joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4ddd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x4ddd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4ddd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4ddd94
push eax
push esi
call fcn.004e020b
add esp, 8
pop esi
ret 0x10

Function at 0x4ddda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4dde22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x4dde15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x4f6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.004dfdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x4dddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x4dde30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ddec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x4ddeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x4f6320
push ecx
mov dword [esp + 0x1c], 4
call fcn.004dfdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x4ddeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x4dde6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x4de000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x4de131
push esi
call fcn.004e1145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.004d0080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x4de131
push 0
push ebp
call fcn.004d03a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.004d0260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4de08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.004d02f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4de121
push 0x4f6918
push edi
call fcn.004df3f0
push eax
push ebx
push esi
call fcn.004ddf60
push 0x4f68f8
push edi
call fcn.004df3f0
push eax
push ebx
push esi
call fcn.004ddf60
push 0x4f68d8
push edi
call fcn.004df3f0
push eax
push ebx
push esi
call fcn.004ddf60
push 0x4f68c0
push edi
call fcn.004df3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.004ddf60
push 0x4f68a0
push edi
call fcn.004df3f0
push eax
push ebx
push esi
call fcn.004ddf60
push 0x4f6888
push edi
call fcn.004df3f0
push eax
push ebx
push esi
call fcn.004ddf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4df1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.004df140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.004df140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.004df140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.004df140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x4dfbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4dfc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x4f187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4dfc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4dfc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x406c76
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
nop
add byte [eax], al
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x406c60
shr eax, 1
xor eax, 0xedb88320
jmp 0x406c62
shr eax, 1
dec edx
jne 0x406c53
add dword [ecx*4 + 0x4141c0], 0xf98141
add dword [eax], eax
add byte [ecx + ebx*8 - 0x3d], bh
cmp dword [0x414144], 0
jne 0x406c84
loopne 0x406c49
invalid
mov dword [esp + 8], ecx
add dword [esp + 4], 0x56
mov esi, dword [esp + 0x10]
inc edi
test esi, esi
jbe 0x406cb1
test cl, 7
je 0x406cb1
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec esi
inc ecx
jmp 0x406c92
cmp esi, 8
jb 0x406d35
mov edi, esi
ror edi, 3
xor eax, dword [ecx]
add ecx, 0
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4101c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
mov edx, eax
invalid
and edx, edx
test dword [esi + 0x76], esi
sbb dl, byte [ebx + 0xf]
mov dh, 0x3c
or cl, byte [edi]
mov dh, 0xd8
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor dword [edi*4 + 0x4141c0], eax
inc edx
cmp edx, esi
jb 0x406d3c
pop ebx
pop ebx
pop esi
ret 0xc

Function at 0x40d94b
Capabilities:
Encode data using xor

Disassembly:
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x419fd0]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x419fd0]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x419fd0]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x419fd0]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x40d926
add eax, edx
dec edi
jne 0x40d924
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x40d97a
cmp ebx, edx
jge 0x40d963
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x40d965
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40d947
cmp ecx, edx
jne 0x40d96c
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x40d939
cmp dword [ebp + 8], 0xa
jle 0x40d8df
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40d981
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x416eb0]
xor dl, byte [eax + ebx*4 + 0x4176b0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x417ab0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4172b0]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x40d9a9
inc eax
cmp eax, edi
jl 0x40d99c
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040e180
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x40d99a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40dcaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
push esi
xor eax, eax
xor ecx, ecx
inc eax
mov esi, 0x11b
push edi
mov edx, eax
and dl, 0x80
movsx edx, dl
mov byte [ebp + ecx - 0x304], al
mov byte [ebp + ecx - 0x205], al
mov byte [ebp + eax - 0x104], cl
inc ecx
neg edx
sbb edx, edx
and edx, esi
lea edi, [eax + eax]
xor edx, edi
xor eax, edx
cmp eax, 1
jne 0x40dcc0
xor ecx, ecx
pop edi
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov byte [ecx + 0x419eb0], al
and edx, esi
add eax, eax
xor eax, edx
inc ecx
cmp ecx, 0x1e
jb 0x40dcf3
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x40dd1b

Function at 0x433006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x51ac50
Capabilities:
Encode data using xor

Disassembly:
cmp cl, byte [eax]
mov al, byte [0x627c92e9]
and bh, byte [ecx - 0x37]
sbb ebp, 0xffffff9d
invalid

Function at 0x564f44
Capabilities:
Encode data using xor

Disassembly:
jb 0x564f67
adc eax, 0x3878bc99
pop ebp
popal
xlatb
fld dword [eax + 0x5d0a0910]
retf
sub al, 0xaa
jns 0x564efa
cmp edi, esi
loop 0x564fb4
mov ah, 0x3c
mov bl, 0
invalid
mov eax, dword [0xc18e66cb]
invalid
in eax, 0x9c
stc
mov edx, 0xa394b9b9
cdq
mov ecx, 0x99a394b9
fdiv dword [edx]
pop es
mov esi, 0x7b2f10d9
push ss
fst dword [eax]
das
jnp 0x564fdd
movsb byte es:[edi], byte [esi]
test byte [esi - 0x3c290606], dl
push ecx
mov ah, 0xe0
push ds
loopne 0x564ff0
pop edx
arpl dx, dx
dec ebx
clc
cdq
mov esp, 0x272421e
lodsd eax, dword [esi]
stosd dword es:[edi], eax
pop eax
mov edx, 0x93c20ab0
add ch, byte [ebp - 0x4f45a755]
or al, dl
xchg ebx, eax
xchg esp, eax
mov dl, 8
xor byte [ebx - 0x1c31f700], bh
sbb al, 0x51
push ecx
pop ds
loop 0x564fd0
loopne 0x56501d
adc byte [ecx - 0x63], 0x23
cmp dword [eax - 0x73], ebp
pop ebp
stosb byte es:[edi], al
pop ecx
jp 0x564fb8
pop ecx
xchg edi, eax
js 0x565050
in eax, dx
xchg ebp, ebx
outsd dx, dword [esi]
mov esi, 0x9610295e
and eax, edi
cmp dl, byte [edx - 0x4a]
pushal
mov dl, 0xd9
std
iretd
sahf
cmpsd dword [esi], dword es:[edi]
dec edi
pop es
mov edi, 0x8a90b243
add dword [eax + esi*2], ebp
mov esi, 0xe2736737
pop esi
pushal
jns 0x564fc2
daa
and esi, ecx
xor ebx, eax
xor dh, byte [esi + 0x49]
test eax, 0xda766768
inc edi
mov byte [edx], cl
jmp 0x47f97909
fcmovbe st(0), st(3)
inc edi
invalid

Function at 0x590c6c
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xc8
mov edi, 0xf7cbe0f9
aad 0x8d
invalid

Function at 0x5f67c2
Capabilities:
Encode data using xor

Disassembly:
cmp dh, byte [esi + 0x6f]
mov dh, 0xe8
push 0x69
inc esp
mov dh, 0x7c
xor byte [esi - 0x3ea1b488], 0x4e
and al, 0x91
jbe 0x5f67c9
pushaw
mov eax, dword [0x8b72e4b7]
and ebx, dword [edi + 0x619a9895]
stc
invalid
Function at 0x5f84ed
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
push edi
inc eax
nop
mov dl, 0x18
test al, 0x2f
mov cl, 0x49
enter 0xffffffffffff8078, 0xffffffffffffffc0
xchg ecx, eax
mov dword [ebx], edi
js 0x5f8533
dec ebx
push ds
cmp al, byte [ebx]
sti
ret
sbb edi, esp
add cl, byte [edi - 0x17db5d7f]
push esp
mov ah, 0x3d
xor dl, dl
sti
or edx, ebx
sar byte [edi], 0xc8
loopne 0x5f8578
push edi
dec edi
shl dword [ebx - 0xf], 0xe
int1
push cs
int 1
cmp dword [edx], ebx
movsb byte es:[edi], byte [esi]
pushal
fld xword [eax]
dec dword [esi - 0x36f43347]
mov dword [0x9e84dfee], eax
lodsb al, byte [esi]
invalid
jge 0x5f859c
jbe 0x5f8594
invalid
jle 0x5f85ec
cmp al, 0x79
jb 0x5f854c
inc ecx
push esi
push eax
fist word [ebx + 0x4f]
invalid
xchg edx, eax
inc ecx
push ecx
int 0x39
aaa
or ch, byte [ecx]
dec eax
adc al, 0x12
test byte [ecx], bl
xchg ebp, eax
add ah, bh
in al, dx
fadd qword [eax]
call 0xc7dc769f
ror byte [ecx - 0x2aa8175c], 0x2b
and byte [ebx - 0xae2c44c], ah
sti
enter 0xffffffffffffd65f, 0xffffffffffffffdf
mov ebp, 0x8cab2e6
les ebx, [eax + 9]
sbb esi, eax
mov ecx, 0x520187aa
scasb al, byte es:[edi]
xor eax, edi
lds edx, [esi + 0x54]
add byte [ecx + 0x7cfe2e84], bh
push ecx
ja 0x5f85b4
or al, 0xd7
sub byte [ecx + 0x4f8868f6], al
adc edi, dword [ebp + 0x60]
int 0xe8
mov edi, 0xd338ed18
sbb ch, ch
cmp bl, dl
cdq
test al, 0xb8
mov dh, 0xcd
or dword [edi + 0x75], ebx
salc
loopne 0x5f8587
int3

Function at 0x61027c
Capabilities:
Packed with generic packer

Disassembly:
mov al, byte fs:[0x43c26a3e]
xor byte [ecx], bh
leave
sbb al, 0xe1
lahf
pushfd
salc
dec ebx
xchg edi, eax
jmp 0x6102f8
mov al, 0x38
or dword [ebx - 0x64], eax
xchg dword [edi + 0x7b77d1f4], edi
and al, 0xf0
sbb eax, 0xc2df4bc9
fnstenv ss:[ebx + 0x6e]
xchg edx, eax
and bl, byte [edi]
jne 0x610357
loopne 0x61035f
pop ebx
mov dh, 0xec
invalid
movsd dword es:[edi], dword [esi]
jns 0x6103c6
dec esi
jno 0x6102eb
or bh, bl
pop ebx
lahf
fistp word [ebx - 0x61]
mov dh, 0x8b
stc
int1
out 0xbd, eax
cwde
inc ebx
inc eax
mov byte [esi - 5], dh
and edx, dword [edx + 0x53]
xlatb
pop eax
jmp 0xf1ca4432
pop eax
clc
dec eax
push ss
jge 0x610402
popal
rol ebp, 1
invalid
Function at 0x64f0c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x650548
push 0x64f0b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cld
add bh, bh
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0xa541c4], 0xffffffff
or dword [0xa541c8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa541c0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa541bc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa541cc], eax
call fcn.0064f23f
cmp dword [0x653460], ebx
jne 0x64f143
push 0x64f23c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064f22a
push 0x65300c
push 0x653008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa541b8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0xa541b4]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x653004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64f1d6
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f1aa
cmp al, 0x22
jne 0x64f19c
cmp byte [esi], 0x22
jne 0x64f1b3
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f1bd
cmp al, 0x20
jbe 0x64f1af
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64f1e1
movzx eax, word [ebp - 0x2c]
jmp 0x64f1e4
cmp byte [esi], 0x20
jbe 0x64f1b3
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64f1d6
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x426f20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x961140]
xor edx, edx
cmp eax, edx
jne 0x426f46
xor eax, eax
mov byte [eax + 0x961040], al
inc eax
cmp eax, 0x100
jl 0x426f2e
mov dword [0x961140], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x961040
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x426fd7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x426faa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x426f78
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x427050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4270a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42708a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x42b561
cmp eax, 8
jg 0x42b561
cmp dword [esp + 0x8c], 2
jl 0x42b561
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x42b561
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x42b561
mov eax, dword [esp + 0x80]
test eax, eax
je 0x42b3c7
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x42b54a
mov ebp, dword [0x4885d8]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x42b3f9
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x42b531
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x42b419
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x4885c8]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x42b458
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x4885cc]
lea ecx, [esp + 0x28]
push ecx
call dword [0x48860c]
test eax, eax
jne 0x42b518
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.0042a950
cmp eax, 1
jne 0x42b542
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0042b200
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x42b40d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x42b54a
jmp 0x42b3e4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.0042a550
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c