joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416190
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
push 0x32cc
mov ecx, dword [edi + 0x5c]
call fcn.00402790
push eax
lea ecx, [ebp - 4]
call fcn.00409a40
push 1
push 0
push 0
push dword [ebp - 4]
push str.open
push dword [edi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 4]
call fcn.0041a66b
add esp, 4
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x4181f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov edx, 2
lea ebx, [eax + 1]
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a6b1
mov edi, eax
add esp, 4
test edi, edi
je 0x41822d
push ebx
push edi
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push dword [esi + 4]
mov dword [esi + 0x3c], edi
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x4186a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4ae008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
push 0x58
push 0
mov dword [esi + 4], 0
lea edi, [esi + 0x20]
mov dword [esi + 0x14], 0
push edi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
call fcn.0041c3a0
xor eax, eax
lea ebx, [esi + 0x27c]
mov word [ebx], ax
xor ecx, ecx
push 0x110
push ecx
lea eax, [ebp - 0x114]
mov word [esi + 0x7c], cx
push eax
mov dword [esi + 0x78], 1
mov dword [edi], 0x58
call fcn.0041c3a0
add esp, 0x18
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x418748
mov eax, dword [ebp - 0x114]
cmp eax, 5
jae 0x41874e
cmp eax, 4
jne 0x418748
cmp dword [ebp - 0x110], 0x5a
jae 0x41874e
mov dword [edi], 0x4c
mov ecx, dword [ebp + 0x18]
lea eax, [esi + 0x7c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], eax
mov eax, esi
mov dword [esi + 0x40], 0x104
mov dword [esi + 0x5c], 0
mov dword [esi + 0x48], 0x100
mov dword [esi + 0x54], 0x880024
mov ecx, dword [0x4afe48]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x64], 0x40c270
xor ecx, ebp
mov dword [esi + 0x24], 0
pop esi
pop ebx
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4191f0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4ae008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.0041c3a0
add esp, 0xc
mov dword [ebp - 0x248], 0x3c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x240], 0
push eax
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x234], str.startupdialogadvanced
mov dword [ebp - 0x22c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
je 0x419296
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 0xc
push 0
call fcn.00420bee
int3

Function at 0x4192a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
push 0x32d1
mov ecx, dword [edi + 0x5c]
call fcn.00402790
push eax
lea ecx, [ebp - 4]
call fcn.00409a40
push 1
push 0
push 0
push dword [ebp - 4]
push str.open
push dword [edi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 4]
call fcn.0041a66b
add esp, 4
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4196c0
Capabilities:
Get token membership
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ae008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x419720
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x10], 1
je 0x41977b
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x44f
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
call esi
push 0x485
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x450
push dword [ebx + 4]
call edi
push 0
push eax
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a65a
mov esp, ebp
pop ebp
ret
push 0
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041a65a
mov esp, ebp
pop ebp
ret

Function at 0x4197a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, ecx
push edi
push 0x44f
push dword [ebx + 4]
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
call edi
push 0x485
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x450
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x467
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x468
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x469
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x470
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x46c
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x46d
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x486
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0x487
push dword [ebx + 4]
call esi
push 0
push eax
call edi
push 0
push dword [ebx + 0x70]
call edi
push 0
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
ret
Function at 0x419e50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x4ae008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x41c]
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x41c]
or esi, 0xffffffff
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419e90
sub ecx, edx
sar ecx, 1
js 0x419eb5
cmp word [ebp + ecx*2 - 0x41c], 0x5c
je 0x419eb3
sub ecx, 1
jns 0x419ea1
jmp 0x419eb5
mov esi, ecx
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.0042094d
add esp, 0x10
test eax, eax
je 0x419eed
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 4
mov edi, 0x103
mov eax, edi
sub eax, esi
push str.MacromedFlashFlashPlayerUpdateService.exe
push eax
lea eax, [ebp - 0x212]
lea eax, [eax + esi*2]
push eax
call fcn.00420681
add esp, 0xc
test eax, eax
jne 0x419ed8
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419f20
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ebx
sub edi, ecx
push edi
lea eax, [eax + ecx*2]
push eax
call fcn.00420681
add esp, 0xc
test eax, eax
jne 0x419ed8
push 0x44
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.0041c3a0
add esp, 0xc
lea eax, [ebp - 0x430]
xorps xmm0, xmm0
movups xmmword [ebp - 0x430], xmm0
push eax
lea eax, [ebp - 0x47c]
push eax
push 0
push 0
push 0xc000000
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x419fdc
push 0x927c0
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x420], 0
push dword [ebp - 0x430]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sete bl
call esi
push dword [ebp - 0x42c]
call esi
jmp 0x419fde
xor bl, bl
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 4
Function at 0x41a000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x4ae008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x20a
push 0
push eax
call fcn.0041c3a0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call fcn.0041a150
test al, al
jne 0x41a052
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a060
sub ecx, edx
mov eax, 0x103
sar ecx, 1
sub eax, ecx
push esi
push eax
lea eax, [ebp - 0x21c]
lea eax, [eax + ecx*2]
push eax
call fcn.00420681
add esp, 0xc
test eax, eax
jne 0x41a03e
push 0x44
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.0041c3a0
add esp, 0xc
lea eax, [ebp - 0x230]
xorps xmm0, xmm0
movups xmmword [ebp - 0x230], xmm0
push eax
lea eax, [ebp - 0x27c]
push eax
push 0
push 0
push 0xc000000
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x41a133
push 0x927c0
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x220], 0
push dword [ebp - 0x230]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sete bl
call esi
push dword [ebp - 0x22c]
call esi
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor bl, bl
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 4

Function at 0x41a150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push ebx
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPepper
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a1de
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push str.UninstallerPath
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41a1d3
lea ecx, [edi + 2]
nop word [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x41a1b0
sub edi, ecx
movzx eax, bl
sar edi, 1
mov ecx, 1
pop edi
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a1f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x4ae008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x20a
push 0
push eax
call fcn.0041c3a0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call fcn.0041a340
test al, al
jne 0x41a242
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a250
sub ecx, edx
mov eax, 0x103
sar ecx, 1
sub eax, ecx
push esi
push eax
lea eax, [ebp - 0x21c]
lea eax, [eax + ecx*2]
push eax
call fcn.00420681
add esp, 0xc
test eax, eax
jne 0x41a22e
push 0x44
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.0041c3a0
add esp, 0xc
lea eax, [ebp - 0x230]
xorps xmm0, xmm0
movups xmmword [ebp - 0x230], xmm0
push eax
lea eax, [ebp - 0x27c]
push eax
push 0
push 0
push 0xc000000
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x41a323
push 0x927c0
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x220], 0
push dword [ebp - 0x230]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sete bl
call esi
push dword [ebp - 0x22c]
call esi
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor bl, bl
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0041a65a
mov esp, ebp
pop ebp
ret 4

Function at 0x41a340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push ebx
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPlugin
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a3ce
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push str.UninstallerPath
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41a3c3
lea ecx, [edi + 2]
nop word [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x41a3a0
sub edi, ecx
movzx eax, bl
sar edi, 1
mov ecx, 1
pop edi
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPlugin
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a452
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.isScriptDebugger
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x41a452
cmp dword [ebp - 8], 0
mov ecx, 1
movzx eax, bl
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerPepper
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a4d2
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.isScriptDebugger
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x41a4d2
cmp dword [ebp - 8], 0
mov ecx, 1
movzx eax, bl
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422f5e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00422ddd
Function at 0x13335ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0x5a4d
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
cmp word [esi], ax
jne 0x1333731
mov ebx, dword [esi + 0x3c]
add ebx, esi
cmp dword [ebx], 0x4550
jne 0x1333731
mov eax, dword [edi + 0x684]
test eax, eax
je 0x1333731
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0xffffffffffffffff
call eax
test eax, eax
je 0x1333731
mov eax, 0x1c0
cmp word [ebp - 4], ax
je 0x1333636
mov eax, 0xaa64
cmp word [ebp - 4], ax
jne 0x1333731
cmp dword [ebx + 8], 0x27debf2c
jne 0x1333661
push 0x4b2e8f83
push 0x4b2e8de3
push 0x4b280000
mov edx, esi
mov ecx, edi
call fcn.01333548
add esp, 0xc
xor eax, eax
jmp 0x1333736
cmp dword [ebx + 8], 0x88330560
jne 0x1333676
push 0x4b3fabde
push 0x4b3fa92b
jmp 0x1333649
cmp dword [ebx + 8], 0xe892dd44
jne 0x133368b
push 0x4b406b8e
push 0x4b4068db
jmp 0x1333649
and dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push 0
push 1
push ecx
push 0x2bcd03a7
push esi
mov ecx, edi
call fcn.01333fd9
test eax, eax
js 0x1333736
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1333731
lea eax, [ebx - 0x140]
mov dword [ebp - 0x1c], 0x3f3f3fe8
push 8
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x18], 0x843f
push ecx
mov edx, 0x140
mov byte [ebp - 0x16], 0xc0
mov ecx, eax
mov dword [ebp - 0x24], 0x1b8
mov word [ebp - 0x20], 0x8400
mov byte [ebp - 0x1e], 0xc0
mov dword [ebp - 0x10], eax
call fcn.01334571
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1333701
mov ecx, dword [ebp - 0x10]
mov edx, 0x140
jmp 0x133371e
push 7
lea eax, [ebp - 0x1c]
mov edx, 0x200
push eax
mov ecx, ebx
call fcn.01334571
test eax, eax
jne 0x133373b
mov edx, 0x200
mov ecx, ebx
push 8
lea eax, [ebp - 0x24]
push eax
call fcn.01334571
test eax, eax
jne 0x133365a
mov eax, 0xe0010001
pop edi
pop esi
pop ebx
leave
ret
push eax
push dword [ebp - 0x14]
push esi
jmp 0x133364e

Function at 0x13343f9
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1334417
mov eax, dword [ecx + 0x3c]
cmp eax, 0x400
jg 0x1334417
add eax, ecx
cmp dword [eax], 0x4550
je 0x1334419
xor eax, eax
ret
Function at 0x13377e0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov edx, 1
push ebx
push esi
push edi
xor esi, esi
mov eax, edx
mov dword [ebp + esi*4 - 0x808], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x408], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x13377f3
mov esi, 1
mov edx, 0x133ec78
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x133eca0
jl 0x1337830
mov eax, 1
mov byte [0x133ca78], 0x63
mov byte [0x133dbdb], 0
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x408]
lea eax, [ebp - 0x40c]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x133ca78], bl
mov byte [ebx + 0x133db78], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jl 0x1337870
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
movzx edx, byte [esi + 0x133ca78]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x133cb78], ecx
rol ecx, 8
mov dword [esi*4 + 0x133cf78], ecx
rol ecx, 8
mov dword [esi*4 + 0x133d378], ecx
rol ecx, 8
mov dword [esi*4 + 0x133d778], ecx
movzx ecx, byte [esi + 0x133db78]
test ecx, ecx
je 0x133799f
mov ecx, dword [ebp + ecx*4 - 0x408]
mov eax, dword [ebp - 0x3d0]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e4]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x808]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d4]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x808]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x808]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3dc]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x808]
jmp 0x13379a8
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 4]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x133dc78], eax
rol eax, 8
mov dword [esi*4 + 0x133e078], eax
rol eax, 8
mov dword [esi*4 + 0x133e478], eax
rol eax, 8
mov dword [esi*4 + 0x133e878], eax
inc esi
cmp esi, 0x100
jl 0x13378e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1337a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x18
test al, 0xf
je 0x1337a16
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1337b6a
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
jne 0x1337ab2
mov ebx, dword [ebp + 0x18]
lea edx, [ecx + 0xf]
dec eax
mov dword [ebp - 8], edx
mov edi, ecx
shr eax, 4
sub edi, esi
inc eax
mov dword [ebp + 0x10], eax
movups xmm0, xmmword [ebx]
push esi
push ebx
push dword [ebp + 8]
movups xmmword [ebp - 0x18], xmm0
call fcn.01338d30
add esp, 0xc
cmp esi, dword [ebp - 8]
ja 0x1337a83
lea eax, [esi + 0xf]
cmp eax, dword [ebp + 0x14]
jb 0x1337a83
mov ecx, esi
mov edx, 0x10
nop
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x1337a70
mov eax, dword [ebp + 0x14]
jmp 0x1337a93
mov eax, dword [ebp + 0x14]
movups xmm0, xmmword [esi]
movups xmm1, xmmword [eax]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [ebp - 0x18]
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
sub dword [ebp + 0x10], 1
movups xmmword [eax], xmm0
jne 0x1337a46
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x18]
lea edx, [eax - 1]
mov ebx, ecx
shr edx, 4
sub ebx, edi
mov dword [ebp - 4], esi
inc edx
mov dword [ebp + 0x10], ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
nop dword [eax]
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x1337ade
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x1337aec
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x1337b1d
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x1337b1d
mov ebx, esi
mov ecx, edi
mov esi, dword [ebp + 0x10]
sub ebx, edi
mov edx, 0x10
nop word [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub edx, 1
jne 0x1337b00
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
jmp 0x1337b2a
movups xmm1, xmmword [ecx]
movups xmm0, xmmword [edi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
cmp dword [ebp + 0xc], 1
push esi
push esi
push edx
jne 0x1337b3a
call fcn.013392c0
jmp 0x1337b3f
call fcn.01338d30
movups xmm0, xmmword [esi]
mov ecx, dword [ebp + 0x14]
sub ebx, 0x10
mov edx, dword [ebp + 8]
add esi, 0x10
add esp, 0xc
mov dword [ebp + 0x10], ebx
add edi, 0x10
mov dword [ebp - 4], esi
sub dword [ebp - 8], 1
movups xmmword [ecx], xmm0
jne 0x1337ad0
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret