joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6289b4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x74], 0
jne 0x6289cc
mov eax, ebx
call fcn.006281c8
cmp dword [ebx + 0x70], 0
jne 0x6289d9
mov eax, ebx
call fcn.00628124
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x628b8c
cmp dword [ebx + 0x70], 0
je 0x628b8c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x74]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00627f6c
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00637db8
cmp eax, dword [esp]
je 0x628a5b
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00637dcc
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x628a37
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00637db8
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x628a50
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x628a6e
mov eax, dword [eax + 0x18]
call fcn.00485c08
mov esi, eax
jmp 0x628a71
mov esi, dword [ebx + 0x58]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
and eax, 8
cmp eax, 8
jne 0x628a86
or esi, 0xffffffff
jmp 0x628a90
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x70]
call fcn.004e72c4
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x70]
call fcn.004e7300
mov edx, dword [esp]
mov eax, dword [ebx + 0x70]
call fcn.0047c2a4
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x70]
call fcn.0047c2d8
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040af30
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.00485c08
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.00485c08
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.00485c08
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x74]
call fcn.00466d2c
call fcn.00461430
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.00485c08
push eax
mov eax, dword [0x6689a8]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x70]
call fcn.00485c08
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x628dd0
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00404a24
lea eax, [esp + 0x3c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x629006
push 0
push 0x629010
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x629006
push 0
push 0x62902c
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x629006
push 0
push 0x629048
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x629006
push 0
push 0x629068
push 0
push eax
call sub.user32.dll_FindWindowExW
mov ebp, eax
test ebp, ebp
je 0x629006
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageW
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x629006
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x629006
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x629006
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x629006
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x628ff2
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageW
test eax, eax
je 0x628fe8
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x20]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x628fe8
test byte [esp + 0x21], 0xd
jne 0x628fe8
movzx eax, byte [esp + 0x20]
and al, 8
cmp al, 8
je 0x628fe8
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x628fe8
cmp dword [esp + 0xc], 0
je 0x628fe8
mov eax, dword [0x6690c0]
mov eax, dword [eax]
cmp byte [eax + 0xd3], 0
je 0x628f85
mov eax, dword [0x6690c0]
mov eax, dword [eax]
cmp dword [eax + 0x44], 0
je 0x628f85
mov eax, dword [0x6690c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.00485c08
mov dword [esp + 0x14], eax
jmp 0x628f96
mov eax, dword [0x6690c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x628fe8
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageW
test eax, eax
je 0x628fc4
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x628ff2
lea eax, [esp + 0x2c]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
call fcn.0040afec
jmp 0x628ff2
cmp ebx, dword [esp + 4]
jl 0x628ede
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x62dd00
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x66f9d0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x62dd22
shr eax, 1
xor eax, 0xedb88320
jmp 0x62dd24
shr eax, 1
dec edx
jne 0x62dd10
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x62dd09
mov byte [0x66fdd0], 1
pop esi
pop ebx
ret

Function at 0x62dd40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x66fdd0], 0
jne 0x62dd57
call fcn.0062dd00
mov eax, edi
dec eax
test eax, eax
jl 0x62dd7f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x66f9d0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x62dd61
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x630b0c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x630ba6.0
jmp dword [ecx*4 + 0x630b3f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x630b71
sub dl, 8
je 0x630b80
jmp case.0x630ba6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6307b4
jmp case.0x630ba6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x63080c
jmp case.0x630ba6.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x630ba6.0
movzx ecx, byte [ecx + 0x630bad]
jmp dword [ecx*4 + 0x630bbe]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6308b8
jmp case.0x630ba6.0
cmp dl, 3
jne 0x630beb
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x630910
jmp case.0x630ba6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6308cc
jmp case.0x630ba6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x630954
jmp case.0x630ba6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x630c16
sub dl, 8
je 0x630c22
jmp case.0x630ba6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x630980
jmp case.0x630ba6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6309ec
jmp case.0x630ba6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x630c41
sub dl, 8
je 0x630c4d
jmp case.0x630ba6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x630aa8
jmp case.0x630ba6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x630ad0
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x630cef
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0062fcb8
test eax, eax
je 0x630cef
mov eax, ebx
call fcn.00630cf8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x630c88
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x630cf8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x630d29
dec al
je 0x630d64
dec al
je 0x630da9
dec al
je 0x630e12
jmp 0x630e9c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x630e9c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x630d39
jmp 0x630e9c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x630e9c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x630d74
jmp 0x630e9c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x630e9c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x630dd8
xor ebp, ebp
jmp 0x630de8
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x630df1
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x630db9
jmp 0x630e9c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x630e9c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x630e6b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0062dd88
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x630e26
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x635f30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x635fa1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x6686ec]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x635f8b
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00635f10
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x635660]
call fcn.00636ad8
mov dword [0x668750], eax
mov eax, dword [ebp - 4]
call fcn.00635eb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x635fa8
lea eax, [ebp - 8]
call fcn.0040a0a8
ret

Function at 0x635fec
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x4008
cmp byte [ebp - 6], 0
je 0x63600f
or dword [ebp - 0x10], 2
cmp byte [ebp - 5], 0
je 0x63601b
or dword [ebp - 0x10], 0
jmp 0x63601f
or dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
push eax
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x637530
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
lea eax, [ebp - 0x2b4]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404a24
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2b4]
push eax
push 0
push 0x6375d0
call sub.shell32.dll_SHGetFileInfoW
mov dword [0x6686e4], eax
cmp dword [0x6686e4], 0
je 0x6375cc
cmp dword [0x6686e8], 0
jne 0x6375cc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5b1424]
call fcn.005b2220
mov dword [0x6686e8], eax
mov edx, dword [0x6686e4]
mov eax, dword [0x6686e8]
call fcn.00494ef8
mov dl, 1
mov eax, dword [0x6686e8]
call fcn.00494e74
mov dl, 1
mov eax, dword [0x6686e8]
call fcn.005b3cfc
push 0xffffffffffffffff
mov eax, dword [0x6686e8]
call fcn.00494f34
push eax
call sub.comctl32.dll_ImageList_SetBkColor
mov esp, ebp
pop ebp
ret

Function at 0x6386e0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd48
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov dl, 1
mov eax, ebx
call fcn.0041e0dc
test al, al
je 0x638769
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404a24
or esi, 0x100
test esi, esi
jns 0x63871d
call fcn.00404f78
push esi
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00407770
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x638769
mov dl, 1
mov eax, dword [0x45d69c]
call fcn.00468a24
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00468eb8
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
je 0x638769
mov eax, esp
call fcn.00424b14
mov eax, dword [esp]
add esp, 0x2b8
pop esi
pop ebx
ret
Function at 0x41b100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a53b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov al, byte [esp + 0x38]
xor edi, edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x14], al
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
push edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00475930
push edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.00475930
push ecx
mov byte [esp + 0x30], 3
mov ecx, esp
mov dword [esp + 0x14], esp
push edi
call fcn.00475930
lea ecx, [esp + 0xc]
call fcn.00475ae0
push edi
lea ecx, [esp + 0xc]
call fcn.00475ce0
cmp byte [0x4c4567], 4
jne 0x41b184
push 0x3b
jmp 0x41b189
push 0xa5
lea ecx, [esp + 0xc]
call fcn.00475ce0
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0xc]
call fcn.00475ce0
lea edx, [esp + 0x38]
lea ecx, [esp + 8]
push edx
call fcn.00475a90
push 1
lea ecx, [esp + 0xc]
call fcn.00475ce0
push 1
push 0x4c4538
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00475910
mov ecx, dword [0x4c4548]
call fcn.0043efc0
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x2c], 2
call fcn.00475a40
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.00475a40
push edi
call fcn.00498130
add esp, 4
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00475a40
mov ecx, dword [esp + 0x24]
mov ax, si
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x28
ret 8
Function at 0x42f7d0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4a6688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
xor esi, esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 8], esi
call fcn.00475d00
mov ebp, eax
cmp bp, 2
jle 0x42f84d
push ebx
push edi
push esi
lea ecx, [esp + 0x28]
call fcn.00475c70
mov bl, al
mov esi, 1
movsx eax, bp
lea edi, [eax - 1]
cmp edi, esi
jle 0x42f834
push esi
lea ecx, [esp + 0x28]
call fcn.00475c70
xor bl, al
inc esi
movsx eax, si
cmp eax, edi
jl 0x42f820
dec ebp
lea ecx, [esp + 0x24]
push ebp
call fcn.00475c70
pop edi
cmp bl, al
pop ebx
jne 0x42f84d
mov dword [esp + 8], 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00475a40
mov ecx, dword [esp + 0xc]
mov ax, word [esp + 8]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x42f880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov ecx, ebp
xor esi, esi
call fcn.00475d00
mov edi, eax
cmp di, 2
jl 0x42f8dd
push ebx
push esi
mov ecx, ebp
call fcn.00475c70
mov esi, 1
mov bl, al
cmp di, si
mov byte [esp + 0x14], bl
jle 0x42f8c5
push esi
mov ecx, ebp
call fcn.00475c70
xor bl, al
inc esi
cmp si, di
jl 0x42f8b1
mov byte [esp + 0x14], bl
mov eax, dword [esp + 0x14]
mov ecx, ebp
push eax
call fcn.00475ce0
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret 4
mov ax, si
pop edi
pop esi
pop ebp
ret 4

Function at 0x433860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a6b00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x18], 0
call fcn.00475910
mov ecx, dword [esp + 0x1c]
add esi, 0xc
push ecx
mov byte [esp + 0x18], 1
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.0041b450
mov ecx, dword [0x4c4560]
mov byte [esp + 0x28], 0
call fcn.0042e760
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
call fcn.00475a40
mov ecx, dword [esp + 8]
mov ax, si
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 8
Function at 0x43bdf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7450
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov ebp, ecx
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.00475930
push 0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 1
call fcn.00475930
push 0
mov ecx, 0x4c4538
mov byte [esp + 0x2c], 2
call fcn.0041b6f0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00475910
lea ecx, [esp + 0x10]
call fcn.00475ae0
lea ecx, [esp + 0xc]
call fcn.00475d00
movsx eax, ax
sub eax, 2
cdq
sub eax, edx
sar eax, 1
test ax, ax
jle 0x43bf23
movsx eax, ax
mov esi, 3
mov dword [esp + 0x14], eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0
call fcn.00475930
lea ecx, [esp + 0x14]
call fcn.00475ae0
lea edi, [esi - 1]
lea ecx, [esp + 0xc]
push edi
call fcn.00475c70
test al, al
jne 0x43beb6
push esi
lea ecx, [esp + 0x10]
call fcn.00475c70
test al, al
je 0x43bf11
push edi
lea ecx, [esp + 0x10]
call fcn.00475c70
push eax
lea ecx, [esp + 0x14]
call fcn.00475ce0
push esi
lea ecx, [esp + 0x10]
call fcn.00475c70
push eax
lea ecx, [esp + 0x14]
call fcn.00475ce0
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00475910
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x34], 3
call fcn.00475910
mov ecx, ebp
mov byte [esp + 0x30], 2
call fcn.0043bb80
mov eax, dword [esp + 0x14]
add esi, 2
dec eax
mov dword [esp + 0x14], eax
jne 0x43be80
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.00475a40
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00475a40
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.00475a40
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 4
Function at 0x449da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a81e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 3
or edi, 0xffffffff
call fcn.00475930
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov byte [esp + 0x28], 4
call fcn.00475910
mov ecx, dword [0x4c4560]
call fcn.0042d870
test ax, ax
jne 0x449e58
lea ecx, [esp + 8]
mov byte [esp + 0x20], 3
call fcn.00475a40
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 2
call fcn.00475a40
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 1
call fcn.00475a40
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 0
call fcn.00475a40
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], 0xffffffff
call fcn.00475a40
mov ax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x1c
ret 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x34]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00475910
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov byte [esp + 0x30], 5
call fcn.00475910
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x34], 6
call fcn.00475910
mov ecx, esi
mov byte [esp + 0x30], 4
call fcn.004498e0
test ax, ax
je 0x449ee0
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00475910
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x2c], 7
call fcn.00475910
mov ecx, esi
mov byte [esp + 0x28], 4
call fcn.00449f40
mov edi, eax
lea ecx, [esp + 8]
mov byte [esp + 0x20], 3
call fcn.00475a40
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 2
call fcn.00475a40
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 1
call fcn.00475a40
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 0
call fcn.00475a40
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], 0xffffffff
call fcn.00475a40
mov ecx, dword [esp + 0x18]
mov ax, di
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x1c
ret 0x10
Function at 0x4761e0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4aa86f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.00475900
mov ecx, 9
mov esi, str.CE8E31D2_F5FE_469b_A69A_299595D3F40E
lea edi, [esp + 0x18]
mov ebp, dword [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x58]
xor ecx, ecx
test esi, esi
mov dword [esp + 0x48], 1
mov ebx, ebp
jle 0x476261
mov eax, ecx
xor edx, edx
mov edi, 0x26
div edi
mov al, byte [ebp]
mov dl, byte [esp + edx + 0x18]
xor dl, al
mov al, dl
shr al, 4
shl dl, 4
or al, dl
inc ebp
not al
mov byte [ebp - 1], al
inc ecx
cmp ecx, esi
jl 0x476238
push esi
push ebx
lea ecx, [esp + 0x18]
call fcn.00475dc0
mov esi, dword [esp + 0x50]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00475910
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0
call fcn.00475a40
mov ecx, dword [esp + 0x40]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0xc