joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e40
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov dword [ebp - 0x1ac], ecx
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp + 8]
shl ecx, 2
push ecx
call sub.mfc42.dll_operatornew
add esp, 4
mov dword [ebp - 0x1a0], eax
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x1a0]
mov dword [edx + 0x2c], eax
mov dword [ebp - 0x198], 0
jmp 0x407ea6
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
cmp edx, dword [ebp + 8]
jge 0x407ec9
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ebp - 0x198]
mov dword [ecx + edx*4], 0
jmp 0x407e97
mov eax, dword [ebp + 8]
shl eax, 2
push eax
call sub.mfc42.dll_operatornew
add esp, 4
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x1a4]
mov dword [ecx + 0x30], edx
mov dword [ebp - 0x198], 0
jmp 0x407f08
mov eax, dword [ebp - 0x198]
add eax, 1
mov dword [ebp - 0x198], eax
mov ecx, dword [ebp - 0x198]
cmp ecx, dword [ebp + 8]
jge 0x407f2b
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x30]
mov ecx, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0
jmp 0x407ef9
mov edx, dword [ebp + 0xc]
shl edx, 2
push edx
call sub.mfc42.dll_operatornew
add esp, 4
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1a8]
mov dword [eax + 0x34], ecx
mov dword [ebp - 0x198], 0
jmp 0x407f6a
mov edx, dword [ebp - 0x198]
add edx, 1
mov dword [ebp - 0x198], edx
mov eax, dword [ebp - 0x198]
cmp eax, dword [ebp + 0xc]
jge 0x407f8d
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x34]
mov eax, dword [ebp - 0x198]
mov dword [edx + eax*4], 0
jmp 0x407f5b
mov dword [ebp - 0x198], 0
jmp 0x407fa8
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x198]
cmp edx, dword [ebp + 8]
jge 0x407fca
lea eax, [ebp - 0x198]
push eax
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x20
call fcn.004089f0
jmp 0x407f99
push 0x425540
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x1ac]
call fcn.00408493
mov ecx, dword [ebp - 0x1ac]
call fcn.00408574
mov word [ebp - 0x19c], 0x202
lea edx, [ebp - 0x194]
push edx
mov ax, word [ebp - 0x19c]
push eax
call dword [sym.imp.ws2_32.dll_WSAStartup]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408458
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
push 4
mov ecx, dword [ebp - 8]
push ecx
push 0x407360
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
push 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret

Function at 0x408493
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5dec
call fcn.0041d390
mov dword [ebp - 0x5dec], ecx
push 0xf
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
lea eax, [ebp - 0x5de4]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
cmp dword [ebp + 8], 0
jne 0x4084db
mov ecx, dword [ebp - 0x5dd0]
shl ecx, 1
mov edx, dword [ebp - 0x5dec]
mov dword [edx + 0x38], ecx
jmp 0x4084e7
mov eax, dword [ebp - 0x5dec]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x38], ecx
mov edx, dword [ebp - 0x5dec]
mov eax, dword [ebp - 0x5dd0]
mov dword [edx + 0x3c], eax
push 0xa
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov ecx, dword [ebp - 0x5dec]
mov dword [ecx + 0xc], eax
mov dword [ebp - 0x5de8], 0
jmp 0x408528
mov edx, dword [ebp - 0x5de8]
add edx, 1
mov dword [ebp - 0x5de8], edx
mov eax, dword [ebp - 0x5dec]
mov ecx, dword [ebp - 0x5de8]
cmp ecx, dword [eax + 0x38]
jge 0x40856e
mov edx, dword [ebp - 0x5de8]
lea eax, [ebp + edx*4 - 0x2ee0]
push eax
push 0
mov ecx, dword [ebp - 0x5dec]
push ecx
push 0x4076b2
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edx, dword [ebp - 0x5de8]
mov dword [ebp + edx*4 - 0x5dc0], eax
jmp 0x408519
mov esp, ebp
pop ebp
ret 4

Function at 0x408574
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5dc8
call fcn.0041d390
mov dword [ebp - 0x5dc8], ecx
push 0xa
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov ecx, dword [ebp - 0x5dc8]
mov dword [ecx + 0x10], eax
mov dword [ebp - 0x5dc4], 0
jmp 0x4085b9
mov edx, dword [ebp - 0x5dc4]
add edx, 1
mov dword [ebp - 0x5dc4], edx
mov eax, dword [ebp - 0x5dc8]
mov ecx, dword [ebp - 0x5dc4]
cmp ecx, dword [eax + 0x3c]
jge 0x4085ff
mov edx, dword [ebp - 0x5dc4]
lea eax, [ebp + edx*4 - 0x2ee0]
push eax
push 0
mov ecx, dword [ebp - 0x5dc8]
push ecx
push 0x407941
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edx, dword [ebp - 0x5dc4]
mov dword [ebp + edx*4 - 0x5dc0], eax
jmp 0x4085aa
mov esp, ebp
pop ebp
ret
Function at 0x409e19
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], ecx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00409dd2
add esp, 8
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x4258c0
call fcn.0040a3c0
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov byte [ebp - 0xc], 1
push 0
call fcn.0040a350
add esp, 4
fstp dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, 0x4258c0
call fcn.00404890
push eax
lea ecx, [ebp - 8]
call fcn.0040db10
and eax, 0xff
test eax, eax
je 0x409eb6
lea ecx, [ebp - 8]
call fcn.0040a3f0
fld dword [ebp - 0x10]
fsub dword [eax + 4]
call sub.msvcrt.dll__ftol
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1388
jge 0x409eb6
lea ecx, [ebp - 8]
call fcn.0040a3f0
cmp dword [eax + 8], 3
jl 0x409eb6
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x14], 0xffffffff
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
and eax, 0xff
test eax, eax
je 0x409eda
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ws2_32.dll_accept]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x14], 0xffffffff
jne 0x409f23
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [ebp - 0x1c], eax
mov eax, 1
test eax, eax
je 0x409efe
mov dword [ebp - 0x2c], 0
jmp 0x409f12
mov ecx, dword [ebp - 0x1c]
push ecx
push str.Socket_Accepting_Fail____d_n
call fcn.004045e0
add esp, 8
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.ws2_32.dll_closesocket]
xor eax, eax
jmp 0x409f51
mov word [ebp - 0x14], 1
mov word [ebp - 0x12], 0
push 4
lea ecx, [ebp - 0x14]
push ecx
push 0x80
push 0xffff
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.ws2_32.dll_setsockopt]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411ceb
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov dword [ebp - 0x164], ecx
mov eax, dword [ebp + 0xc]
push eax
push 0x160
lea ecx, [ebp - 0x160]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.shell32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x15c]
mov esp, ebp
pop ebp
ret 8

Function at 0x41268f
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov dword [ebp - 0x168], ecx
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x424ca4
call dword [sym.imp.shell32.dll_SHGetFileInfoA]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
je 0x4126e9
mov ecx, dword [ebp - 0x164]
push ecx
push 0
push 0x1109
mov edx, dword [ebp - 0x168]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.user32.dll_SendMessageA]
mov esp, ebp
pop ebp
ret
Function at 0x419157
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e8e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x148
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x140], ecx
mov eax, dword [ebp - 0x140]
movsx ecx, byte [eax + 0xc8]
cmp ecx, 0xffffffff
je 0x4191c3
mov edx, 1
test edx, edx
je 0x4191a9
mov dword [ebp - 0x144], 0
jmp 0x4191bc
push str.No_file_opened._n
call fcn.004045e0
add esp, 4
mov dword [ebp - 0x144], eax
xor al, al
jmp 0x419351
mov eax, dword [ebp - 0x140]
cmp dword [eax + 0x48], 0
jne 0x4191f5
mov ecx, dword [ebp - 0x140]
call fcn.00418ccc
mov ecx, dword [ebp - 0x140]
mov edx, dword [ecx + 0x50]
cmp edx, dword [eax + 0x14]
je 0x4191f5
push 0xffffffffffffff9a
mov ecx, dword [ebp - 0x140]
call fcn.0041857b
mov ecx, dword [ebp - 0x140]
call fcn.00418ccc
xor ecx, ecx
mov cx, word [eax + 0xe]
cmp ecx, 8
jne 0x41921d
mov edx, dword [ebp - 0x140]
add edx, 0x10
push edx
call sub.MBX_2D5C_23A17F8._inflateEnd
add esp, 4
mov byte [ebp - 0x14], 1
cmp dword [ebp + 8], 0
je 0x419322
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x12c]
call fcn.0041b480
lea eax, [ebp - 0x134]
push eax
call sub.mfc42.dll_CTime::GetTickCount
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x148]
push ecx
lea ecx, [ebp - 0x124]
call fcn.0041b830
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x14c]
push edx
lea ecx, [ebp - 0x12c]
call fcn.0041b830
mov byte [ebp - 0x11c], 0
mov ecx, dword [ebp - 0x140]
call fcn.00418ccc
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x150]
call fcn.004068d8
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x154]
push ecx
lea ecx, [ebp - 0x128]
call fcn.0041b830
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.mfc42.dll_CFile::SetStatus
mov ecx, dword [ebp - 0x140]
call fcn.00418ccc
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x14], al
jmp 0x41931b
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x140]
add ecx, 0xcc
call fcn.00401c6f
mov ecx, dword [ebp - 0x140]
mov byte [ecx + 0xc8], 0
mov ecx, dword [ebp - 0x140]
add ecx, 0x54
call fcn.004010ae
mov al, byte [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419a97
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e9ba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call sub.mfc42.dll_CString::CString_1
mov dword [ebp - 4], 0
push 0x425260
lea ecx, [ebp - 0x10]
call sub.mfc42.dll_CString::TrimRight_1
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00417280
push eax
lea edx, [ebp - 0x18]
push edx
call fcn.0041971e
add esp, 8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.00412e60
and eax, 0xff
test eax, eax
jne 0x419b3b
lea ecx, [ebp - 0x10]
call fcn.00417280
push eax
call fcn.00419c3e
add esp, 4
xor edx, edx
cmp eax, 0xffffffff
sete dl
mov byte [ebp - 0x1c], dl
mov eax, dword [ebp - 0x1c]
and eax, 0xff
test eax, eax
jne 0x419b3b
mov dword [ebp - 0x40], 0
jmp 0x419b42
mov dword [ebp - 0x40], 1
mov cl, byte [ebp - 0x40]
mov byte [ebp - 0x14], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.mfc42.dll_CString::CString
mov edx, dword [ebp - 0x14]
and edx, 0xff
test edx, edx
je 0x419b7c
mov byte [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.mfc42.dll_CString::CString
mov al, byte [ebp - 0x20]
jmp 0x419c30
lea ecx, [ebp - 0x10]
call fcn.00417280
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041971e
add esp, 8
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
call fcn.00417280
push eax
call fcn.00419a97
add esp, 4
and eax, 0xff
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x24], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call sub.mfc42.dll_CString::CString
mov edx, dword [ebp - 0x24]
and edx, 0xff
test edx, edx
je 0x419bed
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.mfc42.dll_CString::CString
mov al, byte [ebp - 0x2c]
jmp 0x419c30
push 0
lea ecx, [ebp - 0x10]
call fcn.00417280
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x419c1a
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.mfc42.dll_CString::CString
mov al, byte [ebp - 0x30]
jmp 0x419c30
mov byte [ebp - 0x34], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.mfc42.dll_CString::CString
mov al, byte [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41a948
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ea48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0041a9bd
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.00417280
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x10], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.mfc42.dll_CString::CString
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41c901
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ed5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x34], ecx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xc
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xc]
call dword [eax + 0x20]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
call fcn.00417280
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.0041a9bd
add esp, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
call fcn.00417280
push eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x28], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call sub.mfc42.dll_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call sub.mfc42.dll_CString::CString
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
test ecx, ecx
je 0x41c9b7
xor eax, eax
jmp 0x41c9cd
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42ab50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp + 8], eax
mov eax, dword [0x42a0ac]
push esi
push edi
test eax, eax
jne 0x42abcd
mov esi, 0x42a284
mov edx, dword [esi]
lea eax, [ebp - 0x24]
mov cl, byte [edx]
test cl, cl
je 0x42ab8b
lea edi, [ebp - 0x24]
sub edx, edi
xor cl, 0x55
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x42ab7d
lea ecx, [ebp - 0x24]
mov byte [eax], 0
push ecx
call dword [0x42a000]
mov edx, dword [esi - 4]
add esi, 8
cmp esi, 0x42a29c
mov dword [edx], eax
jl 0x42ab6d
mov ecx, dword [0x42a0ac]
mov eax, dword [0x42a000]
push 0
push 0x42a2ac
push ecx
mov dword [0x42a0a4], eax
call fcn.0042ad80
add esp, 0xc
mov dword [0x42a0a8], eax
mov dword [ebp - 4], 0
mov esi, 0x42a284
mov edx, dword [esi]
mov cl, byte [edx]
test cl, cl
je 0x42ac16
mov eax, dword [ebp + 8]
mov al, byte [eax]
test al, al
je 0x42ac16
cmp al, 0x5a
jg 0x42ac02
cmp al, 0x41
jl 0x42ac02
movsx edi, al
add edi, 0x20
movsx ebx, cl
xor edi, 0x55
cmp ebx, edi
je 0x42ac08
xor al, 0x55
cmp cl, al
jne 0x42ac16
mov ecx, dword [ebp + 8]
inc edx
inc ecx
mov dword [ebp + 8], ecx
mov cl, byte [edx]
test cl, cl
jne 0x42abe1
cmp byte [edx], 0
je 0x42ac36
mov edx, dword [ebp - 4]
add esi, 8
inc edx
cmp esi, 0x42a29c
mov dword [ebp - 4], edx
jl 0x42abd9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov edx, dword [ecx*8 + 0x42a280]
mov eax, dword [edx]
mov esp, ebp
pop ebp
ret
Function at 0x42b5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x42a11c
push 5
mov dword [0x43e280], ebx
call fcn.0042d0dc
mov esi, eax
test esi, esi
jne 0x42b612
push eax
push eax
push eax
push 0xef0000fd
push 0x1e
call fcn.0042d0dc
push 0x42a12c
push esi
push 0x35
call fcn.0042d0dc
mov esi, eax
test esi, esi
jne 0x42b634
push eax
push eax
push eax
push 0xef0000fc
push 0x1e
call fcn.0042d0dc
push edi
push 4
push 0x1000
push 0x1000
push 0
call esi
push 4
push 0x2000
push 0x1f
mov dword [0x43db24], eax
call fcn.0042d0dc
and eax, 0x7fff
push eax
push 0
call esi
push 4
push 0x1000
push 0x1000
push 0
mov dword [0x43db2c], eax
call esi
mov dword [0x43db28], eax
mov eax, dword [0x43db24]
push 0x40
mov dword [eax], 0x19660d
mov ecx, dword [0x43db28]
mov dword [ecx], 0x3c6ef35f
call fcn.00436c40
mov ecx, 0x10
mov esi, ebx
mov edi, eax
add esp, 4
mov dword [0x43e27c], eax
lea edx, [ebx + 0x71]
rep movsd dword es:[edi], dword [esi]
push edx
lea ecx, [ebp - 0x44]
call fcn.0042c890
mov eax, dword [0x43e27c]
push 8
push eax
lea ecx, [ebp - 0x44]
call fcn.0042cab0
mov ecx, dword [0x43e27c]
push ebx
push ecx
call fcn.0042c540
mov edx, dword [0x43e27c]
push 0x94
mov ebx, dword [edx]
call fcn.00436c40
add esp, 0xc
mov esi, eax
mov ecx, 0x25
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push 0x14
mov dword [esi], 0x94
call fcn.0042d0dc
mov eax, dword [esi + 0x10]
push esi
mov dword [0x43e278], eax
call fcn.00436ca0
mov ecx, dword [0x43e27c]
add esp, 4
mov eax, dword [ecx + 0x2c]
pop edi
test eax, eax
je 0x42b743
mov ecx, eax
mov edx, 0x80
imul eax, eax, 0x19660d
mov esi, dword [ecx]
add eax, 0x3c6ef35f
xor esi, eax
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x42b72c
mov edx, dword [0x43e27c]
mov eax, dword [edx + 0x24]
shr eax, 4
and al, 1
mov byte [0x42a098], al
call fcn.00433c60
mov eax, dword [0x4432e0]
test eax, eax
je 0x42b772
push 0
push 0
push 0
push eax
push 2
call fcn.0042df58
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c3a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b9c8
push 0x42e314
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0xffffffff
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
push esi
call fcn.0042d0dc
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x42c4fe
push esi
push ebx
push 0x38
call fcn.0042d0dc
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, 0xffffffff
je 0x42c4fe
push esi
push edi
push esi
push 2
push esi
push ebx
push 2
call fcn.0042d0dc
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x42c4dd
push edi
push esi
push esi
push 4
push eax
push 0x19
call fcn.0042d0dc
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x42c4dd
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 0x30], edi
cmp dword [edi], 0x4550
je 0x42c45b
mov ecx, 0xef000002
jmp fcn.00436c30
push 4
lea ecx, [edi + 0x28]
push ecx
push esi
call fcn.0042a4f0
mov dword [ebp - 0x2c], eax
lea ecx, [edi + 6]
push 4
push ecx
push eax
call fcn.0042a4f0
add esp, 0x18
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], esi
xor edx, edx
mov dx, word [edi + 6]
dec edx
cmp esi, edx
jge 0x42c4bc
xor eax, eax
mov ax, word [edi + 0x14]
lea ecx, [esi + esi*4]
mov edx, edi
add edx, eax
lea eax, [edx + ecx*8 + 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [eax + 0x14]
add edx, dword [ebp - 0x28]
push edx
push ebx
call fcn.0042a4f0
add esp, 0xc
mov ebx, eax
mov dword [ebp - 0x2c], ebx
inc esi
jmp 0x42c47e
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.0042e25e
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
call fcn.0042e25e
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0xef000001
jmp fcn.00436c30
Function at 0x42c930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov cl, byte [eax + 4]
push edi
mov dword [ebp + 8], 8
mov dl, byte [eax]
xor ebx, ebx
mov bl, byte [esi]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov dl, byte [edx + 0x42a14c]
xor dl, cl
inc esi
mov byte [eax + 4], dl
mov dl, byte [eax + 1]
mov bl, byte [esi]
mov ecx, edx
and ecx, 0xff
xor ecx, ebx
mov bl, byte [eax + 5]
mov cl, byte [ecx + 0x42a14c]
xor cl, bl
inc esi
mov byte [eax + 5], cl
mov cl, byte [eax + 2]
xor ebx, ebx
and ecx, 0xff
mov bl, byte [esi]
xor ecx, ebx
mov bl, byte [eax + 6]
mov cl, byte [ecx + 0x42a14c]
xor cl, bl
inc esi
mov byte [eax + 6], cl
mov cl, byte [eax + 3]
xor ebx, ebx
and ecx, 0xff
mov bl, byte [esi]
xor ecx, ebx
mov bl, byte [eax + 7]
mov cl, byte [ecx + 0x42a14c]
xor cl, bl
inc esi
mov byte [eax + 7], cl
mov cl, byte [eax + 4]
mov edi, ecx
xor ebx, ebx
mov bl, byte [esi]
and edi, 0xff
xor ebx, edi
mov bl, byte [ebx + 0x42a14c]
xor bl, dl
mov dl, byte [eax + 5]
and edx, 0xff
mov byte [eax + 1], bl
mov bl, byte [eax + 2]
xor edx, edi
inc esi
mov dl, byte [edx + 0x42a14c]
xor dl, bl
xor ebx, ebx
mov byte [eax + 2], dl
mov dl, byte [eax + 6]
mov bl, byte [esi]
and edx, 0xff
xor edx, ebx
mov bl, byte [eax + 3]
mov dl, byte [edx + 0x42a14c]
xor dl, bl
inc esi
mov byte [eax + 3], dl
mov dl, byte [eax + 7]
xor ebx, ebx
and edx, 0xff
mov bl, byte [esi]
xor edx, ebx
mov bl, byte [eax]
mov dl, byte [edx + 0x42a14c]
xor dl, bl
inc esi
mov byte [eax], dl
mov edx, dword [ebp + 8]
dec edx
mov dword [ebp + 8], edx
jne 0x42c945
xor ecx, ecx
xor edx, edx
mov cl, byte [esi]
mov dl, byte [eax]
xor ecx, edx
mov dl, byte [eax + 4]
mov bl, byte [eax + 6]
pop edi
mov cl, byte [ecx + 0x42a14c]
xor dl, cl
inc esi
mov byte [eax + 4], dl
xor edx, edx
mov dl, byte [eax + 1]
xor ecx, ecx
mov cl, byte [esi]
xor edx, ecx
mov cl, byte [eax + 5]
mov dl, byte [edx + 0x42a14c]
xor cl, dl
inc esi
mov byte [eax + 5], cl
xor ecx, ecx
mov cl, byte [eax + 2]
xor edx, edx
mov dl, byte [esi]
xor ecx, edx
xor edx, edx
mov cl, byte [ecx + 0x42a14c]
xor bl, cl
xor ecx, ecx
mov cl, byte [eax + 3]
mov byte [eax + 6], bl
mov dl, byte [esi + 1]
pop esi
xor edx, ecx
mov cl, byte [eax + 7]
pop ebx
mov dl, byte [edx + 0x42a14c]
xor cl, dl
mov byte [eax + 7], cl
pop ebp
ret 4