joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40885b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x408863
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x4088fb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x4088a9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40890a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x4088be
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x4088d0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x408890
jmp 0x4088d9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x408890
cmp edi, ebx
jge 0x4088f0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x408894
jmp 0x4088f4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x40889d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x408992
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x408992
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408944
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x408930
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x408992
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x408950
dec eax
mov ecx, 1
xor esi, esi
jmp 0x4089ac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x40885b
test edx, edx
mov dword [esp], ecx
js 0x4089e0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x4089f0
inc ebp
dec edx
cmp edi, ebp
jne 0x4089c0
mov edx, 0xffffffff
jmp 0x4089f2
xor edi, edi
jmp 0x4089f5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x4089a0
and ebp, 3
je 0x408a28
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408a10
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x408a2a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x4089a0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408a40
jmp 0x4089a0
Function at 0x409590
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x4095f5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x4095b0
mov eax, 0x270
jmp 0x4096cf
cmp eax, 0x4e0
jb 0x4096cf
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x409610
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x409660
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret
Function at 0x41bc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], 0xbf14bd53
mov dword [esp + 0x24], 0x832d8133
mov dword [esp + 0x28], 0x8786852a
mov eax, 0xff5cd55c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xa32ac4]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xe5
and ecx, 0x1a
sub ecx, edx
add cl, 5
mov byte [esp + eax + 0xa32ac4], cl
inc eax
cmp eax, 0xff5cd568
jne 0x41bc60
mov dword [esp + 0x48], 0x61f47fd6
mov dword [esp + 0x4c], 0x65f463f6
mov dword [esp + 0x50], 0x698767bc
mov dword [esp + 0x54], 0x6dc06b85
mov dword [esp + 0x58], 0x51f36fc1
mov dword [esp + 0x5c], 0x55f853f3
mov dword [esp + 0x60], 0x59f757fe
mov dword [esp + 0x64], 0x5dc85bc9
mov dword [esp + 0x68], 0x41405f84
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x48]
add cl, 0x90
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 0x24
jne 0x41bce0
movzx ecx, word [esp + 0x48]
lea eax, [esp + 0x15c]
test cx, cx
je 0x41bd21
lea edx, [esp + 0x4a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bd10
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x41bd51
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bd40
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0x41bd81
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bd70
mov word [eax], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x6f6c6c82
mov byte [esp + 0x4c], 0x8c
mov eax, 0xc8
mov ecx, 0xf6d85a37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x80]
mov edi, eax
xor edi, ecx
and edi, edx
xor edi, ecx
mov edx, 0xbe
sub edx, edi
lea esi, [edi + 0x493d2e41]
or esi, 1
sub esi, edi
lea ebx, [esi - 0x493d2e41]
neg esi
and esi, 2
mov edi, ebx
and edi, 0xfd
imul edi, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
xor edx, 1
add edx, edi
add edx, ebx
mov byte [esp + eax - 0x80], dl
inc eax
dec ecx
cmp eax, 0xcd
jne 0x41bdb0
movzx eax, byte [esp + 0x48]
test al, al
je 0x41be2d
lea ecx, [esp + 0x49]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41be20
jmp 0x41be31
mov edi, dword [esp + 4]
mov byte [edi], 0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.0040ba40
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x183794]
mov ecx, 0xae6ce794
xor ecx, dword [0x18379c]
add eax, ecx
inc eax
jmp eax
Function at 0x43d660
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x11102ffe
mov eax, esp
mov ecx, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x225a3100]
or esi, edx
and edx, ecx
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
add edi, 0xed2e790f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x1d
jne 0x43d680
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret

Function at 0x43df70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43df90
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43dfab
mov eax, 0xffffffff
jmp 0x43dfae
add eax, 0xa
push eax
call fcn.00408bf0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43dff1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43dfe0
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232ac]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232ac], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43e070
mov esi, dword [esp]
mov ecx, dword [0x18965c]
test ecx, ecx
je 0x43e102
xor edx, edx
mov edi, dword [0x189660]
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43e0c0
inc edx
cmp ecx, edx
jne 0x43e0b0
jmp 0x43e102
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43e102
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x189664]
mov edi, eax
call fcn.0043c080
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408c00
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e120
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43e140
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43e15b
mov eax, 0xffffffff
jmp 0x43e15e
add eax, 0xa
push eax
call fcn.00408bf0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43e1a1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43e190
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232ac]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232ac], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43e220
mov esi, dword [esp]
mov ecx, dword [0x18965c]
test ecx, ecx
je 0x43e2a4
xor edx, edx
mov ebx, dword [0x189660]
nop
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43e270
inc edx
cmp ecx, edx
jne 0x43e260
jmp 0x43e2a4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43e2a4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x189664]
mov edi, eax
call fcn.0043c080
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408c00
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43e2e0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43e2fb
mov eax, 0xffffffff
jmp 0x43e2fe
add eax, 0xa
push eax
call fcn.00408bf0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43e341
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43e330
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp], si
add ecx, edx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xc8c9cacb
mov ecx, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x698232cc]
xor esi, ecx
mov edx, esi
and edx, 0x5f
add edx, edx
xor esi, 0xa0
sub edx, esi
mov byte [esp + ecx + 0x698232cc], dl
inc ecx
cmp ecx, 0x967dcd58
jne 0x43e3c0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x18965c]
test ecx, ecx
je 0x43e439
xor edx, edx
mov edi, dword [0x189660]
nop
cmp dword [edi + edx*8], 0xcaa82e26
je 0x43e410
inc edx
cmp ecx, edx
jne 0x43e400
jmp 0x43e439
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43e439
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x189664]
mov edi, eax
call fcn.0043c080
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00408c00
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43e44f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x43e480
mov eax, dword [esp]
mov edx, dword [0x18965c]
test edx, edx
je 0x43e4f8
xor ebx, ebx
mov ecx, dword [0x189660]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x43e4d0
inc ebx
cmp edx, ebx
jne 0x43e4c0
jmp 0x43e4f8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43e4f8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x189664]
call fcn.0043c080
add esp, 0x20
test edi, edi
je 0x43e502
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43e50e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43e680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xc8c9cacb
mov eax, 0x967dcd54
movzx edi, byte [esp + eax + 0x698232b0]
xor edi, eax
mov ebx, edi
and ebx, 0x5f
add ebx, ebx
xor edi, 0xa0
sub ebx, edi
mov byte [esp + eax + 0x698232b0], bl
inc eax
cmp eax, 0x967dcd58
jne 0x43e6a0
mov eax, dword [esp + 4]
mov ebx, dword [0x18965c]
test ebx, ebx
je 0x43e71e
xor ebp, ebp
mov edi, dword [0x189660]
nop
nop
cmp dword [edi + ebp*8], 0x88822328
je 0x43e6f0
inc ebp
cmp ebx, ebp
jne 0x43e6e0
jmp 0x43e71e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43e71e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x189664]
call fcn.0043c080
add esp, 0x30
cmp eax, 0x103
jne 0x43e7b9
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x43e740
mov eax, dword [esp]
mov ecx, dword [0x18965c]
test ecx, ecx
je 0x43e7b1
xor edx, edx
mov edi, dword [0x189660]
nop
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43e790
inc edx
cmp ecx, edx
jne 0x43e780
jmp 0x43e7b1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43e7b1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x189664]
call fcn.0043c080
add esp, 0x18
test eax, eax
js 0x43e7b9
mov eax, dword [esp + 4]
test esi, esi
je 0x43e7c3
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454004]
jne 0x401010
repz ret
jmp fcn.00401866

Function at 0x403848
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
mov esi, str.KERNEL32.DLL
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4037dd
push esi
call fcn.00403af7
pop ecx
mov edi, eax
test edi, edi
je 0x403945
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlsAlloc
push edi
call esi
push str.FlsGetValue
push edi
mov dword [0x456fcc], eax
call esi
push str.FlsSetValue
push edi
mov dword [0x456fd0], eax
call esi
push str.FlsFree
push edi
mov dword [0x456fd4], eax
call esi
cmp dword [0x456fcc], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x456fd8], eax
je 0x403846
cmp dword [0x456fd0], 0
je 0x403846
cmp dword [0x456fd4], 0
je 0x403846
test eax, eax
jne 0x40386a
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x456fd0], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x456fcc], 0x40349f
mov dword [0x456fd4], esi
mov dword [0x456fd8], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4548c4], eax
cmp eax, 0xffffffff
je 0x40394a
push dword [0x456fd0]
push eax
call esi
test eax, eax
je 0x40394a
call fcn.00403de1
push dword [0x456fcc]
call fcn.004033b2
push dword [0x456fd0]
mov dword [0x456fcc], eax
call fcn.004033b2
push dword [0x456fd4]
mov dword [0x456fd0], eax
call fcn.004033b2
push dword [0x456fd8]
mov dword [0x456fd4], eax
call fcn.004033b2
add esp, 0x10
mov dword [0x456fd8], eax
call fcn.00401a27
test eax, eax
je 0x403945
push 0x403693
push dword [0x456fcc]
call fcn.0040342d
pop ecx
call eax
mov dword [0x4548c0], eax
cmp eax, 0xffffffff
je 0x403945
push 0x214
push 1
call fcn.004045f5
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x403945
push esi
push dword [0x4548c0]
push dword [0x456fd4]
call fcn.0040342d
pop ecx
call eax
test eax, eax
je 0x403945
push 0
push esi
call fcn.00403519
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x40394c
call fcn.004034dc
xor eax, eax
pop edi
pop esi
ret
Function at 0x4069ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403424
and dword [ebp - 4], 0
cmp dword [0x457484], 0
mov ebx, eax
jne 0x406a5c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406b0d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406b0d
push eax
call fcn.004033b2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x457484], eax
call esi
push eax
call fcn.004033b2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x457488], eax
call esi
push eax
call fcn.004033b2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45748c], eax
call esi
push eax
call fcn.004033b2
pop ecx
mov dword [0x457494], eax
test eax, eax
je 0x406a5c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004033b2
pop ecx
mov dword [0x457490], eax
mov eax, dword [0x457490]
cmp eax, ebx
je 0x406ab4
cmp dword [0x457494], ebx
je 0x406ab4
push eax
call fcn.0040342d
push dword [0x457494]
mov esi, eax
call fcn.0040342d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406ab4
test edi, edi
je 0x406ab4
call esi
test eax, eax
je 0x406aab
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406aab
test byte [ebp - 0xc], 1
jne 0x406ab4
or dword [ebp + 0x10], 0x200000
jmp 0x406aed
mov eax, dword [0x457488]
cmp eax, ebx
je 0x406aed
push eax
call fcn.0040342d
pop ecx
test eax, eax
je 0x406aed
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406aed
mov eax, dword [0x45748c]
cmp eax, ebx
je 0x406aed
push eax
call fcn.0040342d
pop ecx
test eax, eax
je 0x406aed
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x457484]
call fcn.0040342d
pop ecx
test eax, eax
je 0x406b0d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406b0f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44d6d0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x455000]
push ebx
mov ebx, dword [0x82a1d4]
push esi
mov esi, dword [0x82a01c]
push eax
call fcn.0044d5c0
add esp, 4
cmp dword [0x82a1d4], 0x2f
jne 0x44d6fb
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
call fcn.0044d630
add esp, 4
cmp dword [0x82a1d4], 0x568
pop esi
pop ebx
jne 0x44d71a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
ret