub eax, edx
mov edx, esi
sub edx, eax
mov al, byte [edx + str.invalid_pointer]
not al
xor byte [ecx], al
mov ecx, edi
add esi, 1
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
cmp esi, eax
jb 0x54dd00
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8

Function at 0x54f260
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov eax, esi
sar eax, 2
lea edx, [eax*4]
push edi
mov edi, dword [esp + 0x10]
and esi, 3
or ebx, 0xffffffff
test eax, eax
mov dword [ecx + 0x50], edx
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x4c], esi
mov edx, edi
je 0x54f2a4
mov eax, dword [edx]
xor dword [ecx + 0x54], eax
add dword [ecx + 0x48], ebx
add edx, 4
cmp dword [ecx + 0x48], 0
jne 0x54f293
test esi, esi
je 0x54f2c9
jmp 0x54f2b0
mov eax, dword [ecx + 0x50]
movsx edx, byte [eax + edi]
xor dword [ecx + 0x54], edx
add dword [ecx + 0x4c], ebx
add eax, 1
mov dword [ecx + 0x50], eax
cmp dword [ecx + 0x4c], 0
jne 0x54f2b0
pop edi
pop esi
pop ebx
ret 8

Function at 0x55160d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6397d4]
jne 0x551617
repz ret
jmp fcn.00551d62
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x42910b23
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x73797
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x5cc87227
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x735d1ff8
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10002a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10002ad8
cmp byte [esi + ebx - 1], 0xa
je 0x10002aac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10004118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x24f06025
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x28826249
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
mov esi, ecx
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
movzx eax, byte [edx + 6]
mov byte [esi + 6], al
movzx eax, byte [edx + 7]
mov byte [esi + 7], al
movzx eax, byte [edx + 8]
mov byte [esi + 8], al
movzx eax, byte [edx + 9]
mov byte [esi + 9], al
movzx eax, byte [edx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [esi + 0xc], al
lea eax, [esi + 0xd]
mov bl, byte [edx + 0xd]
mov byte [eax], bl
mov cl, byte [edx + 0xe]
mov byte [esi + 0xe], cl
mov cl, byte [edx + 0xf]
mov byte [esi + 0xf], cl
mov ecx, 4
mov dword [ebp - 8], ecx
nop
mov dh, byte [eax + 2]
mov dl, bl
mov bl, byte [eax + 1]
mov bh, byte [eax - 1]
mov byte [ebp - 2], bl
mov byte [ebp - 1], dh
test cl, 3
jne 0x4010d3
movzx ecx, bl
movzx edx, dl
mov cl, byte [ecx + str.cw]
mov byte [ebp - 3], cl
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 2], cl
movzx ecx, bh
mov cl, byte [ecx + str.cw]
mov byte [ebp - 1], cl
mov ecx, dword [ebp - 8]
shr ecx, 2
mov bh, byte [ecx + 0x424c00]
xor bh, byte [edx + str.cw]
mov dl, byte [ebp - 3]
mov cl, byte [eax - 0xd]
xor cl, bh
mov byte [eax + 3], cl
mov bl, byte [eax - 0xc]
xor bl, dl
lea edx, [eax + 4]
mov byte [edx], bl
mov cl, byte [eax - 0xb]
xor cl, byte [ebp - 2]
mov byte [eax + 5], cl
mov cl, byte [eax - 0xa]
xor cl, byte [ebp - 1]
mov byte [eax + 6], cl
mov eax, edx
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x2c
jb 0x401080
pop esi
pop ebx
mov esp, ebp
pop ebp
ret