joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1106058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x11061a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x110607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x110606a
add dl, dl
jne 0x1106089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11060dc
xor eax, eax
add dl, dl
jne 0x1106096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x110617d
add dl, dl
jne 0x11060a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11060b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11060bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11060c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11060d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1106075
mov eax, 1
add dl, dl
jne 0x11060ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11060f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11060e1
sub eax, ebx
mov ebx, 1
jne 0x1106128
mov ecx, 1
add dl, dl
jne 0x110610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1106119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1106105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1106075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x110613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x110614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1106136
cmp eax, 0x7d00
jae 0x110616d
cmp eax, 0x500
jb 0x1106168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1106075
cmp eax, 0x7f
ja 0x1106170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1106075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x110619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1106075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403d50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403db1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403d94
cmp edi, 2
jb 0x403d94
cmp byte [esi], cl
jne 0x403d94
cmp byte [esi + 1], cl
jne 0x403d94
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4476b8]
jmp 0x403d65
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4476b8]
test edi, edi
jne 0x403d65
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403de0
cmp cl, 0x23
jne 0x403dc7
cmp byte [esi], cl
jne 0x403dc7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4476b8]
test cl, cl
jne 0x403db8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403f70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x403f95
push 0x79e
push str.C:UsersMinoDesktop2imgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x403fa2
mov dword [edi], 0
mov edx, 0x446fe0
mov ecx, esi
call fcn.00403df0
mov esi, eax
test esi, esi
je 0x404092
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x404088
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x404088
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x404088
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x404088
mov eax, dword [0x5b1f10]
test eax, eax
je 0x40401c
inc dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x404088
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40406d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x5b1f10]
add esp, 4
test eax, eax
je 0x40405a
dec dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x40407f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405e30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0xc8], 0
jg 0x405e58
push 0x711
push str.C:UsersMinoDesktop2imgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [ebx + 0xc8]
lea edx, [ebp + 8]
mov ebx, dword [ebx + 0xd0]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4476b8]
sub esi, 1
jne 0x405e72
mov eax, dword [0x5b1f10]
not ebx
cmp dword [eax + 0x3e5c], ebx
jne 0x405eac
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0041bf20
add esp, 8
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x405ec0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc8], 0
jg 0x405eeb
push 0x711
push str.C:UsersMinoDesktop2imgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [ebp + 8]
mov edi, 0x10
movss xmm1, dword [esi + 0xe4]
movss xmm2, dword [esi + 0xe8]
mov ecx, dword [esi + 0xc8]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xd0]
subss xmm0, xmm2
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4476b8]
sub edi, 1
jne 0x405f50
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40d770
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40d7ad
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x40d793
cmp byte [esi], bl
jne 0x40d793
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x4476b8]
test bl, bl
jne 0x40d784
pop edi
pop esi
not ecx
pop ebx
jmp fcn.0040d710
Function at 0x41a950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5a58], 0
lea esi, [edi + 0x5a5c]
je 0x41a9d2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41a98c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041cc60
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.004042f0
mov edx, dword [esi]
mov ecx, 0x5b1f0c
push dword [edi + 0x5a58]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5a64]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.004042f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41aea0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5b1f10]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x41aee7
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x41aece
cmp byte [edx], al
jne 0x41aece
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x4476b8]
test al, al
jne 0x41aec0
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x5a00]
test eax, eax
jle 0x41af3f
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor edi, edi
test esi, esi
js 0x41af08
cmp esi, eax
jl 0x41af25
push 0x708
push str.C:UsersMinoDesktop2imgui.h
push str.i___0__i___Size
call edx
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [ecx + 0x5a08]
cmp dword [eax + edi + 4], ebx
je 0x41af48
mov eax, dword [ecx + 0x5a00]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x41af00
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x41af54
cmp esi, dword [ecx + 0x5a00]
jl 0x41af68
push 0x708
push str.C:UsersMinoDesktop2imgui.h
push str.i___0__i___Size
call edx
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x5a08]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret

Function at 0x41b2e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x5b1f10]
sub esp, 8
push esi
mov esi, ecx
mov dword [eax + 0x59f0], 0
push edi
test esi, esi
je 0x41b33d
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.0041b350
mov edx, 0x446fe4
mov ecx, esi
mov edi, eax
call fcn.00403df0
mov esi, eax
test esi, esi
je 0x41b33d
push esi
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x425060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42509a
mov eax, dword [0x5b1f10]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x42508d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4250cb
mov eax, dword [0x5b1f10]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x4250be
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4250fc
mov eax, dword [0x5b1f10]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x4250ef
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x425149
mov eax, dword [0x5b1f10]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42513c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x42517a
mov eax, dword [0x5b1f10]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x42516d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x4251ab
mov eax, dword [0x5b1f10]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x42519e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00427fd0
Function at 0x4390c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x5b1f10]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
cmp byte [eax + 0x2ed8], 0
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
je 0x43914d
xor edx, edx
mov ecx, 0x210
call fcn.00414610
test al, al
je 0x43914d
push 0xa0
call ebx
shr eax, 0xf
test al, 1
jne 0x43914d
cmp dword [0x5b1f10], 0
jne 0x439118
push 0xf73
push str.C:UsersMinoDesktop2imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x5b1f10]
cmp byte [esi + 0x3769], 0
je 0x439139
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403690
mov dword [esi + 0x33c], 0x210
mov dword [esi + 0x8fc], 0xa0
mov eax, dword [0x5b1f10]
cmp byte [eax + 0x2f18], 0
je 0x4391cb
xor edx, edx
mov ecx, 0x214
call fcn.00414610
test al, al
je 0x4391cb
push 0xa1
call ebx
shr eax, 0xf
test al, 1
jne 0x4391cb
cmp dword [0x5b1f10], 0
jne 0x439196
push 0xf73
push str.C:UsersMinoDesktop2imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x5b1f10]
cmp byte [esi + 0x3769], 0
je 0x4391b7
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403690
mov dword [esi + 0x340], 0x214
mov dword [esi + 0x90c], 0xa1
mov eax, dword [0x5b1f10]
cmp byte [eax + 0x2ef8], 0
je 0x439246
xor edx, edx
mov ecx, 0x212
call fcn.00414610
test al, al
je 0x439246
push 0x5b
call ebx
shr eax, 0xf
test al, 1
jne 0x439246
cmp dword [0x5b1f10], 0
jne 0x439211
push 0xf73
push str.C:UsersMinoDesktop2imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x5b1f10]
cmp byte [esi + 0x3769], 0
je 0x439232
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403690
mov dword [esi + 0x228], 0x212
mov dword [esi + 0x904], 0x5b
mov eax, dword [0x5b1f10]
cmp byte [eax + 0x2f38], 0
je 0x4392c2
xor edx, edx
mov ecx, 0x216
call fcn.00414610
test al, al
je 0x4392c2
push 0x5c
call ebx
shr eax, 0xf
test al, 1
jne 0x4392c2
mov esi, dword [0x5b1f10]
test esi, esi
jne 0x439293
push 0xf73
push str.C:UsersMinoDesktop2imgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x5b1f10]
add esp, 0xc
cmp byte [esi + 0x3769], 0
je 0x4392ae
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.00403690
mov dword [esi + 0x22c], 0x216
mov dword [esi + 0x914], 0x5c
pop edi
pop esi
pop ebx
ret
Function at 0x43f790
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x42c
push ebx
push esi
push edi
push ecx
push 0x18
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x43f819
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x43f819
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ebx, dword [sym.imp.KERNEL32.dll_Module32NextW]
nop dword [eax + eax]
lea eax, [esp + 0x30]
push str.Engine.dll
push eax
call edi
add esp, 8
test eax, eax
je 0x43f811
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x43f7e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f830
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x43f8bf
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x43f8bf
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop dword [eax]
lea eax, [ebp - 0x20c]
push str.Nksp.exe
push eax
call edi
add esp, 8
test eax, eax
je 0x43f8b4
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x43f880
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x228]
pop edi
mov dword [ebp - 4], eax
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x440492
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4404d1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4404d1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4404d1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4404d1
cmp dword [ecx + 0x74], 0xe
jbe 0x4404d1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6a505da9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6a805964
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x409db0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43fbc0]
jne 0x409dba
repz ret
jmp fcn.0040de2b

Function at 0x40d684
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409110
and dword [ebp - 4], 0
cmp dword [0x441d30], 0
mov ebx, eax
jne 0x40d735
push 0x401b18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d7e6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b0c
push edi
call esi
test eax, eax
je 0x40d7e6
push eax
call fcn.0040909e
mov dword [esp], 0x401afc
push edi
mov dword [0x441d30], eax
call esi
push eax
call fcn.0040909e
mov dword [esp], 0x401ae8
push edi
mov dword [0x441d34], eax
call esi
push eax
call fcn.0040909e
mov dword [esp], 0x401acc
push edi
mov dword [0x441d38], eax
call esi
push eax
call fcn.0040909e
pop ecx
mov dword [0x441d40], eax
test eax, eax
je 0x40d735
push 0x401ab4
push edi
call esi
push eax
call fcn.0040909e
pop ecx
mov dword [0x441d3c], eax
mov eax, dword [0x441d3c]
cmp eax, ebx
je 0x40d78d
cmp dword [0x441d40], ebx
je 0x40d78d
push eax
call fcn.00409119
push dword [0x441d40]
mov esi, eax
call fcn.00409119
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d78d
test edi, edi
je 0x40d78d
call esi
test eax, eax
je 0x40d784
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d784
test byte [ebp - 0xc], 1
jne 0x40d78d
or dword [ebp + 0x10], 0x200000
jmp 0x40d7c6
mov eax, dword [0x441d34]
cmp eax, ebx
je 0x40d7c6
push eax
call fcn.00409119
pop ecx
test eax, eax
je 0x40d7c6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d7c6
mov eax, dword [0x441d38]
cmp eax, ebx
je 0x40d7c6
push eax
call fcn.00409119
pop ecx
test eax, eax
je 0x40d7c6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x441d30]
call fcn.00409119
pop ecx
test eax, eax
je 0x40d7e6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d7e8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43b669
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop ecx
and eax, eax
call fcn.0043b6a9
sub eax, 0x3d59c4f8
xor dword [esi], ecx
sub eax, 1
sub ebx, 0x4a227a79
add esi, 1
sub ebx, 0xdd10d351
mov ebx, 0x1e17fcb7
or eax, eax
cmp esi, edi
jne fcn.0043b669
or eax, ebx
ret