joyce8/EMBER2024-capa huggingface dataset:
Function at 0x585ec8
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, edx
test eax, eax
je 0x585ee4
call fcn.00585c40
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
add esp, 0x18
pop ebx
ret
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp], str.null_tree_n
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
add esp, 0x18
pop ebx
ret
Function at 0x588620
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
push ebx
mov ebx, eax
mov edi, edx
mov ebp, ecx
mov edx, dword [edx + 4]
test edx, edx
jle 0x58863f
mov eax, dword [edi + 0x14]
test byte [eax + 8], 1
jne 0x5886d8
mov dword [esp], ebp
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.00588298
mov ecx, dword [edi + 0x10]
xor edx, edx
test ecx, ecx
mov ebx, dword [eax]
jle 0x588665
mov dword [ebx + edx*4], 0
inc edx
cmp dword [edi + 0x10], edx
jg 0x588658
mov edx, dword [edi + 0x28]
mov ecx, dword [edx + 0xc]
mov esi, ecx
shr esi, 5
mov edx, 1
shl edx, cl
or dword [ebx + esi*4], edx
mov ecx, dword [edi + 0x10]
cmp ecx, 1
je 0x5886dc
test ecx, ecx
jle 0x5886e0
mov edx, ebx
lea ebx, [ebx + ecx*4]
xor ecx, ecx
lea esi, [esi]
xor ecx, dword [edx]
add edx, 4
cmp edx, ebx
jne 0x588690
mov dword [eax + 4], ecx
mov dword [eax + 8], 0xd
mov edx, dword [edi + 4]
test edx, edx
jle 0x5886bf
mov esi, dword [edi + 0x14]
xor ebx, ebx
nop
mov dword [esi + 0x14], 0
inc ebx
add esi, 0x20
cmp ebx, edx
jl 0x5886b0
mov dword [eax + 0x14], ebp
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
jmp 0x5886ad
mov ecx, dword [ebx]
jmp 0x588699
xor ecx, ecx
jmp 0x588699
Function at 0x58c6d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov eax, dword [ebp]
cmp dword [edi], eax
jle 0x58c708
mov dword [esp + 4], edi
lea ebx, [esp + 0x10]
mov dword [esp], ebx
call fcn.005252a4
test eax, eax
jne 0x58c759
mov esi, dword [ebp]
mov edi, ebp
jmp 0x58c71e
mov dword [esp + 4], ebp
lea ebx, [esp + 0x10]
mov dword [esp], ebx
call fcn.005252a4
test eax, eax
jne 0x58c759
mov esi, dword [edi]
test esi, esi
jle 0x58c737
mov edx, dword [esp + 0x1c]
mov edi, dword [edi + 0xc]
xor eax, eax
nop
mov ecx, dword [edi + eax*4]
xor dword [edx + eax*4], ecx
inc eax
cmp eax, esi
jne 0x58c72c
mov dword [esp], ebx
call fcn.0058aa84
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.0058c180
mov dword [esp], ebx
call fcn.0052532c
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x599f2c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test edx, edx
je 0x599f44
jmp fcn.00599b00
xor eax, eax
ret
Function at 0x5aea46
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x5aea89
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_UnmapViewOfFile
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x5aebd4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
add eax, 0x1c
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov ecx, edx
call eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x10], 0x4000000
jle 0x5aeacb
mov eax, dword [ebp - 0x10]
sub eax, 0x4000000
and eax, 0xffff0000
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
jle 0x5aebd4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp], eax
call sub.KERNEL32.dll_FlushFileBuffers
sub esp, 4
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileMappingA
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5aebd4
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_MapViewOfFile
sub esp, 0x14
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x5aebc6
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x18]
add edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
neg edx
add edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x5cf6f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
je 0x5cf710
cmp dword [eax + 0x118], 0
jne 0x5cf70c
jmp fcn.005c9134
ret
mov dword [eax + 0x118], 1
ret

Function at 0x5cfd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx], 0x2d
je 0x5cfd1c
cmp dword [eax + 0x118], 0
jne 0x5cfd1b
jmp fcn.005c9134
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ecx + 4]
mov edi, dword [edx + 8]
mov ebp, dword [edx + 4]
test edi, edi
je 0x5cfd14
mov edx, dword [eax + 0x100]
xor ebx, ebx
jmp 0x5cfd53
mov esi, edx
inc edx
mov byte [eax + esi], cl
mov dword [eax + 0x100], edx
mov byte [eax + 0x104], cl
inc ebx
cmp edi, ebx
je 0x5cfd14
mov cl, byte [ebp + ebx]
cmp edx, 0xff
jne 0x5cfd3c
mov byte [eax + 0xff], 0
mov edx, dword [eax + 0x10c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xff
mov dword [esp], eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
call dword [eax + 0x108]
mov eax, dword [esp + 0x18]
inc dword [eax + 0x120]
mov edx, 1
xor esi, esi
mov cl, byte [esp + 0x1c]
jmp 0x5cfd3f
Function at 0x5d4860
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x5d48c0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x5d49b6
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x5d4930
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x5d4905
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x5d4915
cmp byte [esp + 0x1e], 0
je 0x5d4915
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x5d4915
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.005d4860
nop

Function at 0x5d4c50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x68cb44
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x68cb5c]
sub esp, 4
test ebx, ebx
je 0x5d4c9b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x5d4c94
test esi, esi
je 0x5d4c94
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x5d4c70
mov dword [esp], 0x68cb44
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x5d78e0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x68cb78], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
mov dword [0x68cb7c], eax
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x5d7940
mov dword [0x68cb84], eax
mov dword [esp + 4], 0x5d78a4
mov dword [esp], eax
call fcn.005dae30
test eax, eax
jne 0x5d7947
add esp, 0x1c
ret
call sub.KERNEL32.dll_GetLastError
jmp 0x5d7938
call sub.msvcrt.dll_abort
Function at 0x5df720
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.005d4c30
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x5df756
jmp 0x5df795
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x5df753
cmp al, 0x20
je 0x5df753
cmp al, 0x22
jne 0x5df779
jmp 0x5df7e4
cmp al, 0x20
lea esi, [esi]
je 0x5df780
test al, al
je 0x5df795
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x5df767
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x5df7fa
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x5df787
cmp al, 0x20
je 0x5df787
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x5df7a4
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040323c
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x5df7ee
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x5df7e0
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x5df780
cmp al, 9
je 0x5df787
jmp 0x5df795
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43b64e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
add edi, 0xeb5b49b4
add ebx, 0xa79aa47
add edi, edi
call fcn.0043b68d
add edi, ebx
or edi, edi
xor dword [eax], edx
or ebx, ebx
and edi, edi
sub edi, edi
inc eax
add ebx, 0x731641a6
cmp eax, esi
jne fcn.0043b64e
sub edi, 1
inc edi
ret
Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x4d5370f5
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5c9a69cb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x41f040
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
test ax, ax
jne 0x41f05a
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
cmp byte [0x465dd8], 0
mov word [esi + 6], ax
pop esi
jne 0x41f088
push 0x421070
mov byte [0x465dd8], 1
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x421350
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_set_terminate]
add esp, 4
push str..UTF8
push 2
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov ecx, 2
add esp, 8
mov eax, ecx
mov edx, 0x4650a8
xchg dword [edx], eax
mov eax, 0x465dc4
xchg dword [eax], ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
ret

Function at 0x4233a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438b64
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x465040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
push edi
call fcn.00406570
lea eax, [edi + 0x18]
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x18]
push eax
call fcn.00406570
lea eax, [edi + 0x30]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x30]
push eax
call fcn.00406570
lea eax, [edi + 0x48]
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x48]
push eax
call fcn.00406570
mov byte [ebp - 4], 3
lea esi, [ebx + 0x60]
mov eax, dword [edi + 0x60]
mov dword [esi], eax
push 0x38
mov dword [ebp + 8], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004359eb
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 5
mov eax, dword [edi + 0x78]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x7c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x70]
sub eax, dword [edi + 0x6c]
push dword [esi + 4]
sar eax, 2
push eax
call fcn.004236d0
mov eax, dword [edi + 0x64]
mov ecx, esi
push eax
push dword [eax]
call fcn.00423dc0
movzx eax, byte [edi + 0x80]
mov byte [ebx + 0x80], al
movzx eax, byte [edi + 0x81]
mov byte [ebx + 0x81], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4234b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438bd4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x465040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 7
mov word [edi + 0x18], ax
movups xmmword [edi + 0x30], xmm0
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 7
mov word [edi + 0x30], ax
movups xmmword [edi + 0x48], xmm0
movq qword [edi + 0x58], xmm0
movups xmmword [edi + 0x48], xmm0
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], 7
mov word [edi + 0x48], ax
mov byte [ebp - 4], 3
lea esi, [edi + 0x60]
mov dword [ebp - 0x14], esi
mov dword [esi], eax
push 0x38
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call fcn.004359eb
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 5
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004236d0
mov word [edi + 0x80], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret