joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43eab4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
xor eax, eax
push edi
push 0x1dc76ec6
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call fcn.0043804c
mov dword [ebp - 0x14], eax
mov dword [esp], 0x47d93bee
call fcn.0043804c
pop ecx
push 9
pop ecx
mov esi, 0x460690
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x11
mov ebx, eax
pop ecx
movsw word es:[edi], word [esi]
mov ax, word [ebp + ecx*2 - 0x46]
xor word [ebp + ecx*2 - 0x44], ax
dec ecx
test ecx, ecx
jg 0x43eaf6
mov eax, 0x6256
xor edi, edi
xor word [ebp - 0x44], ax
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call ebx
push 2
pop esi
test eax, eax
jne 0x43ec40
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
shr edx, 1
mov dword [ebp - 0x1c], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, word [ebp - 0xc]
jne 0x43eb39
sub ecx, edi
lea eax, [edx + 1]
sar ecx, 1
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437d3b
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
xor eax, eax
mov dword [ebp - 0x10], edi
push eax
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x43ec31
xor ebx, ebx
mov edx, edi
inc ebx
mov ecx, dword [ebp + 0xc]
mov eax, edx
mov di, word [eax]
cmp di, word [ecx]
mov edi, dword [ebp - 0x10]
jne 0x43ebbe
cmp word [eax], 0
je 0x43ebba
mov di, word [eax + 2]
cmp di, word [ecx + 2]
mov word [ebp - 2], di
mov edi, dword [ebp - 0x10]
jne 0x43ebbe
add eax, 4
add ecx, 4
cmp word [ebp - 2], 0
jne 0x43eb8b
xor eax, eax
jmp 0x43ebc2
sbb eax, eax
or eax, ebx
test eax, eax
je 0x43ec35
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, esi
cmp ax, word [ebp - 0xc]
jne 0x43ebce
sub ecx, dword [ebp - 4]
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, esi
cmp ax, word [ebp - 0xc]
jne 0x43ebec
sub ecx, dword [ebp - 4]
sar ecx, 1
jne 0x43eb86
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
dec eax
push esi
lea eax, [edi + eax*2]
push eax
call fcn.0042abd7
lea eax, [esi + esi]
xor ecx, ecx
push eax
push edi
mov word [eax + edi - 2], cx
xor eax, eax
push 7
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [ebp - 0x14]
test eax, eax
je 0x43ec35
xor eax, eax
mov ebx, eax
push edi
call fcn.00437d44
pop ecx
mov eax, ebx
jmp 0x43eca3
cmp eax, esi
jne 0x43eca1
push 0x64
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.00442ca0
add esp, 0xc
lea eax, [ebp - 0xa8]
push dword [ebp + 0xc]
push 0x32
push eax
call fcn.0042abd7
lea ecx, [ebp - 0xa8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, di
jne 0x43ec70
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 4]
push eax
lea eax, [ebp - 0xa8]
push eax
push 7
push edi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [ebp - 0x14]
test eax, eax
jne 0x43eca1
inc eax
jmp 0x43eca3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43eca8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push esi
push edi
push 0xf
pop edx
mov ecx, edx
lea edi, [ebp - 0xa4]
mov esi, 0x460bb0
rep movsd dword es:[edi], dword [esi]
push 0x1c
pop ecx
mov ax, word [ebp + ecx*2 - 0xa6]
xor word [ebp + ecx*2 - 0xa4], ax
dec ecx
test ecx, ecx
jg 0x43ecc8
push 7
pop ecx
mov esi, 0x460408
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x282c
xor word [ebp - 0xa4], ax
push 0xd
movsw word es:[edi], word [esi]
pop ecx
mov ax, word [ebp + ecx*2 - 0x22]
xor word [ebp + ecx*2 - 0x20], ax
dec ecx
test ecx, ecx
jg 0x43ecfb
push 8
pop ecx
mov esi, str._e_e
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x75e6
xor word [ebp - 0x20], ax
movsw word es:[edi], word [esi]
mov ax, word [ebp + edx*2 - 0x46]
xor word [ebp + edx*2 - 0x44], ax
dec edx
test edx, edx
jg 0x43ed22
push 9
pop ecx
mov esi, 0x460b8c
lea edi, [ebp - 0x68]
mov eax, 0x6576
xor word [ebp - 0x44], ax
rep movsd dword es:[edi], dword [esi]
push 0x10
pop ecx
mov ax, word [ebp + ecx*2 - 0x6a]
xor word [ebp + ecx*2 - 0x68], ax
dec ecx
test ecx, ecx
jg 0x43ed4a
mov esi, dword [ebp + 8]
mov eax, 0x2938
xor word [ebp - 0x68], ax
lea eax, [ebp - 0xa4]
push eax
push esi
call fcn.0043eab4
pop ecx
pop ecx
test eax, eax
je 0x43edad
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0043eab4
pop ecx
pop ecx
test eax, eax
je 0x43edad
lea eax, [ebp - 0x68]
push eax
push esi
call fcn.0043eab4
pop ecx
pop ecx
test eax, eax
je 0x43edad
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.0043eab4
pop ecx
pop ecx
test eax, eax
je 0x43edad
xor eax, eax
inc eax
jmp 0x43edaf
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x43eecc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push edi
xor edi, edi
mov eax, dword [edx + 4]
mov ebx, dword [edx]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], edi
jle 0x43ef23
push esi
inc bl
movzx ebx, bl
mov ecx, dword [edx + ebx*4 + 8]
mov al, cl
add al, byte [ebp - 4]
mov edx, dword [ebp + 8]
movzx eax, al
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 8]
mov dword [edx + ebx*4 + 8], eax
mov dword [edx + esi*4 + 8], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp + 0xc]
mov al, byte [edx + eax*4 + 8]
xor byte [edi + ecx], al
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x43eee5
mov eax, esi
pop esi
pop edi
mov dword [edx], ebx
mov dword [edx + 4], eax
pop ebx
leave
ret
Function at 0x43efcd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
inc ebx
push edi
mov ecx, ebx
mov al, byte [esi]
xor byte [ecx + esi], al
inc ecx
cmp ecx, 0xd
jb 0x43efdb
mov ecx, dword [esi + 5]
test ecx, ecx
je 0x43f004
push 0xfffffffffffffff3
pop edi
lea edx, [esi + 0xd]
sub edi, esi
mov al, byte [esi]
xor byte [edx], al
inc edx
mov ecx, dword [esi + 5]
lea eax, [edi + edx]
cmp eax, ecx
jb 0x43eff5
push ecx
lea edi, [esi + 0xd]
push edi
push dword [esi + 9]
call fcn.004410dc
add esp, 0xc
test al, al
jne 0x43f01f
xor al, al
jmp 0x43f133
mov eax, dword [esi + 1]
sub eax, 0
je 0x43f138
sub eax, 1
je 0x43f110
sub eax, 1
je 0x43f0a3
sub eax, 1
jne 0x43f018
push dword [edi + 4]
call fcn.00437d3b
mov esi, eax
push esi
push edi
call dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
add esp, 0xc
test al, al
jne 0x43f05a
and dword [edi], 0
push dword [esi + 4]
call fcn.00437d3b
mov ebx, dword [ebp + 0xc]
push eax
push esi
mov dword [ebx], eax
call dword [ebp + 0x18]
add esp, 0xc
push 1
test al, al
jne 0x43f08f
push dword [ebx]
call fcn.0043f499
push 1
push esi
call fcn.0043f499
and dword [edi], 0
add esp, 0x10
and dword [ebx], 0
jmp 0x43f018
mov ecx, dword [esi + 4]
push esi
mov dword [edi], ecx
call fcn.0043f499
pop ecx
pop ecx
mov al, 1
jmp 0x43f133
push dword [edi]
call fcn.00437d3b
mov esi, eax
push esi
push edi
call dword [ebp + 0x18]
add esp, 0xc
test al, al
jne 0x43f0cc
push ebx
push esi
call fcn.0043f499
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
and dword [eax], 0
jmp 0x43f018
push dword [esi + 4]
call fcn.00437d3b
mov edi, dword [ebp + 0xc]
push eax
push esi
mov dword [edi], eax
call dword [ebp + 0x14]
add esp, 0xc
test al, al
jne 0x43f0fc
push ebx
push esi
call fcn.0043f499
push ebx
push dword [edi]
call fcn.0043f499
add esp, 0x10
and dword [edi], 0
jmp 0x43f0c1
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 4]
push 8
push esi
mov dword [eax], ecx
call fcn.0043f499
pop ecx
pop ecx
jmp 0x43f131
push dword [edi + 4]
call fcn.00437d3b
mov esi, dword [ebp + 0xc]
push eax
push edi
mov dword [esi], eax
call dword [ebp + 0x18]
add esp, 0xc
test al, al
je 0x43f151
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov dword [eax], ecx
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [edi + 4]
call fcn.00437d3b
mov esi, dword [ebp + 0xc]
push eax
push edi
mov dword [esi], eax
call dword [ebp + 0x14]
add esp, 0xc
test al, al
je 0x43f129
push ebx
push dword [esi]
call fcn.0043f499
mov eax, dword [ebp + 0x10]
and dword [esi], 0
pop ecx
pop ecx
and dword [eax], 0
xor al, al
jmp 0x43f133
Function at 0x43f4e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, ecx
jne 0x43f522
push 5
pop ecx
mov esi, str.t___t______V___m___
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
push 9
pop ecx
movsw word es:[edi], word [esi]
mov ax, word [ebp + ecx*2 - 0x3a]
xor word [ebp + ecx*2 - 0x38], ax
dec ecx
test ecx, ecx
jg 0x43f504
mov eax, 0x6026
xor word [ebp - 0x38], ax
lea eax, [ebp - 0x38]
push eax
jmp 0x43f525
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push eax
call fcn.004380ea
mov esi, eax
lea edi, [ebp - 0x10]
pop ecx
push ebx
push 0x4586d0
movsd dword es:[edi], dword [esi]
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
push edi
push 0x4586c0
call dword [ebp - 0xc]
mov esi, eax
test esi, esi
js 0x43f58c
mov ecx, dword [ebx]
lea edx, [ebx + 4]
push edx
push edi
push edi
mov eax, dword [ecx]
push edi
push edi
push edi
push edi
mov edi, dword [ebp + 8]
push edi
push ecx
call dword [eax + 0xc]
mov esi, eax
test esi, esi
js 0x43f58f
xor eax, eax
push eax
push eax
push 3
push 3
push eax
push eax
push 0xa
push dword [ebx + 4]
call dword [ebp - 4]
mov esi, eax
jmp 0x43f58f
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
jns 0x43f5ba
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x43f5a7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebx]
test ecx, ecx
je 0x43f5b3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [ebx + 4], 0
and dword [ebx], 0
not esi
shr esi, 0x1f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x44039b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], 0x44
push esi
push edi
test ebx, ebx
je 0x4403bf
mov dword [ebx], edx
push 0x1c
pop ecx
lea eax, [ebp - 0x94]
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x4403c8
push 7
mov dword [ebp - 0x18], 0x83c085f
mov edx, 0x831
mov dword [ebp - 0x14], 0x831085d
mov dword [ebp - 0x10], 0x8330843
mov dword [ebp - 0xc], 0x8500850
pop ecx
mov ax, word [ebp + ecx*2 - 0x1a]
xor word [ebp + ecx*2 - 0x18], ax
dec ecx
test ecx, ecx
jg 0x4403f4
xor word [ebp - 0x18], dx
mov eax, 0x38b5
push 0x24
mov dword [ebp - 0x68], 0x38e838d8
mov dword [ebp - 0x64], 0x38bc38d9
mov dword [ebp - 0x60], 0x38e338da
mov dword [ebp - 0x5c], 0x38bb38da
mov dword [ebp - 0x58], 0x38a13896
mov dword [ebp - 0x54], 0x38a638c7
mov dword [ebp - 0x50], 0x38bb3896
mov dword [ebp - 0x4c], 0x38bb388f
mov dword [ebp - 0x48], 0x38ec388f
mov dword [ebp - 0x44], 0x38f838c1
mov dword [ebp - 0x40], 0x38f238cb
mov dword [ebp - 0x3c], 0x38e638cb
mov dword [ebp - 0x38], 0x38ee38d7
mov dword [ebp - 0x34], 0x38ed388c
mov dword [ebp - 0x30], 0x38e138d5
mov dword [ebp - 0x2c], 0x38b63887
mov dword [ebp - 0x28], 0x38e53884
mov dword [ebp - 0x24], 0x38b538d4
mov word [ebp - 0x20], ax
pop ecx
mov ax, word [ebp + ecx*2 - 0x6a]
xor word [ebp + ecx*2 - 0x68], ax
dec ecx
test ecx, ecx
jg 0x440491
mov eax, 0x38ea
xor word [ebp - 0x68], ax
push 0x77078340
call fcn.0043804c
push 0xa739b25d
mov esi, eax
call fcn.0043804c
push 0x2892074
mov dword [ebp - 0x6c], eax
call fcn.0043804c
push 0xea88d766
mov dword [ebp - 0x70], eax
call fcn.0043804c
mov edi, eax
push 0x2a37f52e
mov dword [ebp + 8], edi
call fcn.0043804c
push 0xc6a91d8b
mov dword [ebp - 0x74], eax
call fcn.0043804c
add esp, 0x18
mov dword [ebp - 0x78], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x68]
push eax
call esi
mov esi, eax
test esi, esi
jne 0x4405ad
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [ebp - 0x6c]
mov esi, eax
lea eax, [ebp - 8]
push eax
call dword [ebp - 0x70]
test esi, esi
jne 0x4405ad
push dword [ebp - 0x1c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x4405a7
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push 0x16
call dword [ebp - 0x74]
test eax, eax
je 0x440596
push 3
pop eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x94]
push eax
push esi
push esi
push 0xa
push 6
push esi
push dword [ebp - 4]
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x7c], edi
call dword [ebp - 0x78]
mov esi, eax
test esi, esi
jne 0x44059e
mov eax, dword [ebp - 4]
and dword [ebp - 4], esi
mov dword [ebx], eax
jmp 0x44059e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4405aa
push 8
pop esi
mov edi, dword [ebp + 8]
cmp dword [ebp - 4], 0
je 0x4405b9
lea eax, [ebp - 4]
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4407c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0xd9c80cfb
call fcn.0043804c
mov dword [ebp - 8], eax
mov dword [esp], 0x1db96c46
call fcn.0043804c
push 0x9c7d1073
mov dword [ebp - 0x10], eax
call fcn.0043804c
push 0x5d5bf7c4
mov ebx, eax
call fcn.0043804c
add esp, 0xc
mov dword [ebp - 0xc], eax
mov esi, 0x460ac4
lea edi, [ebp - 0x34]
push 9
pop ecx
push 0x10
rep movsd dword es:[edi], dword [esi]
pop edx
mov ax, word [ebp + edx*2 - 0x36]
xor word [ebp + edx*2 - 0x34], ax
dec edx
test edx, edx
jg 0x440814
push 9
pop ecx
mov esi, str.TU1UcU
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x31b1
xor word [ebp - 0x34], ax
push 0x11
movsw word es:[edi], word [esi]
pop ecx
mov ax, word [ebp + ecx*2 - 0x5e]
xor word [ebp + ecx*2 - 0x5c], ax
dec ecx
test ecx, ecx
jg 0x44083e
mov eax, 0x5507
xor edi, edi
xor word [ebp - 0x5c], ax
inc edi
lea eax, [ebp - 0x34]
push edi
push eax
call fcn.0043a4e5
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.0043a4e5
add esp, 0x10
lea eax, [ebp - 4]
xor esi, esi
mov dword [ebp - 4], esi
push eax
push 0x2000000
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [ebp - 8]
test eax, eax
je 0x4408b1
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2000000
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [ebp - 0xc]
test eax, eax
je 0x4408b1
xor eax, eax
jmp 0x4408e2
push 8
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [ebp - 0x10]
push dword [ebp - 4]
test eax, eax
je 0x4408c7
call ebx
jmp 0x4408ad
call ebx
lea ecx, [ebp - 0x34]
push esi
push ecx
call fcn.0043a4e5
lea ecx, [ebp - 0x5c]
push esi
push ecx
call fcn.0043a4e5
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4408e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
pop ecx
mov esi, 0x460898
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
push 0x10
pop ecx
mov ax, word [ebp + ecx*2 - 0x2e]
xor word [ebp + ecx*2 - 0x2c], ax
dec ecx
test ecx, ecx
jg 0x440900
mov eax, 0x4d81
xor word [ebp - 0x2c], ax
push 0xd9c80cfb
call fcn.0043804c
push 0xea47fbbc
mov esi, eax
call fcn.0043804c
push 0x9c7d1073
mov ebx, eax
call fcn.0043804c
push 0xdedcf066
mov edi, eax
call fcn.0043804c
and dword [ebp - 4], 0
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4409a0
push dword [ebp + 0xc]
call dword [ebp - 8]
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.0043a4e5
pop ecx
pop ecx
test eax, eax
je 0x4409a0
push 1
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4409a7
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0043a4e5
pop ecx
pop ecx
push dword [ebp - 4]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
call edi
lea ecx, [ebp - 0x2c]
push esi
push ecx
call fcn.0043a4e5
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4409a2
Function at 0x4409bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0xdcc68363
call fcn.0043804c
mov dword [ebp - 4], eax
mov dword [esp], 0x175c2821
call fcn.0043804c
push 0xaec1bc34
mov edi, eax
call fcn.0043804c
push 0x9c7d1073
mov dword [ebp - 0x10], eax
call fcn.0043804c
mov dword [ebp - 0x14], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], ebx
push 0x208
mov dword [ebp - 0x20], eax
call fcn.00437d3b
push 0x104
mov esi, eax
push ebx
push esi
call fcn.00442ca0
add esp, 0x1c
push dword [ebp + 8]
push 0x104
push esi
call fcn.0042abd7
push esi
lea eax, [ebp - 0x20]
push eax
call dword [ebp - 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x18]
push eax
push 3
push ebx
push ebx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], ebx
push eax
push 0x22
lea eax, [ebp - 8]
mov dword [ebp - 0x34], 0x40
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call edi
test eax, eax
je 0x440a72
xor eax, eax
jmp 0x440b0e
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x440a78
sub ecx, edx
lea edi, [ebp - 0x64]
sar ecx, 1
mov esi, 0x4603e4
push 9
lea eax, [ecx + ecx]
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x10
mov dword [ebp - 0xc], eax
pop ecx
mov ax, word [ebp + ecx*2 - 0x66]
xor word [ebp + ecx*2 - 0x64], ax
dec ecx
test ecx, ecx
jg 0x440a9d
mov eax, 0x75bf
mov dword [ebp - 0x24], ebx
xor word [ebp - 0x64], ax
xor eax, eax
push 0x208
mov dword [ebp - 0x28], eax
call fcn.00437d3b
mov edi, 0x104
mov esi, eax
push edi
push ebx
push esi
call fcn.00442ca0
add esp, 0x10
lea eax, [ebp - 0x64]
push eax
push edi
push esi
call fcn.0042abd7
push esi
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push dword [ebp + 0xc]
push 6
push ebx
push eax
push dword [ebp - 8]
call dword [ebp - 0x10]
test eax, eax
jne 0x440b06
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call dword [ebp - 0x14]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x441071
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp byte [0x5b1758], 0
push edi
jne 0x4410b2
mov edx, esi
push ebx
push 8
mov edi, edx
pop ebx
mov ecx, edi
mov eax, edi
shr ecx, 1
mov edi, ecx
xor edi, 0xedb88320
and al, 1
cmove edi, ecx
sub ebx, 1
jne 0x441089
mov dword [edx*4 + 0x5b1358], edi
inc edx
cmp edx, 0x100
jb 0x441084
pop ebx
or edx, 0xffffffff
cmp dword [ebp + 0xc], esi
jbe 0x4410d6
mov edi, dword [ebp + 8]
movzx eax, byte [esi + edi]
xor eax, edx
shr edx, 8
movzx ecx, al
xor edx, dword [ecx*4 + 0x5b1358]
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4410bd
pop edi
mov eax, edx
pop esi
pop ebp
ret

Function at 0x44da15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044da20
Function at 0x408908
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov edi, dword [esp]
add esp, 4
dec ecx
add esi, ecx
call fcn.00408945
add ecx, 0xee53335d
sub ecx, ecx
xor dword [ebx], edi
inc ebx
add ecx, 0x5a914a65
cmp ebx, eax
jne fcn.00408908
sub esp, 4
mov dword [esp], ecx
mov esi, dword [esp]
add esp, 4
ret
Function at 0x4024ca
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0046a220
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x24]
cmp eax, 0xa
ja case.default.0x4024f3
jmp dword [eax*4 + 0x40254e]
mov eax, 0x4b4164
leave
ret
mov eax, str.MIPS
leave
ret
mov eax, str.ALPHA
leave
ret
mov eax, 0x4b4184
leave
ret
mov eax, 0x4b418c
leave
ret
mov eax, 0x4b4194
leave
ret
mov eax, str.IA64
leave
ret
mov eax, str.ALPHA64
leave
ret
mov eax, str.MSIL
leave
ret
mov eax, str.AMD64
leave
ret
mov eax, str.IA32_ON_WIN64
leave
ret
mov eax, str.UNKNOWN
leave
ret
Function at 0x40257a
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x2a4
mov eax, 0x49a3f6
call fcn.0045201c
mov esi, 0x114
lea eax, [ebp - 0x158]
push esi
xor edi, edi
push edi
push eax
call fcn.0046a220
add esp, 0xc
mov dword [ebp - 0x158], esi
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40262b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 2
lea ecx, [ebp - 0x2b0]
mov esi, eax
call fcn.004036fd
lea eax, [ebp - 0x2b0]
mov dword [ebp - 4], edi
push str.GetVersionEx_failed__err_
push eax
call fcn.0040508d
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x2b0]
call fcn.00403c13
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.00403825
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
push edi
call fcn.00401235
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.0040204a
lea ecx, [ebp - 0x2b0]
jmp 0x40280a
push 0x24
lea eax, [ebp - 0x17c]
push edi
push eax
call fcn.0046a220
add esp, 0xc
lea eax, [ebp - 0x17c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x154]
push 2
pop esi
cmp eax, 4
jne 0x40266c
cmp dword [ebp - 0x148], 1
jne 0x40277c
xor eax, eax
jmp 0x402812
cmp eax, 5
jne 0x4026b1
mov eax, dword [ebp - 0x150]
test eax, eax
jne 0x402681
inc eax
jmp 0x402812
cmp eax, 1
je 0x4026aa
cmp eax, esi
jne 0x40277c
cmp word [ebp - 0x17c], 9
je 0x4026a2
cmp word [ebp - 0x17c], 6
jne 0x4026aa
push 3
pop eax
jmp 0x402812
mov eax, esi
jmp 0x402812
push 6
pop edx
cmp eax, edx
jne 0x40274e
mov ecx, dword [ebp - 0x150]
test ecx, ecx
jne 0x4026e4
cmp word [ebp - 0x17c], 9
je 0x4026dd
cmp word [ebp - 0x17c], dx
je 0x4026dd
push 5
jmp 0x4026a4
mov eax, edx
jmp 0x402812
cmp ecx, 1
jne 0x402704
cmp word [ebp - 0x17c], 9
je 0x402700
cmp word [ebp - 0x17c], dx
je 0x402700
push 7
jmp 0x4026a4
push 8
jmp 0x4026a4
cmp ecx, esi
jne 0x402728
push 9
pop eax
cmp word [ebp - 0x17c], ax
je 0x402721
cmp word [ebp - 0x17c], dx
jne 0x402812
push 0xa
jmp 0x4026a4
cmp ecx, 3
jne 0x40277c
cmp word [ebp - 0x17c], 9
je 0x402747
cmp word [ebp - 0x17c], dx
je 0x402747
push 0xb
jmp 0x4026a4
push 0xc
jmp 0x4026a4
cmp eax, 0xa
jne 0x40277c
cmp dword [ebp - 0x150], edi
jne 0x40277c
cmp word [ebp - 0x17c], 9
je 0x402775
cmp word [ebp - 0x17c], dx
je 0x402775
push 0xd
jmp 0x4026a4
push 0xe
jmp 0x4026a4
push 1
push esi
lea ecx, [ebp - 0x218]
call fcn.004036fd
lea eax, [ebp - 0x218]
mov dword [ebp - 4], esi
push str.Unknown_version:_major
push eax
call fcn.0040508d
pop ecx
pop ecx
push dword [ebp - 0x154]
lea ecx, [ebp - 0x218]
call fcn.00403c13
lea eax, [ebp - 0x218]
push str.__minor
push eax
call fcn.0040508d
pop ecx
pop ecx
push dword [ebp - 0x150]
lea ecx, [ebp - 0x218]
call fcn.00403c13
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x214]
call fcn.00403825
mov byte [ebp - 4], 3
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
push edi
call fcn.00401235
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0040204a
lea ecx, [ebp - 0x218]
call fcn.0040247e
or eax, 0xffffffff
call fcn.00451fc5
ret