joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409440
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x4de550]
test eax, eax
jne 0x409476
push esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
mov esi, eax
push esi
push 0x4de550
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp dword [0x4de550], esi
je 0x409475
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [0x4de550]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x409650
Capabilities:
Get disk information
Query environment variable

Disassembly:
sub esp, 0x100
push 0x100
push 0
push 0x5c81a0
call fcn.00428e20
add esp, 0xc
push 0xfe
lea eax, [esp + 4]
push eax
push str.SystemDrive
mov dword [0x4de4f8], 0
mov byte [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x409699
cmp eax, 0xfe
jbe 0x4096aa
lea ecx, [esp]
push 0x496ef0
push ecx
call fcn.00428e00
add esp, 8
lea edx, [esp]
push edx
call fcn.0042dad0
add esp, 4
test eax, eax
je 0x4096ca
cmp byte [esp + eax - 1], 0x5c
je 0x4096ca
mov byte [esp + eax], 0x5c
mov byte [esp + eax + 1], 0
push 0
push 0
push 0
push 0
push 0x5c81a0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4096f4
mov dword [0x4de4f8], 4
add esp, 0x100
ret

Function at 0x40a9d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x16c
push ebx
push esi
mov esi, eax
push edi
and eax, 0xf
mov edi, eax
mov eax, dword [esp + 0x180]
push eax
push 0x80
mov ebx, ecx
lea ecx, [esp + 0x3c]
push 0
push ecx
shr esi, 4
call fcn.00425c50
push 0
lea edx, [esp + 0x30]
push 2
push edx
call fcn.00425d50
add esp, 0x1c
test esi, esi
je 0x40aa34
mov eax, dword [esp + 0x17c]
push eax
mov ecx, esi
shl ecx, 7
push ecx
push ebx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00425db0
add esp, 0x14
test edi, edi
je 0x40aa9f
shl esi, 4
push 0x10
lea esi, [esi + ebx - 0x10]
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.0040bf50
add esp, 0xc
xor eax, eax
test edi, edi
jbe 0x40aa68
mov bl, byte [esp + eax + 0xc]
mov dl, byte [esi + eax + 0x10]
xor bl, dl
mov byte [esp + eax + 0xc], bl
inc eax
cmp eax, edi
jb 0x40aa55
lea eax, [esp + 0xc]
push eax
push 0x80
mov ecx, eax
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00425db0
push edi
lea ecx, [esi + 0x10]
push esi
push ecx
call fcn.0040bf50
push 0x10
lea edx, [esp + 0x30]
push edx
push esi
call fcn.0040bf50
add esp, 0x2c
pop edi
pop esi
pop ebx
add esp, 0x16c
ret
Function at 0x40aeb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
push esi
mov esi, dword [eax + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [eax + 8]
push edi
mov dword [esp + 0x28], edx
lea edx, [esp + 0x2c]
add eax, 0xfffffff0
push edx
mov dword [esp + 0x28], ecx
lea ecx, [esi + 0x10]
push eax
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
call fcn.0040aab0
lea ecx, [esp + 0x38]
mov edx, esi
sub edx, ecx
sub ecx, esi
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x58]
sub ecx, esi
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x39]
sub ecx, esi
add esp, 0xc
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x4d]
sub ecx, esi
mov edi, 0xfffffffe
push ebx
lea eax, [esi + 2]
mov dword [esp + 0x18], ecx
sub edi, esi
push ebp
lea esp, [esp]
lea ecx, [edi + eax]
lea ebp, [esp + ecx + 0x34]
mov bl, byte [edx + ebp]
xor bl, byte [ebp]
add eax, 4
mov byte [esp + ecx + 0x54], bl
mov bl, byte [esp + ecx + 0x35]
xor bl, byte [eax - 5]
mov byte [esp + ecx + 0x55], bl
mov bl, byte [eax - 4]
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + eax - 4]
xor cl, bl
mov ebx, dword [esp + 0x14]
mov byte [ebx + eax - 4], cl
mov ecx, dword [esp + 0x18]
mov bl, byte [eax - 3]
mov cl, byte [ecx + eax - 4]
xor cl, bl
mov ebx, dword [esp + 0x1c]
mov byte [ebx + eax - 4], cl
lea ecx, [edi + eax]
cmp ecx, 0x10
jl 0x40af20
push 0x10
lea edx, [esp + 0x58]
push edx
push 3
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0040ab00
add esp, 0x14
test eax, eax
pop ebp
pop ebx
jne 0x40afc5
push 0x10
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00415940
push 0x10
lea eax, [esp + 0x6c]
push eax
push esi
call fcn.00415940
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0040a9d0
add esp, 0x20
xor eax, eax
pop edi
pop esi
add esp, 0x64
ret
Function at 0x40b3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push esi
mov esi, dword [esp + 0x70]
test esi, esi
mov dword [esp + 8], 0
jne 0x40b3bb
xor eax, eax
pop esi
add esp, 0x60
ret
cmp esi, 0x10
jae 0x40b3ca
mov eax, 8
pop esi
add esp, 0x60
ret
mov ecx, dword [esp + 0x68]
lea eax, [esp + 0x70]
push eax
push ecx
call fcn.00408770
add esp, 8
test eax, eax
jne 0x40b513
push ebx
push ebp
push edi
call fcn.0042e100
mov eax, dword [esp + 0x7c]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.0042e8e0
mov edi, eax
add esp, 8
test edi, edi
jne 0x40b509
mov ebp, dword [esp + 0x78]
lea esp, [esp]
cmp esi, 0x20
mov ecx, dword [esp + 0x7c]
mov edx, dword [ecx]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], edx
mov word [esp + 0x24], 0
mov dword [esp + 0x30], 8
mov dword [esp + 0x38], eax
ja 0x40b49e
push 0x30
lea ecx, [esp + 0x44]
push 0
push ecx
call fcn.00428e20
push esi
lea edx, [esp + 0x50]
push ebp
push edx
call fcn.00415940
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x94]
xor eax, eax
cmp esi, 0x10
setne al
lea ecx, [esp + 0x58]
push edx
mov dword [esp + 0x44], esi
mov dword [esp + 0x50], ecx
dec eax
and eax, 0xfffffff0
add eax, 0x20
mov dword [esp + 0x48], eax
lea eax, [esp + 0x3c]
call fcn.0040afd0
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x40b4c3
push esi
lea eax, [esp + 0x44]
push eax
push ebp
call fcn.00415940
add esp, 0xc
jmp 0x40b4c3
mov eax, dword [ecx + 0x28]
mov edx, dword [esp + 0x10]
test eax, eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], ebp
lea eax, [esp + 0x20]
jne 0x40b4bc
call fcn.0040ae80
jmp 0x40b4c1
call fcn.0040aeb0
mov edi, eax
mov ecx, edi
and ecx, 0xfffffff
cmp ecx, 0x2e
jne 0x40b509
mov eax, dword [esp + 0x14]
cmp eax, 3
jae 0x40b509
mov edx, dword [esp + 0x7c]
mov ecx, eax
inc ecx
push edx
mov dword [esp + 0x18], ecx
call fcn.0042e6d0
mov ecx, dword [esp + 0x80]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0042e8e0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40b410
call fcn.0042e160
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x60
ret
Function at 0x410ec0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp dword [ebx], 0
push ebp
push edi
je 0x410edc
pop edi
mov dword [esp + 0xc], 0xdd
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x10]
movzx edx, byte [eax + 2]
xor ecx, ecx
mov ch, byte [eax]
push esi
mov cl, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
cmp ecx, 0x54534421
jne 0x410f23
movzx esi, byte [eax + 6]
xor edx, edx
mov dh, byte [eax + 4]
mov ecx, 1
mov dl, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
or edx, esi
jmp 0x410f43
mov edx, dword [eax]
xor ecx, ecx
cmp edx, 0x54534421
je 0x410f40
pop esi
pop edi
mov dword [esp + 0xc], 0xd8
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
mov edx, dword [eax + 4]
cmp edx, 2
je 0x410f59
pop esi
pop edi
mov dword [esp + 0xc], 0xdf
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
cmp ecx, 1
jne 0x410f7a
movzx edx, byte [eax + 0x16]
xor ecx, ecx
mov ch, byte [eax + 0x14]
mov cl, byte [eax + 0x15]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0x17]
shl ecx, 8
or ecx, edx
jmp 0x410f7d
mov ecx, dword [eax + 0x14]
add ecx, 0x20
push ecx
push eax
call fcn.00437d10
mov esi, eax
add esp, 8
test esi, esi
je 0x411025
push ebx
push esi
call fcn.00437530
mov edi, eax
push esi
mov dword [esp + 0x20], edi
call fcn.00437cb0
add esp, 0xc
test edi, edi
jne 0x41102d
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
xor ebp, ebp
test ecx, ecx
jbe 0x41102d
xor ebx, ebx
jmp 0x410fc0
mov esi, dword [eax + 0x14]
mov ecx, dword [esi + ebx]
mov edx, dword [eax + 0x18]
add esi, ebx
lea eax, [edx + ecx*8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ecx
push edx
call fcn.00437c50
mov edi, eax
add esp, 8
test edi, edi
je 0x411016
push edi
call fcn.004109e0
push edi
mov dword [esi + 0xc], eax
call fcn.00437910
mov eax, dword [esi + 0xc]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
je 0x411036
mov eax, dword [eax]
mov ecx, dword [eax + 8]
inc ebp
add ebx, 0x10
cmp ebp, ecx
jb 0x410fc0
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push edx
call fcn.004108c0
add esp, 4
mov dword [esp + 0x14], 0xc
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [eax]
push ecx
call fcn.004108c0
add esp, 4
pop esi
pop edi
mov dword [esp + 0xc], 0x7d1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
Function at 0x416e70
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416e91
ret
mov eax, dword [esp + 0xc]
ret

Function at 0x4184c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [ecx]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
add dword [eax + 4], edx
mov edx, dword [ecx + 4]
add esi, edx
mov dword [eax], esi
lea edx, [ecx + 0x10]
mov dword [esp + 0x10], 3
mov edi, edi
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
xor ebx, ebp
mov esi, ebx
mov edi, ebp
shr edi, 4
and edi, 0x1f
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
mov edi, dword [edx - 8]
shl ebx, cl
mov ecx, 0x20
or esi, ebx
sub esi, edi
mov dword [eax + 4], esi
mov edi, esi
shr edi, 7
xor esi, ebp
and edi, 0x1f
sub ecx, edi
mov ebx, esi
shr ebx, cl
mov ecx, edi
shl esi, cl
mov ecx, dword [edx - 4]
or ebx, esi
add ecx, ebx
mov ebx, dword [eax + 4]
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx]
mov edi, ecx
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
xor ebx, esi
mov edi, esi
mov dword [eax + 4], esi
shr edi, 7
and edi, 0x1f
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, dword [edx + 4]
or esi, ebx
mov ebx, dword [eax + 4]
add ecx, esi
mov edi, ecx
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx + 8]
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
mov edi, esi
shr edi, 7
and edi, 0x1f
mov dword [eax + 4], esi
xor ebx, esi
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, dword [edx + 0xc]
add edx, 0x20
or esi, ebx
mov ebx, dword [eax + 4]
add ecx, esi
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx - 0x10]
mov edi, ecx
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
mov edi, esi
xor ebx, esi
shr edi, 7
mov dword [eax + 4], esi
and edi, 0x1f
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
mov edi, dword [edx - 0xc]
shl ebx, cl
mov ecx, dword [esp + 0x10]
or esi, ebx
add esi, edi
dec ecx
mov dword [eax], esi
mov dword [esp + 0x10], ecx
jne 0x4184e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x418620
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, 0xc
jmp 0x418630
mov ebx, dword [edi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + ebp*8 + 4]
mov edx, dword [edi]
sub edx, ecx
mov esi, ebx
shr esi, 7
and esi, 0x1f
mov eax, edx
mov ecx, 0x20
sub ecx, esi
shl eax, cl
mov ecx, esi
shr edx, cl
mov ecx, dword [esp + 0x10]
or eax, edx
xor eax, ebx
mov dword [edi], eax
mov edx, dword [ecx + ebp*8]
lea esi, [edx + ebx]
mov edx, eax
shr edx, 4
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
mov ebx, esi
shl ebx, cl
mov ecx, edx
shr esi, cl
or ebx, esi
xor ebx, eax
dec ebp
mov dword [edi + 4], ebx
jne 0x418630
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
sub dword [edi], ecx
mov edx, dword [eax]
mov eax, ebx
pop esi
sub eax, edx
pop ebp
mov dword [edi + 4], eax
pop ebx
ret
Function at 0x423a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 4], ebx
jle 0x423aa0
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
xor esi, esi
nop
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x423a41
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
movzx eax, byte [edi + ebp]
lea ecx, [edi + ebp]
add eax, ebx
and eax, 0x800000ff
jns 0x423a5b
dec eax
or eax, 0xffffff00
inc eax
movzx ebx, al
lea eax, [ebx + ebp]
call fcn.00423a00
movzx ecx, byte [ecx]
movzx edx, byte [eax]
add ecx, edx
and ecx, 0x800000ff
jns 0x423a7e
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, cl
mov cl, byte [eax + ebp]
mov eax, dword [esp + 0x18]
xor byte [esi + eax], cl
mov eax, dword [esp + 0x10]
inc eax
movsx esi, ax
mov dword [esp + 0x10], eax
cmp esi, dword [esp + 0x1c]
jl 0x423a30
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x423ab0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
xor eax, eax
mov ecx, ebx
lea esp, [esp]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x423ac0
xor dl, dl
xor esi, esi
mov ecx, ebx
mov ebp, 0x100
mov eax, dword [esp + 0x14]
movzx edi, dl
movzx eax, byte [edi + eax]
movzx edx, byte [ecx]
sub eax, edx
add eax, esi
and eax, 0x800000ff
jns 0x423af5
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
lea eax, [esi + ebx]
call fcn.00423a00
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x18]
inc ecx
dec ebp
jne 0x423ad5
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x424420
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
jbe 0x424478
push ebx
push esi
mov esi, dword [esp + 0x10]
movzx edx, byte [esi]
mov ecx, eax
and ecx, 0xf
movzx ecx, word [ecx*4 + 0x4983f0]
shr ax, 4
mov ebx, edx
and ebx, 0xf
xor cx, word [ebx*4 + 0x4983f0]
shr edx, 4
xor ecx, eax
mov eax, ecx
and eax, 0xf
movzx eax, word [eax*4 + 0x4983f0]
xor ax, word [edx*4 + 0x4983f0]
shr cx, 4
xor eax, ecx
inc esi
dec edi
jne 0x424431
pop esi
pop ebx
pop edi
ret
Function at 0x428e90
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.00445eb0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
pop esi
ret

Function at 0x428f20
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
mov eax, dword [0x49afe0]
and eax, 0xff00
cmp eax, 0x5000
je 0x428f6d
shr edi, 2
xor edx, edx
test edi, edi
jle 0x428f6d
push ebx
mov edi, edi
mov ecx, dword [esi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x428f40
pop ebx
pop edi
ret

Function at 0x42d920
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 3
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ecx, 0x9e3779b9
push edi
mov ebp, eax
mov edi, ecx
jb 0x42d9d1
mov eax, 0xaaaaaaab
mul ebp
shr edx, 1
jmp 0x42d950
movzx eax, byte [ebx + 1]
add ecx, eax
movzx eax, byte [ebx + 2]
add esi, eax
movzx eax, byte [ebx]
sub eax, esi
sub eax, ecx
add eax, edi
sub ecx, esi
mov edi, esi
shr edi, 0xd
xor eax, edi
sub ecx, eax
mov edi, eax
shl edi, 8
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 0xd
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 0xc
xor eax, edi
sub ecx, esi
sub ecx, eax
mov edi, eax
shl edi, 0x10
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 5
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 3
xor eax, edi
sub ecx, esi
mov edi, eax
shl eax, 0xa
sub ecx, edi
xor ecx, eax
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 0xf
xor esi, eax
add ebx, 3
sub ebp, 3
dec edx
jne 0x42d950
mov eax, dword [esp + 0x18]
add esi, eax
dec ebp
je 0x42d9df
dec ebp
jne 0x42d9e4
movzx edx, byte [ebx + 1]
add ecx, edx
movzx eax, byte [ebx]
add edi, eax
sub edi, esi
sub edi, ecx
sub ecx, esi
mov edx, esi
shr edx, 0xd
xor edi, edx
sub ecx, edi
mov eax, edi
shl eax, 8
xor ecx, eax
sub esi, ecx
sub esi, edi
mov edx, ecx
shr edx, 0xd
xor esi, edx
sub edi, esi
sub edi, ecx
mov eax, esi
shr eax, 0xc
xor edi, eax
sub ecx, esi
sub ecx, edi
mov edx, edi
shl edx, 0x10
xor ecx, edx
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 5
xor esi, eax
mov eax, esi
sub edi, eax
sub edi, ecx
mov edx, eax
shr edx, 3
xor edi, edx
sub ecx, eax
mov edx, edi
sub ecx, edi
shl edx, 0xa
xor ecx, edx
sub eax, ecx
sub eax, edi
pop edi
pop esi
shr ecx, 0xf
pop ebp
xor eax, ecx
pop ebx
ret
Function at 0x42dfd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
push eax
call fcn.0044f8a0
add esp, 4
test eax, eax
jne 0x42e0ef
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x42e0f4
cmp ecx, 0x80
jg 0x42e0f4
push edi
mov edi, dword [esp + 0x28]
xor edx, edx
mov eax, edi
div ecx
test edx, edx
je 0x42e01d
pop edi
mov eax, 0x16
pop esi
add esp, 0x14
ret
test cl, 3
jne 0x42e012
mov ecx, dword [esi]
imul ecx, ecx, 0x58
mov ecx, dword [ecx + 0x582d58]
test ecx, ecx
je 0x42e052
lea edx, [esi + 0x88]
push edx
mov edx, dword [esp + 0x24]
add esi, 8
push esi
push eax
mov eax, dword [esp + 0x30]
push eax
push edx
call ecx
add esp, 0x14
pop edi
pop esi
add esp, 0x14
ret
test edi, edi
push ebx
push ebp
je 0x42e0ea
mov ebp, dword [esp + 0x28]
mov ecx, dword [esi]
imul ecx, ecx, 0x58
lea eax, [esi + 0x88]
push eax
lea edx, [esp + 0x18]
push edx
push ebp
call dword [ecx + 0x582d40]
add esp, 0xc
test eax, eax
jne 0x42e0ec
mov eax, dword [esi + 4]
test eax, eax
jle 0x42e0cb
mov ebx, dword [esp + 0x2c]
lea edi, [esp + 0x14]
mov edx, 0xfffffff8
sub edi, ebp
sub ebx, ebp
sub edx, esi
lea ecx, [esi + 8]
mov eax, ebp
mov dword [esp + 0x10], edx
mov ebp, dword [ecx]
mov edx, dword [edi + eax]
xor edx, ebp
mov ebp, dword [eax]
mov dword [ecx], ebp
mov dword [ebx + eax], edx
mov edx, dword [esp + 0x10]
mov ebp, dword [esi + 4]
add ecx, 4
add edx, ecx
add eax, 4
cmp edx, ebp
jl 0x42e0a2
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x2c]
add ebp, eax
add ecx, eax
sub edi, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edi
jne 0x42e060
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret
mov eax, 0x16
pop esi
add esp, 0x14
ret

Function at 0x42e100
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x579500]
test eax, eax
jne 0x42e14a
push esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
mov esi, eax
push esi
push 0x579500
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp dword [0x579500], esi
je 0x42e135
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7a000
push 0
push 0x4ff500
call fcn.0042df20
add esp, 0xc
pop esi
mov eax, dword [0x579500]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x42e9d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push eax
call fcn.0044f8a0
add esp, 4
test eax, eax
jne 0x42eac4
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x42eac6
cmp ecx, 0x80
jg 0x42eac6
push edi
mov edi, dword [esp + 0x14]
xor edx, edx
mov eax, edi
div ecx
test edx, edx
je 0x42ea17
pop edi
mov eax, 0x16
pop esi
ret
test cl, 3
jne 0x42ea0f
mov edx, dword [esi]
imul edx, edx, 0x58
mov edx, dword [edx + 0x582d54]
test edx, edx
je 0x42ea49
lea ecx, [esi + 0x88]
push ecx
mov ecx, dword [esp + 0x10]
add esi, 8
push esi
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call edx
add esp, 0x14
pop edi
pop esi
ret
test edi, edi
push ebx
push ebp
je 0x42eabf
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edi, [esi + 8]
lea ebx, [ebx]
xor eax, eax
test ecx, ecx
jle 0x42ea76
mov edx, dword [eax + ebp]
xor dword [edi + eax], edx
mov ecx, dword [esi + 4]
add eax, 4
cmp eax, ecx
jl 0x42ea66
mov ecx, dword [esi]
imul ecx, ecx, 0x58
lea eax, [esi + 0x88]
push eax
push ebx
push edi
call dword [ecx + 0x582d3c]
add esp, 0xc
test eax, eax
jne 0x42eac1
mov ecx, dword [esi + 4]
test ecx, ecx
jle 0x42eab0
jmp 0x42eaa0
mov edx, dword [eax + ebx]
mov dword [edi + eax], edx
mov ecx, dword [esi + 4]
add eax, 4
cmp eax, ecx
jl 0x42eaa0
mov eax, dword [esi + 4]
add ebx, eax
add ebp, eax
mov ecx, eax
sub dword [esp + 0x1c], ecx
jne 0x42ea60
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, 0x16
pop esi
ret

Function at 0x42f010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
je 0x42f030
mov ecx, dword [esp + 4]
push esi
nop
movzx esi, byte [ecx]
imul eax, eax, 0x1000193
xor eax, esi
inc ecx
dec edx
jne 0x42f020
pop esi
ret

Function at 0x430070
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x430093
jmp 0x430080
imul eax, eax, 0xf4243
movzx ecx, cl
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x430080
ret
Function at 0x43b320
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push 0
lea eax, [esp + 0xc]
push eax
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x43b33f
pop esi
xor eax, eax
pop ebx
pop ecx
ret
inc esi
mov eax, esi
call fcn.0043b230
test eax, eax
mov dword [esp + 8], eax
je 0x43b339
push esi
push eax
push edi
call ebx
mov ecx, dword [esp + 8]
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
pop ecx
ret

Function at 0x43b430
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
mov ax, word [esp + 8]
shr ax, 0xf
lea edx, [ecx + ecx]
push ebx
push esi
mov esi, 0x16
or eax, edx
mov ecx, eax
mov dword [esp + 0x10], eax
shr ecx, 8
xor cl, al
mov byte [esp + 0x11], cl
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [esp + 0x10]
shr cx, 1
shl eax, 0xf
xor edx, edx
or eax, ecx
mov dword [esp + 0x10], eax
mov dx, word [esp + 0x10]
shr dx, 1
shl eax, 0xf
or eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
add eax, 4
jmp 0x43b490
mov dl, byte [esp + 0x10]
mov cl, dl
shl dl, 1
shr cl, 7
or cl, dl
mov byte [esp + 0x10], cl
mov ebx, dword [esp + 0x10]
shr ebx, 8
mov dl, bl
shl dl, 7
shr bl, 1
or dl, bl
xor dl, cl
mov byte [esp + 0x11], dl
mov ecx, dword [esp + 0x10]
not ecx
mov dx, cx
xor word [eax - 4], dx
mov dword [esp + 0x10], ecx
add ecx, 0x55
mov dword [esp + 0x10], ecx
mov dl, cl
shl dl, 1
shr cl, 7
or cl, dl
mov byte [esp + 0x10], cl
mov byte [esp + 0xc], bl
mov ebx, dword [esp + 0x10]
shr ebx, 8
mov dl, bl
shl dl, 7
shr bl, 1
or dl, bl
xor dl, cl
mov byte [esp + 0x11], dl
mov ecx, dword [esp + 0x10]
not ecx
mov dx, cx
xor word [eax - 2], dx
mov dword [esp + 0x10], ecx
add ecx, 0x55
mov dword [esp + 0x10], ecx
mov dl, cl
shl dl, 1
shr cl, 7
or cl, dl
mov byte [esp + 0x10], cl
mov byte [esp + 0xc], bl
mov ebx, dword [esp + 0x10]
shr ebx, 8
mov dl, bl
shl dl, 7
shr bl, 1
or dl, bl
xor dl, cl
mov byte [esp + 0x11], dl
mov ecx, dword [esp + 0x10]
not ecx
mov dx, cx
xor word [eax], dx
mov dword [esp + 0x10], ecx
add ecx, 0x55
mov dword [esp + 0x10], ecx
mov dl, cl
shl dl, 1
shr cl, 7
or cl, dl
mov byte [esp + 0xc], bl
mov byte [esp + 0x10], cl
mov ebx, dword [esp + 0x10]
shr ebx, 8
mov dl, bl
shr bl, 1
shl dl, 7
or dl, bl
xor dl, cl
mov byte [esp + 0x11], dl
mov ecx, dword [esp + 0x10]
not ecx
mov byte [esp + 0xc], bl
mov dword [esp + 0x10], ecx
mov dx, cx
xor word [eax + 2], dx
add ecx, 0x55
add eax, 8
dec esi
mov dword [esp + 0x10], ecx
jne 0x43b490
pop esi
pop ebx
ret