joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b980
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
lea edx, [esi + eax*4]
mov eax, dword [edx + 0x1c]
shl eax, 8
or eax, 0x80
mov dword [edx + 0x1c], eax
mov ecx, dword [esi + 0x5c]
sub ecx, 1
mov dword [esi + 0x5c], ecx
je 0x41b9ac
mov eax, dword [esi + 0x18]
shl ecx, 3
shl dword [esi + eax*4 + 0x1c], cl
mov eax, dword [esi + 0x18]
inc eax
mov dword [esi + 0x18], eax
cmp eax, 0x10
jae 0x41b9ce
push edi
lea edi, [esi + 0x1c]
mov ecx, 0x10
lea edi, [edi + eax*4]
sub ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x18]
pop edi
cmp eax, 0xe
jbe 0x41ba0c
mov ecx, esi
call fcn.0041a810
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x14]
mov ecx, esi
shl eax, 3
mov dword [esi + 0x58], eax
pop esi
jmp fcn.0041a810

Function at 0x41c2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
push ebx
push esi
movzx ebx, byte [eax + 0x23]
lea edx, [eax + 0x24]
sub ecx, edx
mov dword [ebp - 8], eax
push edi
mov esi, edx
mov dword [ebp - 4], ecx
lea edi, [eax + 0x44]
mov edx, 0x10
lea ebx, [ebx]
movzx eax, byte [esi]
lea edi, [edi + 1]
mov byte [edi - 0x11], al
lea esi, [esi + 1]
mov cl, byte [ecx + esi - 1]
mov byte [edi - 1], cl
movzx eax, byte [esi - 1]
xor al, cl
mov byte [edi + 0xf], al
movzx eax, cl
mov ecx, dword [ebp - 4]
xor eax, ebx
movzx eax, byte [eax + str._.C]
xor byte [esi - 0x11], al
movzx ebx, byte [esi - 0x11]
sub edx, 1
jne 0x41c320
mov edi, dword [ebp - 8]
xor cl, cl
xor edx, edx
mov edi, edi
lea eax, [edi + 0x35]
mov esi, 6
jmp 0x41c370
movzx ecx, cl
lea eax, [eax + 8]
movzx ecx, byte [ecx + str._.C]
xor byte [eax - 9], cl
movzx ecx, byte [eax - 9]
movzx ecx, byte [ecx + str._.C]
xor byte [eax - 8], cl
movzx ecx, byte [eax - 8]
movzx ecx, byte [ecx + str._.C]
xor byte [eax - 7], cl
movzx ecx, byte [eax - 7]
movzx ecx, byte [ecx + str._.C]
xor byte [eax - 6], cl
movzx ecx, byte [eax - 6]
movzx ecx, byte [ecx + str._.C]
xor byte [eax - 5], cl
movzx ecx, byte [eax - 5]
movzx ecx, byte [ecx + str._.C]
xor byte [eax - 4], cl
movzx ecx, byte [eax - 4]
movzx ecx, byte [ecx + str._.C]
xor byte [eax - 3], cl
movzx ecx, byte [eax - 3]
movzx ecx, byte [ecx + str._.C]
xor byte [eax - 2], cl
mov cl, byte [eax - 2]
sub esi, 1
jne 0x41c370
add cl, dl
inc edx
cmp edx, 0x12
jb 0x41c360
mov eax, dword [edi + 0x34]
mov dword [edi + 0x24], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x28], eax
mov eax, dword [edi + 0x3c]
mov dword [edi + 0x2c], eax
mov eax, dword [edi + 0x40]
mov dword [edi + 0x30], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d350
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax], 0
mov dword [eax + 4], 0
pop ebp
ret 4

Function at 0x41d440
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, 0x40
push edi
mov ecx, dword [esi]
and ecx, 0x3f
mov byte [ecx + esi + 0x18], 0x80
inc ecx
sub eax, ecx
cmp eax, 8
jae 0x41d483
push eax
lea eax, [esi + 0x18]
add eax, ecx
push 0
push eax
call fcn.00551fd0
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.0041cce0
add esp, 0x10
mov eax, 0x40
xor ecx, ecx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, ecx
push 0
push eax
call fcn.00551fd0
shl dword [esi], 3
lea edx, [esi + 0x18]
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.0041cce0
mov ecx, dword [ebp + 0xc]
movzx eax, byte [esi + 8]
push 0x98
push 0
mov byte [ecx], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [ecx + 1], al
movzx eax, byte [esi + 0xa]
mov byte [ecx + 2], al
movzx eax, byte [esi + 0xb]
mov byte [ecx + 3], al
movzx eax, byte [esi + 0xc]
mov byte [ecx + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [ecx + 5], al
movzx eax, byte [esi + 0xe]
mov byte [ecx + 6], al
movzx eax, byte [esi + 0xf]
mov byte [ecx + 7], al
movzx eax, byte [esi + 0x10]
mov byte [ecx + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [ecx + 9], al
movzx eax, byte [esi + 0x12]
mov byte [ecx + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [ecx + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [ecx + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [ecx + 0xd], al
movzx eax, byte [esi + 0x16]
mov byte [ecx + 0xe], al
movzx eax, byte [esi + 0x17]
push esi
mov byte [ecx + 0xf], al
call fcn.00551fd0
add esp, 0x1c
pop edi
pop esi
pop ebp
ret 8
Function at 0x41e0f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5fda40
push 0x552340
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x634384]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
je 0x41e1d7
test esi, esi
je 0x41e1d7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x41e1d7
push edi
push eax
push edi
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0x41e1d7
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
jne 0x41e195
xor bl, bl
jmp 0x41e1db
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x20]
mov ecx, ebx
call fcn.0041f590
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 8]
jmp 0x41e1db
xor bl, bl
xor eax, eax
test eax, eax
je 0x41e1e6
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
je 0x41e1f5
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x41e1fb
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x41e203
push esi
call edi
movzx eax, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41e220
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
push ebx
push esi
push edi
mov esi, dword [eax + 4]
xor edi, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
jmp 0x41e240
mov ebx, dword [edi + 0x634df0]
cmp esi, dword [ebx + 4]
jne 0x41e2b1
mov ecx, dword [eax]
mov edx, dword [ebx]
sub esi, 4
jb 0x41e265
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x41e26e
add ecx, 4
add edx, 4
sub esi, 4
jae 0x41e254
cmp esi, 0xfffffffc
je 0x41e32c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x41e2ab
cmp esi, 0xfffffffd
je 0x41e32c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x41e2ab
cmp esi, 0xfffffffe
je 0x41e32c
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x41e2ab
cmp esi, 0xffffffff
je 0x41e32c
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x41e32c
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
add edi, 4
cmp edi, 0x20
jb 0x41e240
xor ebx, ebx
xor edi, edi
lea ecx, [ecx]
cmp esi, dword [edi + 0x634e14]
jne 0x41e31b
mov edx, dword [eax]
mov eax, dword [edi + 0x634e10]
sub esi, 4
jb 0x41e2e6
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x41e2eb
add edx, 4
add eax, 4
sub esi, 4
jae 0x41e2d5
cmp esi, 0xfffffffc
je 0x41e335
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x41e318
cmp esi, 0xfffffffd
je 0x41e335
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x41e318
cmp esi, 0xfffffffe
je 0x41e335
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x41e318
cmp esi, 0xffffffff
je 0x41e335
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x41e335
mov esi, dword [ebp - 4]
add edi, 0x18
inc ebx
cmp edi, 0x150
jae 0x41e346
mov eax, dword [ebp - 8]
jmp 0x41e2c0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
lea eax, [ebx + ebx*2]
mov eax, dword [eax*8 + 0x634e1c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e3a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ecx], 0
test esi, esi
je 0x41e4c7
cmp esi, 0xffffffff
je 0x41e4c7
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41e4c7
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x41e4c7
movzx eax, word [edi + 0x18]
mov edx, 0x10b
cmp ax, dx
je 0x41e414
mov edx, 0x20b
cmp ax, dx
jne 0x41e4c7
mov dword [ebp - 8], 0x108
mov edx, 0xa8
jmp 0x41e420
mov dword [ebp - 8], 0xf8
mov edx, 0x98
mov eax, edi
add edx, edi
sub eax, esi
mov dword [ebp - 4], edx
add eax, 0x58
mov edx, ecx
push 4
push eax
mov ecx, ebx
call fcn.0041e350
mov eax, dword [edi + 0x54]
add esp, 8
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], eax
sub ecx, esi
xor eax, eax
mov dword [ebp - 0xc], ecx
mov edi, dword [edi]
test edi, edi
je 0x41e45e
cmp ecx, dword [ebx + eax*8]
jbe 0x41e45e
inc eax
cmp eax, edi
jb 0x41e454
mov ecx, edi
lea esi, [ebx + eax*8]
sub ecx, eax
lea eax, [esi + 8]
shl ecx, 3
push ecx
push esi
push eax
call fcn.00551a50
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [esi], eax
lea eax, [edi + 1]
mov dword [esi + 4], 8
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
test ecx, ecx
je 0x41e4be
mov eax, dword [eax + 4]
test eax, eax
je 0x41e4be
mov esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 8]
jb 0x41e4c7
cmp ecx, esi
jb 0x41e4c7
lea esi, [eax + ecx]
cmp esi, eax
jb 0x41e4c7
cmp esi, dword [ebp - 0x14]
ja 0x41e4c7
push eax
push ecx
mov ecx, ebx
call fcn.0041e350
add esp, 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
call fcn.0041d570
cmp esi, 0x40
jb 0x41f631
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x41f631
mov ecx, dword [ebx + 0x3c]
cmp ecx, esi
ja 0x41f631
lea eax, [ecx + 0x378]
cmp eax, ecx
jbe 0x41f631
lea eax, [ecx + 0xf8]
cmp eax, esi
ja 0x41f631
cmp dword [ecx + ebx], 0x4550
jne 0x41f631
lea eax, [esp + 0x14]
mov edx, esi
push eax
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, ebx
call fcn.00428630
test al, al
je 0x41f631
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
cmp edi, 0xc
jb 0x41f631
mov esi, dword [ebx]
add esi, 7
and esi, 0xfffffff8
je 0x41f631
cmp esi, edi
ja 0x41f631
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push ebx
call fcn.0041ef30
add esp, 4
test al, al
jne 0x41f633
sub edi, esi
add ebx, esi
cmp edi, 0xc
jae 0x41f605
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f640
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, ecx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 8], eax
xor edi, edi
mov esi, dword [eax + 4]
mov dword [ebp - 4], esi
cmp esi, dword [edi + 0x634ddc]
jne 0x41f6cd
mov ecx, dword [eax]
mov edx, dword [edi + 0x634dd8]
sub esi, 4
jb 0x41f681
lea ecx, [ecx]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x41f68a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x41f670
cmp esi, 0xfffffffc
je 0x41f74c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x41f6c7
cmp esi, 0xfffffffd
je 0x41f74c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x41f6c7
cmp esi, 0xfffffffe
je 0x41f74c
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x41f6c7
cmp esi, 0xffffffff
je 0x41f74c
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x41f74c
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
add edi, 0x10
inc ebx
cmp edi, 0x10
jb 0x41f658
xor ebx, ebx
xor edi, edi
lea ebx, [ebx]
cmp esi, dword [edi + 0x634e14]
jne 0x41f73b
mov edx, dword [eax]
mov eax, dword [edi + 0x634e10]
sub esi, 4
jb 0x41f706
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x41f70b
add edx, 4
add eax, 4
sub esi, 4
jae 0x41f6f5
cmp esi, 0xfffffffc
je 0x41f75c
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x41f738
cmp esi, 0xfffffffd
je 0x41f75c
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x41f738
cmp esi, 0xfffffffe
je 0x41f75c
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x41f738
cmp esi, 0xffffffff
je 0x41f75c
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x41f75c
mov esi, dword [ebp - 4]
add edi, 0x18
inc ebx
cmp edi, 0x150
jae 0x41f76d
mov eax, dword [ebp - 8]
jmp 0x41f6e0
shl ebx, 4
pop edi
pop esi
mov eax, dword [ebx + 0x634de4]
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
lea eax, [ebx + ebx*2]
mov eax, dword [eax*8 + 0x634e20]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], edx
cmp edx, ebx
je 0x4275f6
mov eax, dword [ebx + 4]
push esi
lea esi, [ecx - 1]
not ecx
shr ecx, 0x1f
shr esi, 0x1f
and esi, ecx
mov ecx, dword [edx + 4]
xor eax, ecx
dec esi
and eax, esi
mov dword [ebp + 8], esi
xor ecx, eax
mov dword [edx + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
and eax, esi
xor ecx, eax
push edi
mov dword [edx + 0xc], ecx
xor edi, edi
xor dword [ebx + 0xc], eax
cmp dword [ebp + 0xc], edi
jle 0x4275f4
lea ecx, [ecx]
mov eax, dword [edx]
mov ecx, dword [eax + edi*4]
lea edx, [eax + edi*4]
mov eax, dword [ebx]
mov esi, dword [eax + edi*4]
xor esi, ecx
and esi, dword [ebp + 8]
xor ecx, esi
mov dword [edx], ecx
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
xor dword [eax + edi*4], esi
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x4275d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428630
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x4286e8
cmp ecx, 0xffffffff
je 0x4286e8
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4286e8
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4286e8
mov edx, 0x10b
cmp word [eax + 0x18], dx
jne 0x428681
cmp dword [eax + 0x74], 4
jbe 0x4286e8
lea esi, [edx - 0x73]
lea edx, [esi + 8]
jmp 0x428694
cmp dword [eax + 0x84], 4
jbe 0x4286e8
mov esi, 0xa8
mov edx, 0xb0
sub edx, ecx
lea ebx, [edx + eax]
mov edx, dword [esi + eax]
test edx, edx
jne 0x4286b9
cmp dword [esi + eax + 4], edx
jne 0x4286b9
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov al, 1
pop ebp
ret 0xc
mov esi, dword [esi + eax + 4]
lea eax, [esi + edx]
cmp eax, edx
jb 0x4286e8
cmp edx, edi
ja 0x4286e8
cmp edx, ebx
jb 0x4286e8
mov eax, dword [ebp + 0xc]
add ecx, edx
sub edi, edx
cmp esi, edi
mov dword [eax], ecx
cmovae esi, edi
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], esi
mov al, 1
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc

Function at 0x42fa80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [edx + 4]
push edi
cmp esi, dword [ebx + 4]
mov edi, ecx
mov ecx, edx
cmovge ecx, ebx
cmovge ebx, edx
mov dword [ebp + 8], ecx
mov edx, dword [ebx + 4]
cmp edx, dword [edi + 8]
jg 0x42faa8
mov eax, edi
jmp 0x42fab2
mov ecx, edi
call fcn.00421500
mov ecx, dword [ebp + 8]
test eax, eax
jne 0x42fabb
pop edi
pop esi
pop ebx
pop ebp
ret
xor esi, esi
cmp dword [ecx + 4], esi
jle 0x42fada
mov eax, dword [ecx]
mov ecx, dword [ebx]
mov edx, dword [eax + esi*4]
xor edx, dword [ecx + esi*4]
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ecx + 4]
jl 0x42fac2
mov eax, dword [ebx + 4]
cmp esi, eax
jge 0x42faf3
mov eax, dword [ebx]
mov ecx, dword [edi]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebx + 4]
cmp esi, eax
jl 0x42fae1
mov dword [edi + 4], eax
test eax, eax
jle 0x42fb13
mov ecx, dword [edi]
lea ecx, [ecx + eax*4]
nop
cmp dword [ecx - 4], 0
lea ecx, [ecx - 4]
jne 0x42fb0e
dec eax
test eax, eax
jg 0x42fb00
mov dword [edi + 4], eax
test eax, eax
jne 0x42fb1c
mov dword [edi + 0xc], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x42ffc0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov ecx, dword [ebp + 0xc]
push edi
xor edi, edi
call fcn.0041fcd0
mov ecx, dword [ebp + 0xc]
call fcn.0041fe00
mov esi, eax
test esi, esi
je 0x4301c6
mov edx, dword [ebx + 4]
add edx, edx
cmp edx, dword [esi + 8]
jle 0x42fffb
mov ecx, esi
call fcn.00421500
test eax, eax
je 0x4301c6
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x430181
mov edi, ecx
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, 0x80000001
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x430013
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
mov dword [esi + 4], eax
test eax, eax
jle 0x4301a3
mov ecx, dword [esi]
lea ecx, [ecx + eax*4]
nop
cmp dword [ecx - 4], 0
lea ecx, [ecx - 4]
jne 0x43019e
dec eax
test eax, eax
jg 0x430190
mov dword [esi + 4], eax
test eax, eax
jne 0x4301ac
mov dword [esi + 0xc], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.0042fb30
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.0041fd90
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4322b0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [ecx]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
test esi, esi
jne 0x4322c8
lea eax, [esi + 6]
pop esi
ret 8
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
call fcn.004125d0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8

Function at 0x4322f0
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [ecx]
test edi, edi
jne 0x4322fe
lea eax, [edi + 6]
pop edi
ret 8
mov ecx, dword [esp + 0xc]
call fcn.00413610
mov ecx, dword [esp + 0xc]
inc eax
push eax
call fcn.004125d0
mov ecx, dword [esp + 0xc]
push eax
push 2
push 0
call fcn.004125d0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
ret 8

Function at 0x432330
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c528
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x634384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp + 0xc]
call fcn.0041bb10
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004125d0
lea ecx, [ebp - 0x28]
push ecx
push eax
push 0
call fcn.00432d00
mov esi, dword [edi]
add esp, 0xc
test esi, esi
jne 0x432395
mov esi, 6
jmp 0x4323c2
mov ecx, ebx
call fcn.0041bbd0
mov ecx, ebx
lea eax, [eax*2 + 2]
push eax
call fcn.0041ba50
push eax
push 2
push 0
lea ecx, [ebp - 0x28]
call fcn.0041ba50
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041ba60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005395e6
mov esp, ebp
pop ebp
ret 8

Function at 0x432400
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [ecx]
movzx eax, byte [eax]
mov dword [esp + 0xc], eax
test esi, esi
jne 0x432419
lea eax, [esi + 6]
pop esi
ret 8
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
call fcn.004125d0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8