joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dedf0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x511c01
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x4dee2d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.00508538
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.00507880
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.004d7d90
lea ecx, [esp + 8]
call fcn.005087a7
lea ecx, [esp + 0x30]
call fcn.005079e4
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.00507880
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.004d8200
lea ecx, [esp + 0x74]
call fcn.005079e4
lea ecx, [esp + 8]
call fcn.005087a8
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.004d59a0
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.004d7ca0
mov ecx, esi
call fcn.004d8840
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.004d7ca0
mov ecx, esi
call fcn.004d8840
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.004d7ca0
mov ecx, esi
call fcn.004d8840
mov ecx, dword [edi + 0x5c]
call fcn.004d5180
push eax
mov ecx, esi
call fcn.004d5190
mov ecx, dword [edi + 0x5c]
call fcn.004d5740
push eax
mov ecx, esi
call fcn.004d56e0
mov ecx, dword [edi + 0x5c]
call fcn.004d5860
push eax
mov ecx, esi
call fcn.004d5810
mov ecx, dword [edi + 0x5c]
push 0
call fcn.004d4a60
push eax
mov ecx, esi
call fcn.004d4a70
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.0050795c
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.0050795c
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.005085c1
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x4e06a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x511e27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.004fe915
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.004fe915
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004e11c0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x4e1210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x511f00
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0050a6e0
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x4e1243
xor al, al
jmp 0x4e136f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x4e1265
xor al, al
jmp 0x4e136f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x4e1278
xor al, al
jmp 0x4e136f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x4e128c
xor al, al
jmp 0x4e136f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004fe9da
test eax, eax
jne 0x4e12c0
xor al, al
jmp 0x4e136f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x6a6d6c
mov dword [esp + 0x20], ebp
call fcn.0050a6e0
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.00507535
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.0050758c
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x4e1354
mov ax, word [ebx]
test ax, ax
je 0x4e1346
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.004e1390
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x4e132a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0050758c
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x4e1890
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.00508be5
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4e18d6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.004eef28
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x6c7378
push ecx
call fcn.004f0b2f
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x4e9740
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4e9789
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4e9c00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x512230
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004e97b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004e9830
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004e9830
lea ecx, [esi + 0xc]
call fcn.005006a0
lea ecx, [esi + 0x10]
call fcn.005006a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004eadc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004eadc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004eadc0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00500715
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00500715
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4eafb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4eb016
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4eb016
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4eaff7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x502af5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x502b2d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00500b70
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00500b48
jmp 0x502b39
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5042f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x504332
call fcn.0050a6e0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x504332
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x504329
xor eax, eax
jmp 0x50433a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00504340
pop edi
pop esi
pop ebx
ret 4

Function at 0x50ac10
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x50ac3e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x50ac5c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0050ab76
jmp 0x50ac5c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x50ac5c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0050ab76
test edi, edi
mov eax, edi
jne 0x50ac46
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001171
Capabilities:
Encode data using xor

Disassembly:
push eax
push ecx
push edi
lea eax, str.WAREZD_OWNFOR_FORUMR_UBOARD_COMINC_RACKWE_TRUSTW_AREZDO_WNWD
lea edi, [0x100030c5]
mov ecx, dword [eax]
xor dword [edi], ecx
add edi, 4
add eax, 4
cmp dword [edi], 0
jne 0x10001180
pop edi
pop ecx
pop eax
ret
Function at 0x402100
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed4b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x66a030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea edi, [eax + 4]
mov dword [eax], 0
mov ecx, edi
call fcn.00406e00
push ecx
push 0
lea ecx, [edi + 0xc]
call fcn.00407240
mov eax, dword [ebx]
mov ecx, ebx
push 0
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x402169
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0049b982
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x402185
push 0x80004005
call fcn.00402df0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp + 0xc], esi
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push 0x637388
call fcn.00408bd0
test eax, eax
je 0x4021be
cmp dword [eax], 0
jne 0x4021be
add eax, 8
lea ecx, [ebp + 0xc]
push eax
call fcn.004024c0
mov esi, dword [ebp + 0xc]
call fcn.0049b982
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4021da
push 0x80004005
call fcn.00402df0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push esi
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push str.SELECT__FROM__config__WHERE_ID___s_
push eax
call fcn.00402640
add esp, 0xc
mov ecx, ebx
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00408070
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x40221c
lea edx, [ebx + 0x14]
push edx
call fcn.004024c0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
cmp dword [ebp - 0x10], 0
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0
setge bl
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402248
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x402264
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403db0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push edi
mov edi, edx
test esi, esi
je 0x403fa6
test edi, edi
je 0x403fa6
push ebx
mov ebx, esi
lea ecx, [ebx + 1]
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x403de0
sub ebx, ecx
mov eax, ebx
and eax, 0x80000003
jns 0x403df7
dec eax
or eax, 0xfffffffc
inc eax
je 0x403e05
pop ebx
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
test ebx, ebx
jle 0x403f87
nop
mov cl, byte [edx + esi]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x403e1f
sub cl, 0x41
jmp 0x403e52
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x403e2b
sub cl, 0x47
jmp 0x403e52
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x403e37
add cl, 4
jmp 0x403e52
cmp cl, 0x2b
jne 0x403e40
mov cl, 0x3e
jmp 0x403e52
cmp cl, 0x2f
jne 0x403e49
mov cl, 0x3f
jmp 0x403e52
cmp cl, 0x3d
setne cl
add cl, 0x40
movzx eax, cl
cmp eax, 0x40
jne 0x403eb8
lea eax, [ebx - 1]
cmp edx, eax
je 0x403e6c
lea eax, [ebx - 2]
cmp edx, eax
jne 0x403ef3
lea eax, [ebx - 2]
cmp edx, eax
jne 0x403eb3
mov cl, byte [edx + esi + 1]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x403e86
sub cl, 0x41
cmp cl, 0x40
jmp 0x403eb1
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x403e95
sub cl, 0x47
cmp cl, 0x40
jmp 0x403eb1
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x403ea4
add cl, 4
cmp cl, 0x40
jmp 0x403eb1
cmp cl, 0x2b
je 0x403eff
cmp cl, 0x2f
je 0x403eff
cmp cl, 0x3d
jne 0x403eff
inc dword [ebp - 4]
jmp 0x403ebd
cmp eax, 0x41
je 0x403f0b
inc edx
cmp edx, ebx
jl 0x403e10
test ebx, ebx
jle 0x403f87
lea eax, [edi + 2]
mov dword [ebp - 8], eax
lea eax, [ebx - 1]
shr eax, 2
inc eax
mov dword [ebp - 0xc], eax
nop
xor edx, edx
lea edi, [edx + 4]
mov al, byte [esi]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x403f17
sub al, 0x41
jmp 0x403f46
pop ebx
pop edi
mov eax, 3
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 4
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 5
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x403f23
sub al, 0x47
jmp 0x403f46
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x403f2f
add al, 4
jmp 0x403f46
cmp al, 0x2b
jne 0x403f37
mov al, 0x3e
jmp 0x403f46
cmp al, 0x2f
jne 0x403f3f
mov al, 0x3f
jmp 0x403f46
cmp al, 0x3d
setne al
add al, 0x40
movzx eax, al
inc esi
and eax, 0x3f
or eax, edx
shl eax, 6
mov edx, eax
sub edi, 1
jne 0x403ee5
mov ecx, dword [ebp - 8]
shl edx, 2
mov eax, edx
shl edx, 8
shr eax, 0x18
mov byte [ecx - 2], al
mov eax, edx
shr eax, 0x18
shr edx, 0x10
mov byte [ecx - 1], al
mov byte [ecx], dl
add ecx, 3
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], ecx
jne 0x403ee0
mov eax, ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
pop ebx
pop edi
pop esi
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 8]
sub ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ef50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x66b798], 0
je 0x40efa7
mov eax, dword [0x676fe8]
test eax, eax
je 0x40ef80
push eax
call dword [0x66b7ec]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.0040c750
mov eax, dword [0x676fe8]
test eax, eax
je 0x40efa2
push eax
call dword [0x66b7f4]
mov esi, dword [ebp - 4]
jmp 0x40efb1
mov esi, dword [ebp - 4]
jmp 0x40efb4
push 0x14
call dword [0x66b7bc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x40efc2
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x66b79c], 0
mov ebx, dword [ebp + 8]
je 0x40eff5
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x40ef20
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.005d3a7e
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x40f002
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x40f01b
call dword [0x5fe46c]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410f40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x410f6e
nop dword [eax + eax]
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x63e8d8]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x410f50
pop esi
ret
Function at 0x410fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov ecx, 0x80
mov dword [ebp - 4], esi
lea eax, [edi*8]
cmp eax, 0x400
cmova edi, ecx
cmp edi, dword [esi]
jne 0x411011
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x677010]
test eax, eax
je 0x41101c
call eax
lea eax, [edi*8]
push 0
push eax
call fcn.0040c840
mov ecx, dword [0x677014]
add esp, 8
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ecx, ecx
je 0x41103f
call ecx
test ebx, ebx
je 0x411008
push dword [esi + 0xc]
call fcn.0040cb60
add esp, 4
mov dword [esi + 0xc], ebx
push ebx
call dword [0x66b7c8]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [esi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.005cbe10
mov ecx, dword [esi + 8]
add esp, 0xc
mov dword [esi + 8], 0
test ecx, ecx
je 0x411122
mov edi, dword [ecx + 0xc]
xor ebx, ebx
mov al, byte [edi]
test al, al
je 0x4110b1
movzx eax, al
lea edx, [ebx*8]
lea edi, [edi + 1]
movzx esi, byte [eax + 0x63e8d8]
mov al, byte [edi]
xor esi, edx
xor ebx, esi
test al, al
jne 0x411093
xor edx, edx
mov edi, dword [ecx]
mov eax, ebx
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x4110fc
mov eax, dword [esi]
test eax, eax
je 0x4110cf
mov edx, dword [esi + 4]
jmp 0x4110d1
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x4110fc
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x4110f1
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x411118
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x411118
mov esi, dword [ebp - 4]
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x41110e
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [esi + 8], ecx
mov ecx, edi
test edi, edi
jne 0x411088
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
push esi
push edi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x411185
mov al, byte [edx]
xor esi, esi
mov edi, edx
test al, al
je 0x41116e
nop
movzx eax, al
lea ecx, [esi*8]
lea edi, [edi + 1]
movzx edx, byte [eax + 0x63e8d8]
mov al, byte [edi]
xor edx, ecx
xor esi, edx
test al, al
jne 0x411150
xor edx, edx
mov eax, esi
div dword [ebx]
mov ebx, dword [ebx + 0xc]
mov ecx, edx
mov edx, dword [ebp - 4]
mov edi, dword [ebx + ecx*8 + 4]
mov ebx, dword [ebx + ecx*8]
jmp 0x41118d
mov edi, dword [ebx + 8]
xor ecx, ecx
mov ebx, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ebx, ebx
je 0x4111f2
mov eax, dword [edi + 0xc]
dec ebx
test eax, eax
jne 0x4111a6
mov eax, edx
neg eax
sbb eax, eax
jmp 0x4111e8
test edx, edx
je 0x4111ec
mov cl, byte [eax]
mov esi, edx
test cl, cl
je 0x4111d2
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x63e8d8]
cmp cl, byte [edx + 0x63e8d8]
jne 0x4111cf
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x4111b2
mov edx, dword [ebp - 4]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x63e8d8]
movzx ecx, byte [ecx + 0x63e8d8]
sub eax, ecx
test eax, eax
je 0x4111fb
mov edi, dword [edi]
test ebx, ebx
jne 0x411196
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4215e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x14], edx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
test ebx, ebx
je 0x4216f3
cmp byte [ebx + 9], 0
je 0x421618
inc dword [ebx + 0xc]
cmp byte [ebx + 0xa], 0
jne 0x421618
call fcn.0041dde0
mov esi, dword [ebx + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x4216e0
cmp dword [ebp + 8], 0
je 0x421662
test byte [esi + 0x40], 1
jne 0x421662
mov al, byte [esi + 0x42]
cmp al, 1
je 0x42163d
cmp al, 2
jne 0x42167f
mov ecx, esi
call fcn.0041e110
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x42167f
mov ebx, dword [esp + 0x10]
mov edx, edi
push 0
mov ecx, ebx
call fcn.004215e0
add esp, 4
jmp 0x4216e0
push dword [esi + 0x30]
call fcn.0040cb60
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x4216cd
lea edi, [esi + 0x78]
nop dword [eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x4216bb
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x4216ad
call fcn.00419140
jmp 0x4216b2
call fcn.004153e0
mov ecx, dword [esp + 0x1c]
call fcn.0041a2e0
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x421690
mov esi, dword [esi + 8]
test esi, esi
jne 0x421626
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [ebx + 9], 0
je 0x4216f3
add dword [ebx + 0xc], 0xffffffff
jne 0x4216f3
mov ecx, ebx
call fcn.0041dda0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret