joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa2db9c
Capabilities:
Encode data using xor

Disassembly:
pushfd
cmp al, 0xf3
pop esp
retf
inc cx
not edi
inc cx
inc edi
call fcn.0082e030
or byte gs:[eax + 0x64], al
pop es
push edx
jp 0xa2dbff
aad 0x90
rcl ah, 1
out 0xa2, eax
sal dh, cl
cmc
cmp byte [eax], 0x1c
mov edi, 0x156e5afa
push eax
mov al, byte [0x4b853cd5]
adc byte [ebp + 0x35], dl
adc dword [edx], esi
ja 0xa2db86
xor dh, byte [edi - 0x49]
or dword [eax + 0x6724d5dd], 0x35
or al, 0x7f
aaa
cmpsd dword [esi], dword es:[edi]
imul edx, dword [edx - 0x16], 0xffffffa1
jle 0xa2dc37
inc ecx
rcr ebx, cl
mov dword [bx + 0x624c], ecx
mov edi, 0xa62da413
into
sbb al, 0x50
insd dword es:[edi], dx
cmp al, 0xee
push ds
ror byte [edi], cl
aad 0xb4
pop esi
scasb al, byte es:[edi]
xor al, cl
popal
dec edx
in eax, 0x27
daa
sar dword [esp + ecx*2 + 0x20], 0xfa
cmpsd dword [esi], dword es:[edi]
jno 0xa2dbcc
and al, 0xe0
sub ch, byte [edi + 0x39]
dec esp
mov ebx, 0xa95f7af0
mov word [eax + ecx*8 - 0x4603d8a6], gs
stc
int 0x96
and edi, ebx
enter 0x275a, 0xfffffffffffffffc
mov ecx, 0x2396cdf9
sti
fistp word [ecx + ebx*8 - 0x5401a287]
arpl word [edi + 0x2c], dx
imul ebx, dword [ecx - 0x447431a3], 0x9e9acff
sub eax, 0xbc13fbae
sar dh, 1
xor byte [ebx], 0xed
mov esp, 0x3380fed0
in eax, dx
rcr ebp, 1
out 0xa7, eax
inc esi
and ebx, edx
shr dword [eax - 0x11181e20], cl
pop esi
sbb eax, 0xb0e46290
xor dl, byte [ecx - 0x24]
xor esi, dword [ecx + ecx + 0x535ed46d]
loop 0xa2dc15
scasb al, byte es:[edi]
loop 0xa2dc7f
xchg edi, eax
lodsb al, byte [esi]
push esi
sbb ebx, dword [ebx + 0x61]
sar byte [edi + 0x1a], 0xfd
mov esi, 0xa2f7a173
xchg edx, eax
outsb dx, byte [esi]
adc al, 0x39
pop edi
and dl, byte [edx]
outsb dx, byte [esi]
dec ecx
cmp dl, bl
ljmp 0xd222
and dl, dl
dec esi
invalid

Function at 0xac3cf9
Capabilities:
Encode data using xor

Disassembly:
push 0xc49ba6b1
push 0x6c2ff289
pushfd
pop dword [esp + 4]
neg dword [esp]
push 0xae0ec9a4
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00aae0e0
xchg edi, eax
pop esi
sbb byte [ebp + ebp*8 - 0x1ec98f9f], dl
mov ebp, 0x29f85d9c
mov ebx, 0x85244060
xor eax, 0x16acce30
add esp, dword [ebx + 0x37]
and edi, esi
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
cmp dword [eax + ecx*2 + 0x782060c5], esi
scasd eax, dword es:[edi]
jo 0xac3d2a
push ecx
inc ecx
mov al, byte [0x56422139]
wait
sti
xchg ecx, eax
dec edx
jae 0xac3ce2
sti
lcall 0xa586, 0x54704389
xor eax, 0xfcb57dad
int3
Function at 0x4014d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x34], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
push 0x54efb8
push 0x6c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x54ef50
push 0x6f
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x70
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x4000
lea edx, [ebp - 8]
push edx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [0x54e945], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402e50
add esp, 4
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402bd0
add esp, 8
test eax, eax
jne 0x40157c
xor eax, eax
jmp 0x4015bf
push 0
push 0
push 0
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4015bc
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x4015ba
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40157c
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401627
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401650
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401648
cmp al, 0x22
jne 0x40163c
cmp byte [esi], 0x22
jne 0x40165a
inc esi
jmp 0x40165a
cmp al, 0x20
jle 0x40165a
inc esi
cmp byte [esi], 0x20
jg 0x401654
mov al, byte [esi]
test al, al
je 0x401664
cmp al, 0x20
jle 0x40164d
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004017b4
push 0x54e004
push section..data
call fcn.004031de
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x401694
movzx eax, word [ebp - 0x14]
jmp 0x401697
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00402fd4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
lea eax, [ebp - 0x400]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x400]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xff
push 0x54cd18
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push str.test.txt
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]

Function at 0x40ac16
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x627466
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x652018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [0x65e8d4]
mov esi, dword [ebp + 8]
add eax, 4
mov edx, dword [ebp + 0xc]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], esi
mov dword [edi + 0xc], edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], 0
mov word [edi + 0x2c], 0
mov byte [edi + 0x2e], 0
mov dword [edi + 0x28], 8
mov dword [ebp - 4], 0
push ecx
push edx
push esi
lea ecx, [edi + 0x30]
call 0x3ccc96
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40af46
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x627516
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x652018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xf8], edi
lea ecx, [edi + 0x10]
call 0x3bd036
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x104], esp
mov dword [ebp - 0xfc], eax
mov dword [eax + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x100], eax
mov byte [ebp - 4], 1
mov dword [eax], 0x41bbd0
mov byte [ebp - 4], 2
mov dword [eax], 0x41bb18
mov byte [ebp - 4], 0
mov dword [eax + 0x10], eax
mov dword [ebp - 4], 5
lea ecx, [edi + 0x30]
push 1
mov dword [ebp - 4], 0xffffffff
call 0x3cdcb6
mov eax, dword [edi + 0xc]
xor ecx, ecx
mov dword [edi + 4], 0
xor ebx, ebx
mov byte [ebp - 0xf1], cl
cmp byte [eax + 0x1a], cl
jne 0x40b04b
mov ecx, 0x19
lea edi, [ebp - 0xf0]
mov esi, 0x4207c0
lea eax, [ebp - 0xf0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xf8]
push ebx
push ebx
push 0x32
push eax
movsw word es:[edi], word [esi]
call fcn.0040ada6
push eax
push ebx
mov ecx, 0x17
lea edi, [ebp - 0x88]
mov esi, 0x420828
lea eax, [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xf8]
mov ecx, edi
push 0x2d
push eax
call fcn.0040ada6
mov ecx, eax
mov esi, dword [edi]
test esi, esi
je 0x40b0a4
jmp 0x40b056
push ecx
push ebx
push dword [esi + 4]
mov ecx, edi
push dword [esi]
call fcn.0040ada6
mov ecx, eax
inc ebx
mov al, byte [ebp - 0xf1]
test al, al
jne 0x40b099
test ecx, ecx
je 0x40b099
cmp byte [ecx + 0x26], al
je 0x40b099
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x40b093
movzx eax, word [eax - 4]
test eax, eax
jne 0x40b093
mov al, 1
mov byte [ebp - 0xf1], al
jmp 0x40b099
mov al, byte [ebp - 0xf1]
mov esi, dword [esi + 8]
test esi, esi
jne 0x40b056
test al, al
jne 0x40b0ef
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x1a], 0
jne 0x40b0ef
mov eax, dword [0x420884]
mov dword [ebp - 0x28], eax
mov eax, dword [0x420888]
mov dword [ebp - 0x24], eax
mov eax, dword [0x42088c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x420890]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x420894]
push ecx
mov dword [ebp - 0x18], eax
mov ecx, edi
mov ax, word [0x420898]
push 0
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x28]
push 0xa
push eax
call fcn.0040ada6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x59f177
mov esp, ebp
pop ebp
ret
Function at 0x40b196
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62755d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x652018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebx]
test edi, edi
je 0x40b1f9
mov ebx, dword [0x66016c]
lea esp, [esp]
mov esi, edi
mov edi, dword [edi + 8]
push dword [esi]
push 0
push dword [0x65e8d0]
call ebx
push esi
push 0
push dword [0x65e8d0]
call ebx
test edi, edi
jne 0x40b1d6
mov ebx, dword [ebp - 0x10]
lea ecx, [ebx + 0x10]
mov dword [ebx], 0
call 0x3bd036
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], eax
mov dword [eax + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov dword [eax], 0x41bbd0
mov byte [ebp - 4], 2
mov dword [eax], 0x41bb18
mov byte [ebp - 4], 0
mov dword [eax + 0x10], eax
mov dword [ebp - 4], 5
lea ecx, [ebx + 0x30]
push 1
mov dword [ebp - 4], 0xffffffff
call 0x3cdcb6
mov dword [ebx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f106
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6226f3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x652018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x420988
mov dword [esi + 0x3c], 0x420998
mov dword [esi + 0x48], 0x4209a0
mov dword [esi + 0x30], 0x40bbd8
mov dword [ebp - 4], 0
lea ecx, [esi + 0x38]
mov eax, dword [ecx + 4]
mov dword [ecx], 0x41eec8
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
mov dword [eax + ecx + 4], 0x40bbe4
mov dword [ebp - 4], 2
lea ecx, [esi + 0x44]
mov eax, dword [ecx + 4]
mov dword [ecx], 0x41eec8
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
mov dword [eax + ecx + 4], 0x425cb8
mov eax, dword [ecx + 4]
mov eax, dword [eax + 8]
mov dword [eax + ecx + 4], 0x41eec8
mov dword [ebp - 4], 2
mov eax, 4
mov dword [ebp - 0x10], eax
or eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x41f108
mov eax, dword [esi]
mov eax, dword [eax + 8]
mov dword [esi + eax], 0x428d44
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [esi + eax], 0x41bdc0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x30]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
lea eax, [ecx - 0x38]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
push ecx
push dword [ebp + 0xc]
lea eax, [ecx - 0x44]
mov dword [ecx + esi - 4], eax
lea ecx, [esi + 4]
call fcn.0040f4a6
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fa46
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6226f3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x652018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x420a18
mov dword [esi + 0x3c], 0x420a28
mov dword [esi + 0x48], 0x420a30
mov dword [esi + 0x30], 0x40bbd8
mov dword [ebp - 4], 0
lea ecx, [esi + 0x38]
mov eax, dword [ecx + 4]
mov dword [ecx], 0x41eec8
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
mov dword [eax + ecx + 4], 0x40bbe4
mov dword [ebp - 4], 2
lea ecx, [esi + 0x44]
mov eax, dword [ecx + 4]
mov dword [ecx], 0x41eec8
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
mov dword [eax + ecx + 4], 0x425cb8
mov eax, dword [ecx + 4]
mov eax, dword [eax + 8]
mov dword [eax + ecx + 4], 0x41eec8
mov dword [ebp - 4], 2
mov eax, 4
mov dword [ebp - 0x10], eax
or eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x41f108
mov eax, dword [esi]
mov eax, dword [eax + 8]
mov dword [esi + eax], 0x428d44
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [esi + eax], 0x41bdc0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x30]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
lea eax, [ecx - 0x38]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
push ecx
push dword [ebp + 0xc]
lea eax, [ecx - 0x44]
mov dword [ecx + esi - 4], eax
lea ecx, [esi + 4]
call fcn.0040fdb6
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4108e6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6226f3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x652018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x420a70
mov dword [esi + 0x3c], 0x420a80
mov dword [esi + 0x48], 0x420a88
mov dword [esi + 0x30], 0x40bbd8
mov dword [ebp - 4], 0
lea ecx, [esi + 0x38]
mov eax, dword [ecx + 4]
mov dword [ecx], 0x41eec8
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
mov dword [eax + ecx + 4], 0x40bbe4
mov dword [ebp - 4], 2
lea ecx, [esi + 0x44]
mov eax, dword [ecx + 4]
mov dword [ecx], 0x41eec8
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
mov dword [eax + ecx + 4], 0x425cb8
mov eax, dword [ecx + 4]
mov eax, dword [eax + 8]
mov dword [eax + ecx + 4], 0x41eec8
mov dword [ebp - 4], 2
mov eax, 4
mov dword [ebp - 0x10], eax
or eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x41f108
mov eax, dword [esi]
mov eax, dword [eax + 8]
mov dword [esi + eax], 0x428d44
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [esi + eax], 0x41bdc0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x30]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
lea eax, [ecx - 0x38]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
push ecx
push dword [ebp + 0xc]
lea eax, [ecx - 0x44]
mov dword [ecx + esi - 4], eax
lea ecx, [esi + 4]
call fcn.00410c56
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4155be
Capabilities:
Get number of processors

Disassembly:
push esi
push edi
mov eax, dword [0x652018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
and al, 0x30
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0

Function at 0x4155ca
Capabilities:
Get number of processors

Disassembly:
push esi
push edi
mov eax, dword [0x652018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
and al, 0x30
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
Function at 0x4155d6
Capabilities:
Get number of processors

Disassembly:
jne 0x415611
lea ecx, [esp + 0x1c]
call dword [0x660330]
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x40cc48
mov dword [esp + 0x28], 0x40cb40
mov dword [esp + 0x38], 0xffffffff
lea eax, [esp + 0x1c]
push 0x651bb0
push eax
call 0x5a4c6c
mov ebx, 0x64
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], ebx
lea esp, [esp]
mov dword [esp + 0x18], 0
mov dword [esp + 0x38], 2
push ebx
push 0xc
push dword [0x65e8d0]
call dword [0x660170]
mov edi, ebx
mov esi, eax
shr edi, 1
mov ebx, 0
mov dword [esp + 0x18], esi
je 0x41565e
cmp edi, 0x7fffffff
jbe 0x415663
mov ebx, 0x80070057
test ebx, ebx
js 0x4156a2
lea ecx, [ebp + 0x10]
xor ebx, ebx
push ecx
push dword [ebp + 0xc]
lea eax, [edi - 1]
push eax
push esi
call dword [0x660224]
mov ecx, eax
add esp, 0x10
lea eax, [edi - 1]
test ecx, ecx
js 0x415695
cmp ecx, eax
ja 0x415695
jne 0x4156ab
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4156ab
xor ecx, ecx
mov ebx, 0x8007007a
mov word [esi + eax*2], cx
jmp 0x4156ab
test edi, edi
je 0x4156ab
xor eax, eax
mov word [esi], ax
test ebx, ebx
jns 0x4156c7
cmp ebx, 0x8007007a
jne 0x41575e
mov ebx, dword [esp + 0x14]
add ebx, ebx
mov dword [esp + 0x14], ebx
jmp 0x415721
test esi, esi
je 0x4156ff
cmp edi, 0x7fffffff
ja 0x4156ff
xor edx, edx
mov ecx, edi
mov eax, esi
test edi, edi
je 0x4156e8
cmp word [eax], dx
je 0x4156f7
add eax, 2
dec ecx
jne 0x4156dd
mov edx, 0x80070057
xor edi, edi
test edx, edx
js 0x415704
add edi, edi
jmp 0x415706
test ecx, ecx
je 0x4156e8
sub edi, ecx
jmp 0x4156ef
mov edx, 0x80070057
xor edi, edi
test edx, edx
js 0x415791
mov ecx, dword [ebp + 8]
push edi
push esi
call fcn.00415b06
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], 1
mov dword [esp + 0x38], 0xffffffff
push esi
push 0
push dword [0x65e8d0]
call dword [0x66016c]
cmp byte [esp + 0x13], 0
mov dword [esp + 0x18], 0
je 0x415626
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x1c]
call dword [0x660330]
mov byte [esp + 0x38], 3
mov dword [esp + 0x1c], 0x40cc48
mov dword [esp + 0x28], 0x40bbf0
mov byte [esp + 0x38], 2
lea eax, [esp + 0x1c]
push 0x651bb0
push eax
call 0x5a4c6c
lea ecx, [esp + 0x1c]
call dword [0x660330]
mov byte [esp + 0x38], 4
mov dword [esp + 0x1c], 0x40cc48
mov dword [esp + 0x28], 0x40bbf0
mov byte [esp + 0x38], 2
lea eax, [esp + 0x1c]
push 0x651bb0
push eax
call 0x5a4c6c
int3
Function at 0x427dc6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6256b1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x652018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x10
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
call 0x3c2f56
mov dword [ebp - 4], 0
lea ecx, [esi + 0x1c]
push 0x10
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
call 0x3c2f56
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0x10
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
call 0x3c2f56
mov byte [ebp - 4], 2
mov dword [esi + 0x44], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42ad4e
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [ebx], ch
ret
Function at 0x430c96
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x629a28
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x652018]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov eax, dword [0x652018]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x40], edx
xor edx, edx
mov dword [esp + 0x3c], ebx
mov ebx, dword [ecx + 0x1c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x74], 0xfeefed
mov dword [esp + 0x70], 0xfeefed
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x28], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], edx
test ebx, ebx
je 0x4313b4
mov edi, dword [ebx]
mov dword [esp + 0x20], edi
mov ecx, dword [edi]
lea eax, [ecx - 0x47]
cmp eax, 9
ja case.default.0x430d42
jmp dword [eax*4 + 0x4ad090]
mov ebx, dword [ebx + 4]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x430d2e
mov eax, dword [esp + 0x24]
test edx, edx
je 0x4313b0
mov dword [edx + 0x28], eax
mov eax, dword [esp + 0x3c]
jmp 0x4314c8
mov ecx, dword [esp + 0x2c]
cmp dword [ecx], 0x47
jne 0x4314c6
test byte [ecx + 0x2c], 1
jne 0x4314c6
lea eax, [esp + 0x70]
mov ecx, esi
push eax
push 0
push 0x404b4c
call fcn.00470a46
push 0x30
lea ecx, [esi + 0x24]
mov ebx, eax
call fcn.0053ac26
mov edi, eax
mov eax, 0x27
mov word [edi], ax
test ebx, ebx
je 0x431403
mov ax, word [ebx + 2]
and ax, 1
mov dword [edi + 0x24], ebx
or word [edi + 2], ax
mov eax, dword [ebx + 4]
mov ecx, 0x65e308
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov dword [edi + 0x1c], 0x65e308
call 0x3db1c6
mov dword [edi + 0x14], eax
mov ecx, esi
lea eax, [esp + 0x70]
push eax
push 0
push edi
push 0x65e308
push 0x4f
call fcn.00473196
mov ebx, eax
lea ecx, [esi + 0xa4]
mov eax, dword [esi + 0xc]
push 0xfb
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x41c]
lea eax, [ecx + 0x18]
push eax
call fcn.0042dc86
mov edx, eax
mov eax, dword [esi + 0xf4]
push dword [eax + 0x3c]
mov ecx, dword [eax + 0x38]
lea eax, [esp + 0x74]
or ecx, 0x20
push ecx
push dword [esp + 0x2c]
mov ecx, esi
push edi
push edx
push eax
call fcn.00468206
mov ecx, eax
mov eax, dword [esi + 0xf4]
push ecx
push dword [eax + 0x3c]
push dword [eax + 0x38]
lea eax, [esp + 0x7c]
push ecx
push ebx
push 0
push ecx
push eax
mov ecx, esi
call fcn.004675d6
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x70]
push edx
push ecx
push eax
push dword [ecx + 0x1c]
mov ecx, esi
push 0x63
call fcn.00473196
mov edx, eax
jmp 0x4314c8
xor edx, edx
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x4314d2
mov dword [ecx], edx
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call 0x59f177
mov esp, ebp
pop ebp
ret 0xc
add al, 0
int3