joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bfad
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x8815d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
cmp dword [esi + 0xc], 0
jle 0x491777
push 2
push 0
push dword [esi + 8]
call fcn.0043bf51
add esp, 0xc
test eax, eax
je 0x491777
cmp dword [0x882038], 2
jl 0x491777
push str.Failed_to_seek_on_output_file_n
push dword [0x885eec]
push 2
call fcn.0047e100
add esp, 0xc
mov dword [ebp - 4], 0
nop
push 8
mov byte [esi + 0x1c], 0
call fcn.00432cea
add esp, 4
test eax, eax
je 0x49179c
mov dword [eax], esi
mov dword [eax + 4], 0x490b10
jmp 0x49179e
xor eax, eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x486460
push 0
push 0
call fcn.004383d1
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x48], ecx
test ecx, ecx
je 0x491820
cmp dword [esi + 0x24], 0
jne 0x49181b
mov eax, dword [ebp - 0x44]
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00432bfc
mov esp, ebp
pop ebp
ret
call fcn.004386e8
push 6
mov dword [ebp - 0x44], 0
call fcn.0042ea34
int3
Function at 0x491e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
mov edi, dword [esp + 8]
push str.NONE
push edi
call fcn.00484600
add esp, 8
test eax, eax
jne 0x491ebd
push eax
push dword [esp + 0x10]
call fcn.00491db0
add esp, 8
cmp dword [0x882038], 3
jl 0x492003
push str.NONE
push str.Loading_reverb__s_n
push dword [0x885eec]
push 3
call fcn.0047e100
add esp, 0x10
pop edi
ret
cmp byte [0x886158], 0
jne 0x491ecd
mov eax, 0x8000
jmp 0x491ed8
xor eax, eax
cmp byte [0x886159], al
sete al
push ebx
mov ebx, dword [esp + 0x10]
push esi
push eax
push ebx
call fcn.00491db0
add esp, 8
mov esi, str.GENERIC
nop dword [eax]
push esi
push edi
call fcn.00484600
add esp, 8
test eax, eax
je 0x491f33
add esi, 0x8c
cmp esi, 0x5b77dc
jne 0x491ef0
cmp dword [0x882038], 2
jl 0x492001
push edi
push str.Reverb_preset__s_not_found_n
push dword [0x885eec]
push 2
call fcn.0047e100
add esp, 0x10
pop esi
pop ebx
pop edi
ret
cmp dword [0x882038], 3
jl 0x491f52
push esi
push str.Loading_reverb__s_n
push dword [0x885eec]
push 3
call fcn.0047e100
add esp, 0x10
mov eax, dword [esi + 0x20]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x4c]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x60]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x64]
mov dword [ebx + 0x48], eax
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x4c], eax
mov eax, dword [esi + 0x6c]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x78]
mov dword [ebx + 0x5c], eax
mov eax, dword [esi + 0x7c]
mov dword [ebx + 0x60], eax
mov eax, dword [esi + 0x80]
mov dword [ebx + 0x64], eax
mov eax, dword [esi + 0x84]
mov dword [ebx + 0x68], eax
cmp dword [esi + 0x88], 0
setne al
mov byte [ebx + 0x6c], al
pop esi
pop ebx
pop edi
ret
Function at 0x49ae10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50cacd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x8815d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 8
mov dword [ebp - 4], 0
call fcn.00432cea
mov esi, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x49ae5e
mov dword [eax], esi
mov dword [eax + 4], 0x49a900
jmp 0x49ae60
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x487730
push 0
push 0
call fcn.004383d1
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x49af0c
cmp dword [esi + 0xe0], 0
jne 0x49af07
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0xdc], ecx
mov dword [esi + 0xe0], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004386e8
push 6
mov dword [ebp - 0x1c], 0
call fcn.0042ea34
int3
Function at 0x4b1ca0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x34]
movss xmm6, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push edi
mov dword [esp + 0x18], eax
xor edi, edi
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4b1dd9
movss xmm7, dword [esp + 0x34]
push esi
nop dword [eax + eax]
mov ecx, dword [esp + 0x28]
lea esi, [edi*4 + 0x800]
and edx, ecx
sub eax, edi
sub ecx, edx
inc ecx
cmp ecx, eax
cmova ecx, eax
mov eax, edx
shl eax, 4
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
movaps xmm0, xmm6
inc edi
inc edx
movss xmm5, dword [esi + eax - 0x800]
movss xmm3, dword [esi + eax - 0x400]
mov eax, dword [esp + 0x3c]
movss xmm4, dword [esi + eax]
mov eax, dword [esp + 0x1c]
movaps xmm1, xmm4
subss xmm1, xmm3
movss xmm2, dword [esi + eax + 0x400]
add esi, 4
mulss xmm0, xmm2
mov eax, dword [esp + 0x2c]
addss xmm1, xmm5
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x20]
add dword [esp + 0x20], 0x10
mulss xmm1, xmm7
addss xmm1, xmm0
movaps xmm0, xmm6
mulss xmm0, xmm4
movss dword [esp + 8], xmm1
movaps xmm1, xmm3
subss xmm1, xmm2
addss xmm1, xmm5
mulss xmm1, xmm7
addss xmm1, xmm0
movaps xmm0, xmm6
mulss xmm0, xmm3
movss dword [esp + 0xc], xmm1
movaps xmm1, xmm2
subss xmm1, xmm4
xorps xmm4, xmmword [0x511aa0]
subss xmm4, xmm2
addss xmm1, xmm5
subss xmm4, xmm3
mulss xmm1, xmm7
mulss xmm4, xmm7
addss xmm1, xmm0
movaps xmm0, xmm6
mulss xmm0, xmm5
movss dword [esp + 0x10], xmm1
addss xmm4, xmm0
movss dword [esp + 0x14], xmm4
movups xmm0, xmmword [esp + 8]
movups xmmword [esi + eax], xmm0
mov esi, dword [esp + 0x18]
sub ecx, 1
jne 0x4b1cf0
mov eax, dword [esp + 0x40]
cmp edi, eax
jb 0x4b1cd0
pop esi
pop edi
add esp, 0x1c
ret
Function at 0x4b7e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d286
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x8815d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x4b7ed3
mov esi, edi
shr esi, 1
or esi, edi
mov eax, esi
shr eax, 2
or esi, eax
mov eax, esi
shr eax, 4
or esi, eax
mov eax, esi
shr eax, 8
or esi, eax
mov eax, esi
shr eax, 0x10
or esi, eax
mov dword [ebp + 0xc], esi
inc esi
cmp esi, edi
jbe 0x4b7f94
mov ecx, dword [ebp + 0x10]
or eax, 0xffffffff
xor edx, edx
div ecx
cmp esi, eax
ja 0x4b7f94
imul esi, ecx
mov ecx, 0x20
mov dword [ebp - 0x14], esi
lea eax, [esi + 0x10]
cmp eax, ecx
cmovb eax, ecx
add eax, ecx
mov ecx, 0x40
cmp eax, ecx
cmovb eax, ecx
push eax
push 0x10
call fcn.0047a160
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4b7faf
mov dword [ebp - 0x18], ebx
mov dword [ebx], 0
lea eax, [ebx + 0x30]
mov dword [ebx + 4], 0
push esi
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov dword [ebx + 0x20], esi
call fcn.004b7e60
mov eax, dword [ebp + 8]
add esp, 8
mov edx, dword [ebp + 0xc]
mov ecx, edx
cmp dword [ebp + 0x14], 0
mov dword [eax], ebx
cmovne ecx, edi
mov dword [ebx + 8], ecx
mov ecx, dword [eax]
mov dword [ecx + 0xc], edx
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x10], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Ring_buffer_size_overflow
lea ecx, [ebp - 0x30]
call fcn.0042eb80
push 0x876ce8
lea eax, [ebp - 0x30]
push eax
call fcn.00434778
lea ecx, [ebp - 0x24]
call fcn.0042ea92
push 0x876c38
lea eax, [ebp - 0x24]
push eax
call fcn.00434778
int3

Function at 0x4cf010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
lea edx, [eax*4]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], edx
lea esi, [ecx + 0x7d0]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], eax
push edi
lea edi, [ecx + 0x10]
cmp ebx, eax
je 0x4cf0b8
mov ebp, dword [edi]
cmp ebp, 0xffffffff
je 0x4cf0ab
push esi
lea eax, [edx + ebx]
push eax
push ebx
lea eax, [edi + 0x20]
push eax
lea ecx, [edi + 4]
call fcn.004b9c40
mov eax, dword [esp + 0x14]
lea ecx, [edi + 0x3c]
sar eax, 2
lea esi, [esi + eax*4]
mov eax, dword [esp + 0x10]
push eax
push esi
push eax
lea eax, [edi + 0x58]
push eax
call fcn.004b9c40
push dword [esp + 0x20]
movss xmm0, dword [edi + 0x78]
lea eax, [edi + 0x74]
push ecx
movss dword [esp], xmm0
push eax
shl ebp, 0xc
add ebp, dword [esp + 0x38]
push ebp
push esi
mov esi, dword [esp + 0x24]
push esi
call dword [0x882334]
mov eax, dword [esp + 0x30]
add esp, 0x18
mov edx, dword [esp + 0x14]
add ebx, 0x1000
add edi, 0x7c
cmp ebx, eax
jne 0x4cf043
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
Function at 0x4ed450
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.004ee680
mov edi, dword [esi + 0x14]
add esp, 4
test edi, edi
je 0x4ed4d1
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov ecx, dword [edx + eax*8]
mov eax, dword [edx + eax*8 + 4]
mov edx, dword [esi + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp edx, edi
jae 0x4ed4d1
push ebx
mov ebx, dword [esi + 0x18]
nop dword [eax + eax]
movq xmm1, qword [esp + 0xc]
mov eax, 0x38
sub eax, edx
add edx, 8
movd xmm0, eax
psrlq xmm1, xmm0
movd eax, xmm1
movzx ecx, al
mov eax, ebx
shr eax, 8
xor ecx, eax
movzx ebx, bl
shl ebx, 8
movzx ecx, word [ecx*2 + 0x5ea9d8]
xor ebx, ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x18], ebx
cmp edx, edi
jb 0x4ed490
pop ebx
mov ax, word [esi + 0x18]
pop edi
pop esi
add esp, 8
ret

Function at 0x4ee760
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
cmp edi, 8
jb 0x4ee800
push ebx
mov ebx, edi
shr ebx, 3
nop dword [eax + eax]
movzx edx, byte [esi]
sub edi, 8
movzx ecx, byte [esi + 1]
movzx eax, ax
shl edx, 8
or edx, ecx
xor edx, eax
movzx eax, byte [esi + 6]
mov ecx, edx
shr ecx, 8
mov cx, word [ecx*2 + 0x5eb7d8]
xor cx, word [eax*2 + 0x5eabd8]
movzx eax, byte [esi + 5]
xor cx, word [eax*2 + 0x5eadd8]
movzx eax, byte [esi + 4]
xor cx, word [eax*2 + 0x5eafd8]
movzx eax, byte [esi + 3]
xor cx, word [eax*2 + 0x5eb1d8]
movzx eax, byte [esi + 7]
xor cx, word [eax*2 + 0x5ea9d8]
movzx eax, byte [esi + 2]
add esi, 8
xor cx, word [eax*2 + 0x5eb3d8]
movzx eax, dl
xor cx, word [eax*2 + 0x5eb5d8]
movzx eax, cx
sub ebx, 1
jne 0x4ee780
pop ebx
test edi, edi
je 0x4ee825
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, ax
shr edx, 8
xor edx, ecx
shl eax, 8
xor ax, word [edx*2 + 0x5ea9d8]
movzx eax, ax
sub edi, 1
jne 0x4ee804
pop edi
pop esi
ret

Function at 0x4ee830
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4ee8d4
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x10]
add ecx, 2
push ebx
push esi
nop word [eax + eax]
mov edx, dword [ecx + 2]
lea ecx, [ecx + 8]
movzx eax, ax
mov ebx, dword [ecx - 0xa]
shr edx, 0x10
xor edx, eax
movzx eax, byte [ecx - 9]
mov dword [esp + 0x18], edx
movzx edx, byte [ecx - 7]
mov si, word [eax*2 + 0x5eabd8]
movzx eax, byte [ecx - 6]
xor si, word [edx*2 + 0x5eafd8]
mov edx, dword [esp + 0x18]
xor si, word [eax*2 + 0x5eb1d8]
movzx eax, byte [ecx - 5]
xor si, word [eax*2 + 0x5eb3d8]
mov eax, edx
shr eax, 8
xor si, word [eax*2 + 0x5eb7d8]
movzx eax, bl
xor si, word [eax*2 + 0x5ea9d8]
movzx eax, dl
xor si, word [eax*2 + 0x5eb5d8]
movzx eax, byte [ecx - 8]
xor si, word [eax*2 + 0x5eadd8]
movzx eax, si
sub edi, 1
jne 0x4ee850
pop esi
pop ebx
pop edi
ret
mov ax, word [esp + 0x10]
pop edi
ret
Function at 0x4ee8e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
test edx, edx
je 0x4ee907
push esi
mov esi, dword [esp + 8]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [ecx + 0x5eb9d8]
sub edx, 1
jne 0x4ee8f0
pop esi
ret
Function at 0x4f5720
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
xor ecx, ecx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x4f57a6
cmp ebx, 8
jb 0x4f57a6
cmp dword [0x885410], 2
jl 0x4f57a6
mov eax, ebx
xorps xmm2, xmm2
and eax, 0xfffffff8
xorps xmm1, xmm1
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [esi + ecx*4]
pabsd xmm0, xmm0
paddd xmm2, xmm0
movups xmm0, xmmword [esi + ecx*4 + 0x10]
add ecx, 8
pabsd xmm0, xmm0
paddd xmm1, xmm0
cmp ecx, eax
jb 0x4f5760
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd edi, xmm1
mov dword [esp + 0x10], edi
xor ebp, ebp
mov dword [esp + 0x14], ebp
cmp ecx, ebx
jae 0x4f57fe
mov eax, ebx
sub eax, ecx
cmp eax, 2
jb 0x4f57ec
lea eax, [ebx - 1]
xor ebx, ebx
mov edi, eax
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [esi + ecx*4 + 4]
cdq
add ecx, 2
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, ecx
cmp ecx, edi
jb 0x4f57c0
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], ebx
cmp eax, dword [esp + 0x24]
jae 0x4f57f6
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov ecx, dword [esp + 0x14]
add ecx, ebp
add edi, ecx
mov eax, 1
test edi, edi
cmove edi, eax
mov eax, edi
cdq
push edx
push eax
call fcn.004fe210
add esp, 8
add eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4f5830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 0x10], ebx
test edi, edi
je 0x4f58b6
cmp edi, 8
jb 0x4f58b6
cmp dword [0x885410], 2
jl 0x4f58b6
mov eax, edi
xorps xmm2, xmm2
and eax, 0xfffffff8
xorps xmm1, xmm1
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [esi + ecx*4]
pabsd xmm0, xmm0
paddd xmm2, xmm0
movups xmm0, xmmword [esi + ecx*4 + 0x10]
add ecx, 8
pabsd xmm0, xmm0
paddd xmm1, xmm0
cmp ecx, eax
jb 0x4f5870
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ebx, xmm1
mov dword [esp + 0x10], ebx
xor ebp, ebp
mov dword [esp + 0x14], ebp
cmp ecx, edi
jae 0x4f590e
mov eax, edi
sub eax, ecx
cmp eax, 2
jb 0x4f58fc
lea eax, [edi - 1]
xor edi, edi
mov ebx, eax
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [esi + ecx*4 + 4]
cdq
add ecx, 2
xor eax, edx
sub eax, edx
add edi, eax
mov eax, ecx
cmp ecx, ebx
jb 0x4f58d0
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x14], edi
cmp eax, dword [esp + 0x24]
jae 0x4f5906
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov ecx, dword [esp + 0x14]
add ecx, ebp
add ebx, ecx
mov eax, 1
test ebx, ebx
cmove ebx, eax
mov eax, ebx
cdq
push edx
push eax
call fcn.004fe210
mov ebx, dword [esp + 0x24]
add esp, 8
mov edx, ebx
sub edx, dword [esp + 0x28]
add edx, eax
pop edi
pop esi
cmp ebx, edx
lea ecx, [ebx + 1]
lea eax, [edx + 1]
pop ebp
cmovg eax, ecx
pop ebx
add esp, 8
ret
Function at 0x4fe420
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
jl 0x4fe4d5
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [esp + 0x10]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x5ee1a0]
xor edx, dword [ecx*4 + 0x5edda0]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x5ee5a0]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x5ecda0]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x5ed1a0]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x5ec9a0]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x5ed5a0]
xor edx, dword [eax*4 + 0x5ed9a0]
mov eax, edx
sub ebx, 1
jne 0x4fe444
pop ebx
jmp 0x4fe4d9
mov eax, dword [esp + 0xc]
test edi, edi
je 0x4fe4fc
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x5ec9a0]
sub edi, 1
jne 0x4fe4e0
pop edi
pop esi
ret

Function at 0x500bf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x500c1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x500c1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x505917
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x8815d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x50595a
call fcn.00438aad
mov dword [eax], 0xf
call fcn.00438ac0
mov dword [eax], 0xd
call fcn.00438687
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00432bfc
leave
ret
test eax, eax
jne 0x505961
inc eax
jmp 0x50594e
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x50594c
xor eax, eax
cmp ecx, 1
setne al
jmp 0x50594e
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x3fbc09b0
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
mov eax, section..didat
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x11da10ab
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 0xffffff90
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x408c20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44df72
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4671f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 2
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x408cef
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
push ecx
mov ecx, eax
call fcn.004097e0
cmp dword [eax + 0x14], 8
jb 0x408c8b
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x408cb4
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00405020
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x34], vtable.CefStringBase_struct_CefStringTraitsUTF16_.0
test eax, eax
je 0x408cef
cmp byte [ebp - 0x2c], 0
je 0x408cef
push eax
call sub.libcef.dll_cef_string_utf16_clear
push 0xc
push dword [ebp - 0x30]
call fcn.00434014
add esp, 0xc
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 4
test eax, eax
je 0x408d0a
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 5
test eax, eax
je 0x408d25
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 6
test eax, eax
je 0x408d43
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004344cb
mov esp, ebp
pop ebp
ret 0xc