joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dd8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x44df6e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x44ddd6
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0044d85c
mov eax, dword [ebp - 0x204]
mov edx, ebx
call fcn.0040c318
cmp al, 1
jne 0x44ddd6
dec ebx
mov edi, ebx
mov eax, esi
call fcn.0044db70
test al, al
je 0x44df0e
test edi, edi
jge 0x44dded
xor edi, edi
lea ebx, [edi + 1]
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0044d85c
mov eax, dword [ebp - 0x204]
call fcn.00403da4
cmp ebx, eax
jge 0x44de34
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0044d85c
mov eax, dword [ebp - 0x204]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x48f100]
and eax, 0xff
bt dword [edx], eax
jae 0x44de34
inc ebx
mov eax, dword [esi + 0x20c]
cmp edi, eax
jl 0x44de42
mov edi, eax
mov ebx, edi
mov ecx, ebx
mov edx, ebx
mov eax, esi
call fcn.0044dd68
cmp ebx, edi
je 0x44df06
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x44de6c
mov byte [ebp - 0x1f0], 0x81
mov eax, esi
mov bx, 0xffcf
call fcn.00403110
and eax, 0x7f
movzx eax, word [eax*2 + 0x48db30]
mov byte [ebp + eax - 0x200], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
mov eax, esi
mov bx, 0xffcf
call fcn.00403110
and eax, 0x7f
movzx eax, word [eax*2 + 0x48db30]
push eax
push pe_nt_image_headers32
mov eax, esi
call fcn.00431b64
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, esi
mov bx, 0xffcf
call fcn.00403110
and eax, 0x7f
movzx eax, word [eax*2 + 0x48db30]
push eax
push 0x101
mov eax, esi
call fcn.00431b64
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [esi + 0x214], edi
jmp 0x44df55
test edi, edi
jge 0x44df14
xor edi, edi
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0044d85c
mov eax, dword [ebp - 0x204]
call fcn.00403da4
cmp edi, eax
jl 0x44df4a
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0044d85c
mov eax, dword [ebp - 0x204]
call fcn.00403da4
mov edi, eax
mov ecx, edi
mov edx, edi
mov eax, esi
call fcn.0044dd68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44df75
lea eax, [ebp - 0x204]
call fcn.00403b28
ret

Function at 0x44e14c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x44e187
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x44e16e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x44e17f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x44e189
inc edi
add eax, 0x28
cmp edi, esi
jb 0x44e164
xor eax, eax
pop edi
pop esi
ret
Function at 0x44f030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
das
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
Function at 0x401d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x507040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push edi
call fcn.0044ac6c
lea ecx, [ebp - 0x434]
push ecx
push eax
call fcn.0044306b
add esp, 0xc
test eax, eax
jne 0x401db6
mov eax, dword [ebp - 0x42e]
and eax, 0xf000
cmp eax, 0x8000
jne 0x401db6
push 1
push esi
push edi
call fcn.0044211b
add esp, 0xc
test eax, eax
je 0x401de2
test esi, esi
je 0x401de2
mov ebx, 0x400
nop
cmp esi, ebx
mov eax, esi
push edi
cmova eax, ebx
push eax
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.004424e9
add esp, 0x10
test eax, eax
je 0x401df8
sub esi, eax
jne 0x401dc0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret

Function at 0x401e10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x507040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
mov edi, ecx
mov ebx, edx
push edi
push 8
push 1
push eax
call fcn.004424e9
add esp, 0x10
cmp eax, 8
jb 0x401eae
lea eax, [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [ebx]
movzx eax, byte [ebp - 6]
je 0x401ed9
movzx edx, byte [ebp - 5]
mov ecx, edi
shl edx, 8
or edx, eax
movzx eax, byte [ebp - 7]
shl edx, 8
or edx, eax
movzx eax, byte [ebp - 8]
shl edx, 8
or edx, eax
mov dword [esi], edx
call fcn.00401d60
test eax, eax
je 0x401ec6
push dword [esi]
lea eax, [ebp - 0xc]
mov byte [ebp - 8], 0
push eax
push str.Skipping_chunk_of_type___s___length__d_n
push 2
call fcn.0043f858
add esp, 4
push eax
call fcn.00401040
push edi
push 8
lea eax, [ebp - 0xc]
push 1
push eax
call fcn.004424e9
add esp, 0x20
cmp eax, 8
jae 0x401e40
push str.Warning:_Unexpected_EOF_in_reading_WAV_header_n
push 2
call fcn.0043f858
add esp, 4
push eax
call fcn.00401040
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebp - 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 8]
shl ecx, 8
or ecx, eax
mov eax, 1
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
Function at 0x401f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x507040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], edx
mov esi, ecx
xor edi, edi
nop dword [eax]
push esi
push 8
lea eax, [ebp - 0xc]
push 1
push eax
call fcn.004424e9
add esp, 0x10
cmp eax, 8
jae 0x401f5e
test edi, edi
jne 0x401faf
push 0
push 0xc
push esi
mov edi, 1
call fcn.0044211b
add esp, 0xc
jmp 0x401f30
movzx edx, byte [ebp - 8]
movzx eax, byte [ebp - 7]
mov ecx, dword [ebp - 0x10]
shl edx, 8
or edx, eax
movzx eax, byte [ebp - 6]
shl edx, 8
or edx, eax
movzx eax, byte [ebp - 5]
shl edx, 8
or edx, eax
lea eax, [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebx], edx
cmp eax, dword [ecx]
je 0x401fda
test dl, 1
je 0x401f93
inc edx
mov dword [ebx], edx
mov ecx, esi
call fcn.00401d60
test eax, eax
jne 0x401f30
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
push str.Warning:_Unexpected_EOF_in_AIFF_chunk_n
push 2
call fcn.0043f858
add esp, 4
push eax
call fcn.00401040
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
Function at 0x40a3c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x507040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x250], edx
push esi
mov esi, ebx
mov dword [ebp - 0x24c], ebx
push edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x40a3f0
sub esi, ecx
lea eax, [esi + 1]
push eax
call fcn.004418e9
mov ecx, ebx
add esp, 4
mov edi, eax
mov esi, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a410
sub ecx, edx
cmp ecx, 3
jb 0x40a437
movsx eax, byte [ebx]
push eax
call fcn.0044a99b
add esp, 4
test eax, eax
je 0x40a437
cmp byte [ebx + 1], 0x3a
jne 0x40a437
lea esi, [ebx + 2]
lea eax, [esi + 1]
push 0x4fd228
push eax
call fcn.0044a8b0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40a53e
mov eax, dword [ebp - 0x24c]
mov esi, ebx
sub esi, eax
push esi
push eax
push edi
call fcn.0043f210
add esp, 0xc
mov byte [esi + edi], 0
cmp dword [ebp - 0x250], 0
je 0x40a4a5
push 0x105
lea eax, [ebp - 0x218]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004430d6
jmp 0x40a4b2
lea eax, [ebp - 0x248]
push eax
push edi
call fcn.00443076
add esp, 8
test eax, eax
je 0x40a517
call fcn.00449231
cmp dword [eax], 2
jne 0x40a55a
push edi
call fcn.0044ac92
add esp, 4
test eax, eax
je 0x40a523
call fcn.00449231
push dword [eax]
call fcn.004426ba
add esp, 4
push eax
push edi
push str.Couldnt_create_directory___s_:__s_n
push 2
call fcn.0043f858
add esp, 4
push eax
call fcn.00401040
push edi
call fcn.004418e4
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
test dword [ebp - 0x242], 0x4000
je 0x40a575
lea eax, [ebx + 2]
push 0x4fd228
push eax
call fcn.0044a8b0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40a452
push edi
call fcn.004418e4
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
call fcn.00449231
push dword [eax]
call fcn.004426ba
add esp, 4
push eax
push edi
push str.Error_checking_for_existence_of_directory__s:__s_n
jmp 0x40a4ea
push edi
push str.Error:_path_segment___s__is_not_a_directory_n
push 2
call fcn.0043f858
add esp, 4
push eax
call fcn.00401040
add esp, 0xc
push edi
call fcn.004418e4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
or eax, 0xffffffff
pop edi
pop esi
pop ebx
call fcn.0043d9c9
mov esp, ebp
pop ebp
ret
Function at 0x40a5f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, edx
mov eax, ecx
push ecx
push 1
lea edx, [ebp - 0x18]
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
call fcn.00421750
add esp, 8
test eax, eax
je 0x40a659
mov ebx, dword [ebp - 0x14]
push esi
push ebx
push 1
push dword [ebp - 0x18]
call fcn.00443500
push esi
mov esi, dword [ebp - 0xc]
mov edi, eax
push esi
push 1
push dword [ebp - 0x10]
call fcn.00443500
add eax, edi
lea ecx, [esi + ebx]
add esp, 0x20
cmp eax, ecx
jne 0x40a662
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x18]
push 1
call fcn.00421750
mov esi, dword [ebp - 8]
add esp, 8
test eax, eax
jne 0x40a615
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41eb50
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov esi, edx
mov edi, ecx
mov edx, 2
mov dword [ebp - 4], edx
cmp edi, 8
jle 0x41ebc2
push dword [ebx + 8]
mov edx, esi
call fcn.0041ed40
add esp, 4
mov edx, 8
mov dword [ebp - 4], edx
cmp edi, 0x20
jle 0x41ebc2
mov dword [ebp - 4], 0x20
nop dword [eax]
push dword [ebx + 8]
mov ecx, edi
push esi
call fcn.0041f200
mov edx, dword [ebp - 4]
add esp, 8
lea eax, [edx*4]
mov dword [ebp - 4], eax
cmp eax, edi
jl 0x41eba0
mov dword [ebp - 4], edx
lea eax, [edx*4]
cmp eax, edi
jne 0x41ecc4
xor ecx, ecx
test edx, edx
jle 0x41ed28
lea eax, [edx + edx*2]
lea edi, [esi + eax*8]
lea eax, [esi + edx*8]
mov dword [ebp - 0xc], eax
mov eax, edx
shl eax, 4
add eax, esi
nop
mov edx, dword [ebp - 0xc]
movsd xmm3, qword [esi + ecx*8]
movsd xmm6, qword [eax]
movsd xmm5, qword [esi + ecx*8 + 8]
movsd xmm7, qword [edx]
movsd xmm2, qword [edx + 8]
addsd xmm7, xmm3
subsd xmm3, qword [edx]
xorps xmm5, xmmword [0x4fe020]
movsd xmm4, qword [eax + 8]
subsd xmm5, xmm2
subsd xmm2, qword [esi + ecx*8 + 8]
movsd qword [ebp - 0x10], xmm3
movaps xmm3, xmm6
addsd xmm3, qword [edi]
subsd xmm6, qword [edi]
movsd qword [ebp - 0x18], xmm2
movaps xmm2, xmm4
addsd xmm2, qword [edi + 8]
subsd xmm4, qword [edi + 8]
movaps xmm0, xmm3
addsd xmm0, xmm7
subsd xmm7, xmm3
movsd qword [esi + ecx*8], xmm0
movaps xmm0, xmm5
subsd xmm0, xmm2
addsd xmm2, xmm5
movsd qword [esi + ecx*8 + 8], xmm0
add ecx, 2
movsd xmm0, qword [ebp - 0x10]
subsd xmm0, xmm4
movsd qword [eax], xmm7
addsd xmm4, qword [ebp - 0x10]
movsd qword [eax + 8], xmm2
add eax, 0x10
movsd qword [edx], xmm0
movsd xmm0, qword [ebp - 0x18]
subsd xmm0, xmm6
addsd xmm6, qword [ebp - 0x18]
movsd qword [edx + 8], xmm0
add edx, 0x10
movsd qword [edi], xmm4
movsd qword [edi + 8], xmm6
add edi, 0x10
mov dword [ebp - 0xc], edx
cmp ecx, dword [ebp - 4]
jl 0x41ebf0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
test edx, edx
jle 0x41ed28
movsd xmm5, qword [0x4fe020]
lea ecx, [esi + 8]
lea ecx, [ecx + edx*8]
nop dword [eax + eax]
movsd xmm3, qword [ecx - 8]
movsd xmm4, qword [esi + eax*8]
movaps xmm0, xmm3
movsd xmm1, qword [esi + eax*8 + 8]
addsd xmm0, xmm4
movsd xmm2, qword [ecx]
subsd xmm4, xmm3
subsd xmm2, xmm1
xorps xmm1, xmm5
movsd qword [esi + eax*8], xmm0
subsd xmm1, qword [ecx]
movsd qword [esi + eax*8 + 8], xmm1
add eax, 2
movsd qword [ecx - 8], xmm4
movsd qword [ecx], xmm2
add ecx, 0x10
cmp eax, edx
jl 0x41ece0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x420140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, edx
mov edi, ecx
mov edx, 2
mov dword [ebp - 4], edx
cmp edi, 8
jle 0x4201a2
push dword [ebp + 8]
mov edx, esi
call fcn.00420310
add esp, 4
mov edx, 8
mov dword [ebp - 4], edx
cmp edi, 0x20
jle 0x4201a2
mov dword [ebp - 4], 0x20
nop word [eax + eax]
push dword [ebp + 8]
mov ecx, edi
push esi
call fcn.004207d0
mov edx, dword [ebp - 4]
add esp, 8
lea eax, [edx*4]
mov dword [ebp - 4], eax
cmp eax, edi
jl 0x420180
mov dword [ebp - 4], edx
lea eax, [edx*4]
cmp eax, edi
jne 0x4202a1
xor ecx, ecx
test edx, edx
jle 0x420308
lea eax, [edx + edx*2]
lea eax, [esi + eax*4]
mov dword [ebp - 0xc], eax
lea edi, [esi + edx*4]
lea eax, [esi + edx*8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
movss xmm3, dword [esi + ecx*4]
movss xmm7, dword [edi]
mov edx, dword [ebp - 8]
addss xmm7, xmm3
subss xmm3, dword [edi]
movss xmm5, dword [esi + ecx*4 + 4]
movss xmm2, dword [edi + 4]
movss xmm6, dword [edx]
xorps xmm5, xmmword [0x4fe030]
movss xmm4, dword [edx + 4]
subss xmm5, xmm2
subss xmm2, dword [esi + ecx*4 + 4]
movss dword [ebp - 0xc], xmm3
movaps xmm3, xmm6
addss xmm3, dword [eax]
subss xmm6, dword [eax]
movss dword [ebp - 0x10], xmm2
movaps xmm2, xmm4
addss xmm2, dword [eax + 4]
subss xmm4, dword [eax + 4]
movaps xmm0, xmm3
addss xmm0, xmm7
subss xmm7, xmm3
movss dword [esi + ecx*4], xmm0
movaps xmm0, xmm5
subss xmm0, xmm2
addss xmm2, xmm5
movss dword [esi + ecx*4 + 4], xmm0
add ecx, 2
movss xmm0, dword [ebp - 0xc]
subss xmm0, xmm4
movss dword [edx], xmm7
addss xmm4, dword [ebp - 0xc]
movss dword [edx + 4], xmm2
add edx, 8
mov dword [ebp - 8], edx
movss dword [edi], xmm0
movss xmm0, dword [ebp - 0x10]
subss xmm0, xmm6
addss xmm6, dword [ebp - 0x10]
movss dword [edi + 4], xmm0
add edi, 8
movss dword [eax], xmm4
movss dword [eax + 4], xmm6
add eax, 8
cmp ecx, dword [ebp - 4]
jl 0x4201d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
test edx, edx
jle 0x420308
movss xmm5, dword [0x4fe030]
lea ecx, [esi + 4]
lea ecx, [ecx + edx*4]
nop word [eax + eax]
movss xmm3, dword [ecx - 4]
movss xmm4, dword [esi + eax*4]
movaps xmm0, xmm3
movss xmm1, dword [esi + eax*4 + 4]
addss xmm0, xmm4
movss xmm2, dword [ecx]
subss xmm4, xmm3
subss xmm2, xmm1
xorps xmm1, xmm5
movss dword [esi + eax*4], xmm0
subss xmm1, dword [ecx]
movss dword [esi + eax*4 + 4], xmm1
add eax, 2
movss dword [ecx - 4], xmm4
movss dword [ecx], xmm2
add ecx, 8
cmp eax, edx
jl 0x4202c0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4214c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
cmp edi, 8
jl 0x42156f
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
shl eax, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
shl edx, 8
or edx, eax
xor ecx, edx
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x46f488]
xor edx, dword [eax*4 + 0x46f088]
movzx eax, byte [esi + 6]
xor edx, dword [eax*4 + 0x46e088]
movzx eax, byte [esi + 5]
xor edx, dword [eax*4 + 0x46e488]
movzx eax, byte [esi + 7]
xor edx, dword [eax*4 + 0x46dc88]
movzx eax, byte [esi + 4]
add esi, 8
xor edx, dword [eax*4 + 0x46e888]
mov eax, ecx
shr eax, 0x18
xor edx, dword [eax*4 + 0x46f888]
movzx eax, cl
xor edx, dword [eax*4 + 0x46ec88]
mov ecx, edx
sub ebx, 1
jne 0x4214e0
pop ebx
test edi, edi
je 0x42158f
movzx eax, byte [esi]
lea esi, [esi + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
xor edx, eax
xor ecx, dword [edx*4 + 0x46dc88]
sub edi, 1
jne 0x421573
pop edi
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x430ef0
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
push esi
mov esi, ecx
movsd xmm0, qword [eax + 8]
movhps xmm0, qword [eax + 0x18]
movsd xmm2, qword [eax]
movaps xmm1, xmm0
movhps xmm2, qword [eax + 0x10]
movsd xmm4, qword [eax + 0x20]
addps xmm1, xmm2
movhps xmm4, qword [eax + 0x30]
subps xmm2, xmm0
movsd xmm0, qword [eax + 0x28]
movhps xmm0, qword [eax + 0x38]
movaps xmm5, xmm1
movhlps xmm5, xmm1
movaps xmm3, xmm2
xorps xmm5, xmmword [0x476630]
movlhps xmm1, xmm1
shufps xmm3, xmm2, 0xbb
addps xmm5, xmm1
xorps xmm3, xmmword [0x4765c0]
movaps xmm1, xmm0
movlhps xmm2, xmm2
addps xmm1, xmm4
subps xmm4, xmm0
addps xmm3, xmm2
movlps qword [eax], xmm5
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x9e
movaps xmm2, xmm4
movlps qword [eax + 8], xmm3
movhps qword [eax + 0x10], xmm5
movhps qword [eax + 0x18], xmm3
xorps xmm0, xmmword [0x476630]
shufps xmm2, xmm4, 0x4b
xorps xmm2, xmmword [0x4765c0]
shufps xmm1, xmm1, 0x34
shufps xmm4, xmm4, 0xb4
addps xmm0, xmm1
addps xmm2, xmm4
movlps qword [eax + 0x20], xmm0
movhps qword [eax + 0x30], xmm0
movaps xmm0, xmm2
movss xmm1, dword [0x50c028]
shufps xmm0, xmm2, 0xa5
xorps xmm0, xmmword [0x4765f0]
shufps xmm2, xmm2, 0xf0
shufps xmm1, xmm1, 0
addps xmm0, xmm2
mulps xmm0, xmm1
movlps qword [eax + 0x28], xmm0
movhps qword [eax + 0x38], xmm0
cmp esi, 0x10
jle 0x4310d8
lea ecx, [eax + 0x48]
mov edx, 0x50c050
lea eax, [esi - 0x11]
shr eax, 4
inc eax
nop word [eax + eax]
movsd xmm0, qword [ecx]
movhps xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx - 8]
movaps xmm1, xmm0
movhps xmm2, qword [ecx + 8]
addps xmm1, xmm2
subps xmm2, xmm0
movaps xmm3, xmm1
movhlps xmm3, xmm1
movaps xmm4, xmm2
xorps xmm3, xmmword [0x476630]
movlhps xmm1, xmm1
addps xmm3, xmm1
shufps xmm4, xmm2, 0xbb
xorps xmm4, xmmword [0x4765c0]
movlhps xmm2, xmm2
addps xmm4, xmm2
movlps qword [ecx - 8], xmm3
movaps xmm0, xmm3
movsd xmm5, qword [ecx + 0x18]
movhps xmm5, qword [ecx + 0x28]
movsd xmm1, qword [ecx + 0x20]
movhps xmm1, qword [ecx + 0x30]
shufps xmm0, xmm3, 0xbb
movaps xmm2, xmm1
mulps xmm0, xmmword [edx - 0x20]
addps xmm2, xmm5
mulps xmm3, xmmword [edx - 0x30]
subps xmm5, xmm1
movaps xmm1, xmm2
movhlps xmm1, xmm2
addps xmm0, xmm3
movlhps xmm2, xmm2
movhps qword [ecx + 8], xmm0
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xb1
mulps xmm0, xmmword [edx]
mulps xmm4, xmmword [edx - 0x10]
addps xmm0, xmm4
movlps qword [ecx], xmm0
movhps qword [ecx + 0x10], xmm0
xorps xmm1, xmmword [0x476630]
addps xmm1, xmm2
movaps xmm2, xmm5
shufps xmm2, xmm5, 0xbb
xorps xmm2, xmmword [0x4765c0]
movlhps xmm5, xmm5
addps xmm2, xmm5
movlps qword [ecx + 0x18], xmm1
movaps xmm0, xmm1
mulps xmm0, xmmword [edx + 0x20]
shufps xmm1, xmm1, 0xbb
mulps xmm1, xmmword [edx + 0x10]
subps xmm1, xmm0
movaps xmm0, xmm2
shufps xmm0, xmm2, 0xb1
movhps qword [ecx + 0x28], xmm1
mulps xmm0, xmmword [edx + 0x40]
mulps xmm2, xmmword [edx + 0x30]
sub edx, 0xffffff80
addps xmm2, xmm0
movlps qword [ecx + 0x20], xmm2
movhps qword [ecx + 0x30], xmm2
add ecx, 0x40
sub eax, 1
jne 0x430fe0
pop esi
ret
Function at 0x4318d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov esi, edx
mov edx, 2
cmp edi, 8
jle 0x43192d
mov edx, esi
call fcn.00430ef0
mov edx, 8
cmp edi, 0x20
jle 0x43192d
mov dword [ebp - 4], 0x20
push esi
mov ecx, edi
call fcn.004310e0
mov edx, dword [ebp - 4]
add esp, 4
lea eax, [edx*4]
mov dword [ebp - 4], eax
cmp eax, edi
jl 0x431911
lea eax, [edx*4]
test edx, edx
jle 0x4319ed
cmp eax, edi
jne 0x4319ac
lea eax, [edx + edx*2]
lea ecx, [esi + edx*4]
lea edi, [esi + eax*4]
lea eax, [esi + edx*8]
dec edx
shr edx, 2
inc edx
movups xmm4, xmmword [eax]
movups xmm2, xmmword [edi]
movups xmm5, xmmword [esi]
addps xmm2, xmm4
movups xmm3, xmmword [ecx]
subps xmm4, xmmword [edi]
addps xmm3, xmm5
subps xmm5, xmmword [ecx]
movaps xmm0, xmm2
shufps xmm4, xmm4, 0xb1
xorps xmm4, xmmword [0x4765f0]
addps xmm0, xmm3
subps xmm3, xmm2
movups xmmword [esi], xmm0
movaps xmm0, xmm4
addps xmm0, xmm5
movups xmmword [eax], xmm3
subps xmm5, xmm4
add esi, 0x10
add eax, 0x10
movups xmmword [ecx], xmm0
add ecx, 0x10
movups xmmword [edi], xmm5
add edi, 0x10
sub edx, 1
jne 0x431951
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [esi + edx*4]
dec edx
shr edx, 3
inc edx
movups xmm2, xmmword [eax]
movups xmm4, xmmword [esi]
movaps xmm0, xmm2
movups xmm3, xmmword [esi + 0x10]
addps xmm0, xmm4
movups xmm1, xmmword [eax + 0x10]
subps xmm4, xmm2
movups xmmword [esi], xmm0
movaps xmm0, xmm1
addps xmm0, xmm3
subps xmm3, xmm1
movups xmmword [esi + 0x10], xmm0
add esi, 0x20
movups xmmword [eax], xmm4
movups xmmword [eax + 0x10], xmm3
add eax, 0x20
sub edx, 1
jne 0x4319b4
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x43e297
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43e2d6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43e2d6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43e2d6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43e2d6
cmp dword [ecx + 0x74], 0xe
jbe 0x43e2d6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x45144a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004512c9

Function at 0x455a55
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00455715

Function at 0x45dbc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45dbed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45dbed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx