joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4238d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
push edi
jne 0x42396c
cmp dword [esi + 4], 0xffffffff
jne 0x42396c
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423900
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x423937
cmp eax, 0x2f
je 0x423937
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x423924
mov eax, dword [0x584b74]
mov dword [edi], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
call fcn.00422660
add esp, 4
test eax, eax
jne 0x423952
mov eax, dword [ebp + 8]
pop edi
pop ebp
ret 4
call fcn.00422a50
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
pop ebp
ret 4
mov eax, 0x1000000
pop edi
pop ebp
ret 4

Function at 0x424030
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5a8f00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x424064
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x424064
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x42414e
mov ecx, ebx
mov edx, ebx
cmp ax, 0x2f
je 0x424080
cmp ax, 0x5c
jne 0x424082
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x424074
push edi
cmp ecx, ebx
je 0x4240c2
sub ecx, ebx
sar ecx, 1
lea edi, [ecx + ecx]
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0052a0e0
lea edx, [ebp - 0x414]
push edx
xor ecx, ecx
push esi
mov word [ebp + edi - 0x414], cx
call fcn.00424030
add esp, 0x14
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x4240ef
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4240e0
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4240f3
lea edi, [ebp - 0x20c]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x424110
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x42414e
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00523079
mov esp, ebp
pop ebp
ret
Function at 0x42d305
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42d34c
call fcn.00431617
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42d34c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42d368
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042ce05
mov esi, eax
test edi, edi
je 0x42d366
test ebx, ebx
je 0x42d366
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42db1f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x549183
call fcn.00527b83
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x42db44
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42db96
call fcn.00430a2c
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d9e0
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005276b2
push eax
call fcn.0040d660
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040b5a0
mov eax, esi
call fcn.00527c5b
ret 8

Function at 0x432d22
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00431617
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x432d5b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0043295f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x432db9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x432ddd
cmp dword [edi + 0x74], 0
jne 0x432ddd
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00431617
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00432d7a
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x433877
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0043351b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4338c1
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00426fb5
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004259a2
jmp 0x4338cc
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0043bffd
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4338d2
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0042d411
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x43390f
call fcn.0043351b
mov dword [esi + 0xc], 1
jmp 0x433914
call fcn.0043351b
cmp dword [esi], 0
je 0x43395d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x433935
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00426fb5
jmp 0x433947
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.0040dbb0
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004259a2
jmp 0x433981
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x433981
push dword [esi]
push dword [ebp + 8]
call fcn.0043bffd
pop esi
pop ebp
ret 0xc

Function at 0x435ac7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x435b0f
call fcn.00431617
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x435b0f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x435b52
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x435b3b
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x435b3b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x435b4f
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x478e87
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004fc6e4
call fcn.00431034
cmp dword [eax + 0x14], 0
jne 0x478ea4
mov ecx, esi
pop esi
jmp fcn.0047898c
pop esi
ret

Function at 0x47c3bc
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0047aae1
call fcn.00431034
cmp dword [eax + 0x14], 0
jne 0x47c3d9
mov ecx, esi
pop esi
jmp fcn.0047bd8f
pop esi
ret

Function at 0x48c5ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x48c5e8
call fcn.00431617
mov esi, dword [eax + 0xc]
push dword [0x5ae50c]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x48c606
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x48c5fe
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x48c633
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x48c600
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0048c4fc
mov esi, eax
jmp 0x48c625

Function at 0x509767
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x50977f
mov edi, dword [esi + 0xc]
jmp 0x5097bf
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x509798
call fcn.0042f478
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x5097ad
call fcn.0042f478
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x5097bf
call fcn.0042f478
call fcn.00431617
cmp dword [eax + 0x3c], 0
je 0x5097d4
push edi
mov ecx, ebx
call fcn.00508599
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00509681
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x5097f2
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x5097fe
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x523079
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a8f00]
jne 0x523083
repz ret
jmp fcn.0052d1f4
Function at 0x535490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5354b7
call fcn.00527d2e
mov dword [eax], esi
call fcn.00527d1b
push 0x16
pop esi
mov dword [eax], esi
call fcn.0052d695
mov eax, esi
jmp 0x53550c
test dword [ebp + 0xc], 0xfffffff9
jne 0x53549d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5354e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00527d41
pop ecx
call fcn.00527d1b
mov eax, dword [eax]
jmp 0x53550c
test al, 0x10
jne 0x53550a
test al, 1
je 0x53550a
test byte [ebp + 0xc], 2
je 0x53550a
call fcn.00527d2e
mov dword [eax], 5
call fcn.00527d1b
mov dword [eax], 0xd
jmp 0x5354db
xor eax, eax
pop esi
pop ebp
ret

Function at 0x53c9f8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a8f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0052cc1b
and dword [ebp - 0x14], 0
cmp dword [0x5b0f10], 0
mov dword [ebp - 0x18], eax
jne 0x53caab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x53cb53
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x57ee48
push ebx
call edi
test eax, eax
je 0x53cb53
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x57ee38
push ebx
mov dword [0x5b0f10], eax
call edi
push eax
call esi
push 0x57ee24
push ebx
mov dword [0x5b0f14], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5b0f18], eax
call edi
push eax
call esi
mov dword [0x5b0f20], eax
test eax, eax
je 0x53caab
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5b0f1c], eax
mov eax, dword [0x5b0f1c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x53cb04
cmp dword [0x5b0f20], ecx
je 0x53cb04
push eax
call esi
push dword [0x5b0f20]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x53cb04
test ebx, ebx
je 0x53cb04
call edi
test eax, eax
je 0x53cafb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x53cafb
test byte [ebp - 8], 1
jne 0x53cb04
or dword [ebp + 0x10], 0x200000
jmp 0x53cb37
mov eax, dword [0x5b0f14]
cmp eax, dword [ebp - 0x18]
je 0x53cb37
push eax
call esi
test eax, eax
je 0x53cb37
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x53cb37
mov eax, dword [0x5b0f18]
cmp eax, dword [ebp - 0x18]
je 0x53cb37
push eax
call esi
test eax, eax
je 0x53cb37
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5b0f10]
call esi
test eax, eax
je 0x53cb53
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x53cb55
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00523079
leave
ret
Function at 0x414f5f
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword fs:[0x30]
mov ebp, ecx
mov dl, byte [0x42b93c]
xor dl, 0x84
movzx eax, dl
mov ecx, dword [edi + 0xc]
add ecx, 0x14
lea ebx, [edx + 0x16]
mov edx, 0xffbf
xor ax, dx
mov byte [0x42b944], bl
mov edx, 0x25c1
mov esi, dword [ecx]
and ax, dx
mov word [0x42b954], ax
movzx eax, ax
cmp esi, ecx
je 0x415010
movzx eax, bl
mov ecx, 0x1b33
add eax, 0xdfda564e
mov dword [0x42b93c], eax
movzx eax, al
imul eax, eax, 0xfb
push ebp
push dword [esi + 0x28]
movzx eax, al
add ax, cx
mov word [0x42b954], ax
or al, 0xaa
mov byte [0x42b944], al
call fcn.00407189
pop ecx
pop ecx
test eax, eax
je 0x415024
mov ax, word [0x42b954]
mov ecx, 0x6e7b
mov esi, dword [esi]
sub ax, cx
movzx ecx, ax
mov word [0x42b954], ax
mov eax, dword [edi + 0xc]
add eax, 0x14
cmp esi, eax
je 0x41500e
mov bl, byte [0x42b944]
jmp 0x414fa6
mov eax, ecx
movzx eax, ax
or eax, 0x1e56bb2
mov dword [0x42b93c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [0x42b93c]
mov eax, dword [esi + 0x10]
imul ecx, edx, 0x404e
xor edx, 0xeabcfa7d
mov dword [0x42b93c], edx
mov word [0x42b954], cx
movzx ecx, dl
imul ecx, ecx, 0xf7
mov byte [0x42b944], cl
jmp 0x41501f

Function at 0x4153cb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov al, byte [0x42b98e]
sub al, 0x23
mov byte [0x42b970], al
mov al, byte [0x42b93a]
push ebx
mov ebx, dword [0x42b984]
sub al, 0x36
or al, 0x5e
push esi
mov byte [0x42b932], al
lea eax, [ebx + 0x4bc1]
sub bl, 9
push edi
mov edi, ecx
movzx edx, ax
movzx ecx, ax
mov word [0x42b9ac], ax
mov eax, 0x5a4d
mov dword [ebp - 8], ebx
cmp word [edi], ax
jne 0x41549c
imul eax, dword [0x42b950], 0xb0528a2
mov esi, dword [edi + 0x3c]
add esi, edi
mov bl, al
and eax, 0x9dbac588
or bl, 0x85
mov dword [0x42b984], eax
mov eax, dword [ebp - 8]
mov byte [ebp - 1], bl
mov byte [0x42b93a], bl
movzx ebx, al
movzx eax, byte [0x42b98c]
add ebx, 0xb354cb57
imul eax, eax, 0x29
cmp dword [esi], 0x4550
mov dword [0x42b950], ebx
mov byte [0x42b970], al
jne 0x41549c
mov cl, byte [ebp - 1]
lea eax, [edx - 0x10de]
xor cl, 0x1d
mov word [0x42b98c], ax
mov byte [0x42b98e], cl
mov eax, esi
lea ecx, [ebx - 0x43]
or ebx, 0x84109514
mov byte [0x42b970], cl
mov dword [0x42b950], ebx
jmp 0x4154b9
and cl, 0xb
or dl, 0x1c
mov byte [0x42b932], cl
xor cl, 0x76
mov byte [0x42b98e], cl
xor eax, eax
mov byte [0x42b93a], dl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4154be
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ecx
push ecx
mov dl, byte [0x42b97e]
push ebx
mov bl, byte [0x42b958]
push esi
push edi
mov edi, ecx
movzx eax, dl
mov ecx, 0xb451
add bl, 0x7c
xor ax, cx
mov byte [0x42b971], bl
mov word [0x42b99c], ax
xor esi, esi
mov al, byte [edi]
mov byte [esp + 0xe], al
test al, al
je 0x415589
push ebp
mov ebp, dword [str.D_q4m]
mov byte [esp + 0x13], bl
movzx eax, bl
mov ecx, ebp
imul eax, eax, 0x90
or ecx, 0xf09c
movzx ebp, cx
mov ebx, 0x1087
movzx edx, dl
and ebp, 0x50059351
sub dl, 0x45
imul esi, esi, 0x3c847bc
mov dword [esp + 0x14], eax
mov byte [0x42b97e], al
movzx eax, cl
imul ecx, eax, 0xa0
movzx eax, byte [esp + 0x13]
add ax, bx
mov word [0x42b99c], ax
movzx eax, dl
mov edx, dword [esp + 0x14]
imul ebx, eax, 0xfd
movsx eax, byte [esp + 0x12]
xor esi, eax
mov byte [0x42b960], cl
inc edi
mov byte [0x42b971], bl
mov byte [esp + 0x13], bl
mov al, byte [edi]
mov byte [esp + 0x12], al
test al, al
jne 0x415506
mov dword [str.D_q4m], ebp
pop ebp
jmp 0x41558f
mov cl, byte [0x42b960]
movzx ecx, cl
mov eax, esi
imul ecx, ecx, 0x175d9fa
pop edi
pop esi
pop ebx
mov dword [0x42b958], ecx
pop ecx
pop ecx
ret
Function at 0x41769f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x24], 0x7d8b8d3d
push edi
mov dword [ebp - 0x20], 0x878a888a
mov ecx, esi
mov dword [ebp - 0x1c], 0x7d84817e
mov dword [ebp - 0x18], 0x7d6c743d
mov dword [ebp - 0x14], 0x8a7f7d84
mov dword [ebp - 0x10], 0x5c388579
mov dword [ebp - 0xc], 0x8c838b7d
mov dword [ebp - 8], 0x8c748887
mov dword [ebp - 4], 0x798c797c
movzx eax, byte [ebp + ecx - 0x24]
mov edx, 0xff
sub ax, 0x18
and ax, dx
mov word [ebp + ecx*2 - 0xc8], ax
inc ecx
cmp ecx, 0x24
jl 0x4176ee
xor eax, eax
mov dword [ebp - 0x20], 0x989889cd
mov word [ebp - 0x80], ax
mov dword [ebp - 0x1c], 0x899c898c
mov dword [ebp - 0x18], 0x8dbcb4cd
mov dword [ebp - 0x14], 0x9a8f8d84
mov dword [ebp - 0x10], 0xacc88589
mov dword [ebp - 0xc], 0x9c839b8d
mov dword [ebp - 8], 0x9cb49887
mov dword [ebp - 4], 0x899c898c
movq xmm1, qword [ebp + eax - 0x20]
movq xmm0, qword [0x429000]
pxor xmm1, xmm0
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
movups xmmword [ebp + eax*2 - 0x78], xmm1
add eax, 8
cmp eax, 0x20
jl 0x41774b
mov dl, byte [0x42b9ec]
xor eax, eax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x28], eax
mov eax, 0x6d47
movzx ecx, dl
or dl, 0xe1
imul ecx, eax
push 0x1000
mov byte [0x42b9ed], dl
mov word [0x42b9bc], cx
call fcn.0040570b
pop ecx
movzx ecx, byte [0x42b9ec]
mov edi, eax
mov eax, 0xbd87
or cx, ax
movzx edx, cx
add edx, 0x1a857d59
mov word [0x42b9bc], cx
mov dword [0x42b9b0], edx
test edi, edi
je 0x4178ea
imul ebx, edx, 0x376c
mov al, dl
and al, 0x97
add al, 0x5c
mov byte [0x42b9ec], al
mov word [0x42b9bc], bx
movzx eax, bl
xor dl, 0x53
imul eax, eax, 0x34
xor ecx, ecx
push 0x800
push edi
push dword [ebp + esi*4 - 0x2c]
mov byte [0x42b9ed], dl
inc ecx
or al, 0x95
mov edx, 0x5060ff33
mov byte [0x42b9b4], al
call fcn.004155a6
call eax
test eax, eax
je 0x4178ab
mov al, byte [0x42b9bc]
xor ecx, ecx
add byte [0x42b9b4], 0xa6
add al, 0xe
push edi
mov edx, 0xeeb55893
mov byte [0x42b9ec], al
inc ecx
call fcn.004155a6
call eax
movzx ecx, byte [0x42b9b4]
mov bx, word [0x42b9bc]
imul ecx, ecx, 0xbc
movzx edx, bx
add edx, 0x124c1a47
mov dword [0x42b9b0], edx
mov byte [0x42b9ed], cl
add cl, 9
mov byte [0x42b9b4], cl
cmp eax, 0xffffffff
je 0x4178b8
test al, 0x10
je 0x4178b8
movzx eax, byte [0x42b9ec]
and bl, 4
and eax, 0x96b513c0
mov byte [0x42b9b4], bl
mov ecx, edi
mov dword [0x42b9b0], eax
call fcn.004178ef
mov bx, word [0x42b9bc]
mov edx, dword [0x42b9b0]
inc esi
cmp esi, 2
jb 0x4177f9
movzx eax, byte [0x42b9b4]
mov ecx, 0x685b
add edx, 0x76efee93
and ax, cx
push edi
mov dword [0x42b9b0], edx
mov word [0x42b9bc], ax
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b04d
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
mov word [ebp - 4], 0x2923
push esi
mov byte [ebp - 2], 0x1d
mov ecx, ebx
mov al, byte [ebp + ecx - 4]
add al, 0x4a
mov byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 3
jl 0x41b063
mov byte [ebp - 5], bl
mov ecx, ebx
mov dword [ebp - 0x14], 0xe6e3edee
mov dword [ebp - 0x10], 0xede1f0e7
mov word [ebp - 0xc], 0xe7e6
mov al, byte [ebp + ecx - 0x14]
xor al, 0x82
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xa
jl 0x41b08c
mov al, byte [0x42ba7c]
lea edx, [ebp - 0x20]
and dword [0x42baa8], 0x492042ca
lea ecx, [ebp - 8]
xor al, 0x17
mov byte [ebp - 0x16], bl
mov byte [0x42ba96], al
call fcn.0041d9c2
imul ecx, dword [0x42ba80], 0xbef618f6
mov esi, eax
mov dword [0x42ba80], ecx
test esi, esi
je 0x41b240
mov al, byte [0x42baa0]
mov ecx, dword [0x42ba7c]
xor al, 0x7f
sub dword [0x42ba78], 0x2249310b
and ecx, 0x18a9ecc3
movzx eax, al
imul eax, eax, 0x59
push edi
mov dword [0x42baa8], ecx
mov byte [0x42ba96], al
lea eax, [ebp - 4]
push eax
push esi
call fcn.00405b40
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0040f780
movzx edx, byte [0x42ba96]
mov edi, eax
pop ecx
lea ecx, [edx + 0x5050cda2]
mov dword [0x42baa8], ecx
test edi, edi
je 0x41b229
mov ecx, dword [0x42ba78]
mov eax, edx
and eax, 0xafe254c6
mov dword [ebp - 0x14], edi
mov dword [0x42ba78], eax
add ecx, 0x6150c0b7
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
imul eax, edx, 0x9e5f0815
push ebx
push ebx
mov dword [0x42ba80], ecx
xor ecx, 0x32dacbf6
mov dword [0x42ba7c], ecx
mov dword [0x42baa0], eax
lea eax, [ebp - 0x14]
push eax
push 0x41b244
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov cl, byte [0x42baa8]
mov ebx, eax
mov edx, dword [0x42ba78]
sub cl, 0x7e
mov byte [0x42ba96], cl
mov ecx, edx
or ecx, 0x85de89b3
mov dword [0x42ba7c], ecx
test ebx, ebx
je 0x41b20b
mov eax, dword [0x42ba80]
sub dl, 0x3d
push 0xffffffffffffffff
add eax, 0x992700a6
mov byte [0x42ba96], dl
push ebx
mov dword [0x42baa0], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x42ba80]
and eax, 0x7bc692b4
mov dword [0x42baa8], eax
add eax, 0x32004941
mov dword [0x42ba80], eax
mov eax, dword [0x42ba78]
xor eax, 0x4b13429e
push ebx
mov dword [0x42baa0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x42ba78]
lea eax, [edx - 0x3475d733]
or edx, 0xa623800a
push edi
mov dword [0x42baa0], eax
mov dword [0x42ba78], edx
call fcn.004056f0
pop ecx
mov eax, dword [0x42ba80]
and eax, 0x94137c99
push esi
mov dword [0x42ba7c], eax
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41bd4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x1c], 0x82747d61
xor ecx, ecx
mov dword [ebp - 0x18], 0x73806f85
mov dword [ebp - 0x14], 0x71775b6a
mov dword [ebp - 0x10], 0x7d817d80
mov dword [ebp - 0xc], 0x5d6a8274
mov dword [ebp - 8], 0x71777474
mov byte [ebp - 4], 0x73
movzx eax, byte [ebp + ecx - 0x1c]
mov edx, 0xff
sub ax, 0xe
and ax, dx
mov word [ebp + ecx*2 - 0x50], ax
inc ecx
cmp ecx, 0x19
jl 0x41bd81
xor eax, eax
lea ecx, [ebp - 0x50]
mov word [ebp - 0x1e], ax
call fcn.0041bdad
leave
ret