joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x464ff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x47bfd4]
xor eax, esp
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
push ebp
push esi
mov dword [esp + 0xc], eax
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], 1
call fcn.00411630
mov eax, dword [esp + 0x54]
mov ebx, dword [esp + 0x70]
xor esi, esi
test eax, eax
mov ebp, eax
jle 0x412cbe
push edi
lea ecx, [ecx]
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x412c3f
lea eax, [esp + 0x64]
mov edx, dword [esp + 0x74]
push edx
push esi
push eax
lea ecx, [esp + 0x50]
call fcn.00401920
mov edi, eax
cmp edi, ebp
jae 0x412cb4
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x50]
call fcn.00412770
mov eax, dword [esp + 0x28]
test eax, eax
mov byte [esp + 0x3c], 2
jbe 0x412c82
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
call fcn.00412b40
cmp dword [esp + 0x2c], 0x10
lea esi, [edi + ebx - 1]
mov byte [esp + 0x3c], 1
jb 0x412c9f
mov eax, dword [esp + 0x18]
push eax
call fcn.004525d3
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
inc esi
cmp esi, ebp
jl 0x412c30
pop edi
mov eax, dword [esp + 0x58]
mov esi, 0x10
cmp eax, esi
jb 0x412cd8
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004525d3
add esp, 4
cmp dword [esp + 0x74], esi
pop esi
pop ebp
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
pop ebx
jb 0x412d03
mov edx, dword [esp + 0x54]
push edx
call fcn.004525d3
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004525c5
add esp, 0x30
ret

Function at 0x413210
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
add ecx, 4
mov eax, edx
shr eax, 1
test dl, 1
je 0x413223
xor eax, 0xedb88320
test al, 1
je 0x413230
shr eax, 1
xor eax, 0xedb88320
jmp 0x413232
shr eax, 1
test al, 1
je 0x41323f
shr eax, 1
xor eax, 0xedb88320
jmp 0x413241
shr eax, 1
test al, 1
je 0x41324e
shr eax, 1
xor eax, 0xedb88320
jmp 0x413250
shr eax, 1
test al, 1
je 0x41325d
shr eax, 1
xor eax, 0xedb88320
jmp 0x41325f
shr eax, 1
test al, 1
je 0x41326c
shr eax, 1
xor eax, 0xedb88320
jmp 0x41326e
shr eax, 1
test al, 1
je 0x41327b
shr eax, 1
xor eax, 0xedb88320
jmp 0x41327d
shr eax, 1
test al, 1
je 0x41328a
shr eax, 1
xor eax, 0xedb88320
jmp 0x41328c
shr eax, 1
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0x100
jl 0x413215
ret
Function at 0x415eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4652d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
mov dword [esi], 0x468868
mov dword [esi + 8], 0x467aa4
mov dword [esi + 0x24], 0xffffffff
xor eax, eax
xor ebp, ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
push edi
mov dword [esp + 0xc], esi
mov dword [ecx + 0x14], eax
lea edi, [esi + 0x30]
mov ecx, edi
mov dword [esp + 0x1c], ebp
call fcn.00415c70
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x3c]
mov dword [esp + 0x10], edi
mov dword [edi], ebp
push 1
mov byte [esp + 0x20], 2
call fcn.0042e4e0
add esp, 4
mov dword [edi], eax
mov dword [esi + 0x40], 1
mov dword [esi + 4], ebp
mov eax, dword [esi + 0x2c]
dec eax
mov byte [esp + 0x1c], 3
je 0x415f70
dec eax
je 0x415f64
dec eax
jne 0x415f73
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
je 0x415f73
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0xffffffff
jmp 0x415f73
lea edx, [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x415f73
mov dword [esi + 0x28], ebp
lea eax, [esi + 0xc]
push eax
mov dword [esi + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x2c], 2
mov ecx, dword [edi]
push str.__self__nil_nEnvironmentList__last___1_nfunction_EnvironmentList:Push_value__nlocal_last__self.last__1_nself.last__last_nself_last_____self_n__self__value_nend_nfunction_EnvironmentList:Pop___nlocal_last__self.last_nlocal_value__self_last__nself_last___nil_nself.last__last___1_n__self__value_nreturn_value_nend_n
call fcn.00429740
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4189f0
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x20]
xor eax, eax
push eax
push ebp
mov esi, ecx
push edi
push ebx
mov dword [esi], 0x468b9c
mov dword [esi + 0x38], 1
call fcn.00454060
xor ecx, ecx
push ecx
push ebp
push edx
push eax
call fcn.00454020
mov ebp, dword [esp + 0x24]
mov dword [esi + 8], eax
xor ecx, ecx
mov eax, ebp
add eax, ebx
adc ecx, edi
mov dword [esi + 0x14], ecx
mov ecx, dword [esi + 8]
mov dword [esi + 0x10], eax
sub eax, ecx
sub ebx, ecx
mov dword [esp + 0x1c], ecx
push eax
sbb edi, edx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x20]
push edx
xor ecx, ecx
push eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov ecx, dword [esp + 0x20]
push 6
push ecx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
pop edi
mov dword [esi + 0x18], eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x418d60
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea eax, [esp + 4]
push eax
mov dword [esi], 0x468bec
mov dword [esi + 0x14], 1
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x10], ecx
mov eax, esi
pop esi
add esp, 0x24
ret

Function at 0x419750
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov al, byte [ebx]
test al, al
push esi
push edi
mov dword [esp + 0xc], ecx
mov esi, 0x7fed7fed
mov edi, 0xeeeeeeee
je 0x41979e
push ebp
mov ebp, dword [esp + 0x1c]
shl ebp, 8
movzx eax, al
push eax
call fcn.004541d3
mov edx, dword [esp + 0x14]
add esi, edi
imul edi, edi, 0x21
add esp, 4
inc ebx
lea ecx, [eax + ebp]
xor esi, dword [edx + ecx*4 + 4]
add edi, eax
mov al, byte [ebx]
test al, al
lea edi, [edi + esi + 3]
jne 0x419774
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x41f7c6
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov ecx, dword [edx + ecx*4]
mov dword [esp], ecx
movzx ecx, word [ebx + 2]
push ebp
push esi
mov esi, ecx
xor ecx, 0x7f0
xor eax, 0x7f0
shr esi, 4
mov esi, dword [edx + esi*4]
shr ecx, 4
mov ecx, dword [edx + ecx*4]
shr eax, 4
mov eax, dword [edx + eax*4]
add esi, eax
add ecx, eax
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ecx
xor edi, edi
cmp edi, dword [esp + 0x20]
jae 0x41f925
mov eax, edi
or eax, 8
xor esi, esi
cmp eax, 1
je 0x41f83a
jmp 0x41f810
mov ebp, dword [esp + 0x1c]
mov ecx, eax
and eax, 1
shr ecx, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x41f810
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
add esi, eax
mov dword [ecx + edi*4], esi
inc edi
cmp edi, 8
jb 0x41f7f5
cmp edi, 0x10
jae 0x41f8bd
lea eax, [edi - 8]
mov dword [esp + 0xc], eax
lea esp, [esp]
cmp edi, dword [esp + 0x20]
jae 0x41f925
or eax, 8
xor esi, esi
cmp eax, 1
je 0x41f8a1
mov ebp, dword [esp + 0x1c]
mov ecx, eax
and eax, 1
shr ecx, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x41f874
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
add esi, eax
mov eax, dword [esp + 0xc]
mov dword [ecx + edi*4], esi
inc edi
inc eax
cmp edi, 0x10
mov dword [esp + 0xc], eax
jb 0x41f860
cmp edi, dword [esp + 0x20]
jae 0x41f925
lea eax, [edi - 0x10]
mov dword [esp + 0xc], eax
lea ebx, [ebx]
or eax, 0x100
xor esi, esi
cmp eax, 1
je 0x41f906
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x41f8e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
add esi, eax
mov eax, dword [esp + 0xc]
mov dword [ecx + edi*4], esi
mov ecx, dword [esp + 0x20]
inc edi
inc eax
cmp edi, ecx
mov dword [esp + 0xc], eax
jb 0x41f8d0
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x4232b0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x1c]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x4232d3
mov edi, dword [esp + 0x1c]
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp eax, 0xffffffff
mov dword [esi + 0x40], eax
jne 0x4232f3
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret 4
mov edx, dword [esi]
push 0xf
push edi
mov ecx, esi
mov dword [esi + 0x44], 1
call dword [edx + 4]
sub eax, edi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x24
ret 4
Function at 0x42357d
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x47bfd4]
xor eax, esp
push esi
mov esi, ecx
mov dword [esp + 0x194], eax
lea ecx, [esi + 4]
mov dword [esi], 0x467e38
call fcn.00407960
lea eax, [esp + 4]
push eax
push 0x202
mov dword [esi], 0x46915c
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor ecx, ecx
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], 0
lea edx, [esi + 0x48]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0x194]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004525c5
add esp, 0x194
ret

Function at 0x425500
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, dword [ecx + 0x30]
sub esp, 8
test eax, eax
je 0x425565
mov eax, dword [esp + 0xc]
push esi
push eax
call fcn.004254a0
mov esi, eax
test esi, esi
jne 0x425526
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret 0xc
push edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push ecx
push esi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x42551b
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 0xc
cmp dword [ecx + 0x50], 0x10
jb 0x425570
mov ecx, dword [ecx + 0x3c]
jmp 0x425573
add ecx, 0x3c
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 8
ret 0xc

Function at 0x425590
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ecx
mov eax, dword [ecx + 0x30]
test eax, eax
push esi
je 0x42560f
mov eax, dword [esp + 0xc]
push edi
push eax
call fcn.004254a0
mov edi, eax
test edi, edi
jne 0x4255b4
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ecx
ret 0x14
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
push 0
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x4255f8
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x18]
jb 0x4255f8
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push edi
call ebp
mov esi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop ebp
pop ebx
jne 0x4255aa
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ecx
ret 0x14
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x42561c
mov eax, 0x467523
cmp dword [ecx + 0x50], 0x10
jb 0x425627
mov ecx, dword [ecx + 0x3c]
jmp 0x42562a
add ecx, 0x3c
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push esi
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, esi
pop esi
pop ecx
ret 0x14
Function at 0x425650
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
mov eax, dword [0x47bfd4]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x30]
test eax, eax
push edi
mov edi, dword [esp + 0x24]
je 0x4256c9
push edi
call fcn.004254a0
mov esi, eax
test esi, esi
jne 0x425692
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004525c5
add esp, 0x14
ret 0xc
push 4
lea eax, [esp + 0x30]
push eax
push 4
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004525c5
add esp, 0x14
ret 0xc
mov ecx, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x10]
push 0x467550
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esi + 0x50]
add esp, 0xc
cmp eax, 0x10
jb 0x4256ee
mov esi, dword [esi + 0x3c]
jmp 0x4256f1
add esi, 0x3c
push esi
lea eax, [esp + 0x10]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004525c5
add esp, 0x14
ret 0xc

Function at 0x425720
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov eax, dword [ecx + 0x30]
test eax, eax
je 0x4257b5
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
push edi
jne 0x425757
call fcn.00425420
mov esi, eax
test esi, esi
jne 0x425749
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x42579f
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x425779
mov edx, dword [esp + 0x10]
push edx
call fcn.004254a0
mov esi, eax
test esi, esi
je 0x425741
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x42579f
mov eax, dword [esp + 0x10]
push eax
call fcn.004254a0
mov esi, eax
test esi, esi
je 0x425741
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebx
ret 0xc
cmp dword [ecx + 0x50], 0x10
jb 0x4257c0
mov ecx, dword [ecx + 0x3c]
jmp 0x4257c3
add ecx, 0x3c
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
ret 0xc
Function at 0x42d010
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
push esi
mov esi, dword [ecx + 0x18]
xor eax, eax
cmp esi, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
jne 0x42d046
push str.m_state
lea ecx, [esp + 0x38]
call fcn.0042d7b0
push 0x477758
lea eax, [esp + 0x38]
push eax
call fcn.00452aa2
mov edx, dword [esi]
mov dword [esp + 8], edx
cmp dword [ecx + 0x10], 5
je 0x42d06f
push str.___m_object___tt___5_
lea ecx, [esp + 0x38]
call fcn.0042d7b0
push 0x477758
lea eax, [esp + 0x38]
push eax
call fcn.00452aa2
push ebx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d080
sub eax, edx
push ebp
mov ebp, eax
shr eax, 5
inc eax
cmp ebp, eax
push edi
mov ecx, ebp
mov edx, ebp
jb 0x42d0bf
lea esp, [esp]
movzx esi, byte [ebx + edx - 1]
mov edi, ecx
shl edi, 5
add esi, edi
mov edi, ecx
shr edi, 2
add esi, edi
sub edx, eax
xor ecx, esi
cmp edx, eax
jae 0x42d0a0
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ecx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x42d0f7
cmp byte [eax + 4], 4
jne 0x42d0f1
cmp dword [eax + 0xc], ebp
jne 0x42d0f1
mov ecx, ebp
lea edi, [eax + 0x10]
mov esi, ebx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42d12c
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x42d0d5
mov eax, dword [esp + 0x40]
mov dword [eax + 0x18], esi
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + 0x114]
add ecx, 0x114
pop edi
mov dword [eax], edx
mov dword [ecx], eax
mov edx, dword [eax]
pop ebp
mov dword [edx + 4], eax
pop ebx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], 0
pop esi
add esp, 0x2c
ret 8
mov esi, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esi + 8]
mov dword [esp + 0x2c], 4
mov ecx, dword [eax]
push edx
push ecx
call fcn.00432340
mov ecx, dword [esi + 0x18]
mov eax, dword [esp + 0x50]
xor edx, edx
add esp, 0x10
cmp ecx, edx
mov dword [esp + 0x24], edx
mov dword [eax + 0x10], edx
jne 0x42d18a
push str.state
lea ecx, [esp + 0x44]
call fcn.0042d7b0
push 0x477758
lea edx, [esp + 0x44]
push edx
call fcn.00452aa2
mov dword [eax + 0x18], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + 0x114]
add ecx, 0x114
mov dword [eax], edx
mov dword [ecx], eax
mov edx, dword [eax]
mov dword [edx + 4], eax
mov edx, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x2c]
pop edi
pop ebp
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
pop ebx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
pop esi
add esp, 0x2c
ret 8
Function at 0x42d1d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [ecx + 0x18]
xor eax, eax
cmp esi, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
jne 0x42d206
push str.m_state
lea ecx, [esp + 0x28]
call fcn.0042d7b0
push 0x477758
lea eax, [esp + 0x28]
push eax
call fcn.00452aa2
cmp dword [ecx + 0x10], 5
je 0x42d229
push str.___m_object___tt___5_
lea ecx, [esp + 0x28]
call fcn.0042d7b0
push 0x477758
lea ecx, [esp + 0x28]
push ecx
call fcn.00452aa2
mov edx, dword [esi]
push ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0xc], edx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d240
sub eax, edx
push ebp
mov ebp, eax
shr eax, 5
inc eax
cmp ebp, eax
push edi
mov ecx, ebp
mov edx, ebp
jb 0x42d27f
lea esp, [esp]
movzx esi, byte [ebx + edx - 1]
mov edi, ecx
shl edi, 5
add esi, edi
mov edi, ecx
shr edi, 2
add esi, edi
sub edx, eax
xor ecx, esi
cmp edx, eax
jae 0x42d260
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ecx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x42d2b7
cmp byte [eax + 4], 4
jne 0x42d2b1
cmp dword [eax + 0xc], ebp
jne 0x42d2b1
mov ecx, ebp
lea edi, [eax + 0x10]
mov esi, ebx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42d2ec
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x42d295
mov eax, dword [esp + 0x30]
mov dword [eax + 0x18], esi
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + 0x114]
add ecx, 0x114
pop edi
mov dword [eax], edx
mov dword [ecx], eax
mov edx, dword [eax]
pop ebp
mov dword [edx + 4], eax
pop ebx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], 0
pop esi
add esp, 0x1c
ret 8
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x2c], 4
call fcn.00434e80
mov ecx, dword [esi + 0x18]
xor edi, edi
mov edx, eax
add esp, 8
cmp edx, edi
mov dword [esp + 0x24], edi
jne 0x42d339
push 0x469c38
lea ecx, [esp + 0x34]
call fcn.0042d7b0
push 0x477758
lea edx, [esp + 0x34]
push edx
call fcn.00452aa2
cmp ecx, edi
mov eax, dword [esp + 0x30]
mov dword [eax + 0x10], edi
jne 0x42d361
push str.state
lea ecx, [esp + 0x38]
call fcn.0042d7b0
push 0x477758
lea eax, [esp + 0x38]
push eax
call fcn.00452aa2
mov dword [eax + 0x18], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x114]
mov dword [eax], esi
add ecx, 0x114
mov dword [ecx], eax
mov esi, dword [eax]
mov dword [esi + 4], eax
mov dword [eax + 4], ecx
mov ecx, dword [edx]
pop edi
mov dword [eax + 8], ecx
mov ecx, dword [edx + 4]
pop ebp
mov dword [eax + 0xc], ecx
mov edx, dword [edx + 8]
pop ebx
mov dword [eax + 0x10], edx
pop esi
add esp, 0x1c
ret 8
Function at 0x42f130
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x70]
test eax, eax
je 0x42f152
mov ecx, dword [esp + 0xc]
mov dword [eax + 0x44], ecx
mov edx, dword [esi + 0x70]
push 1
add edx, 4
push edx
call dword [sym.imp.MSVCR71.dll_longjmp]
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x10]
mov byte [esi + 6], al
mov edx, dword [ecx + 0x58]
test edx, edx
je 0x42f173
push eax
call fcn.0042f0b0
mov edx, dword [esi + 0x10]
push esi
call dword [edx + 0x58]
add esp, 8
push 1
call dword [sym.imp.MSVCR71.dll_exit]
int3
Function at 0x435810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, ebp
shr eax, 5
push esi
mov esi, dword [esp + 0x14]
inc eax
cmp ebp, eax
push edi
mov edx, ebp
mov ecx, ebp
jb 0x43584b
lea ebx, [ebx]
movzx edi, byte [esi + ecx - 1]
mov ebx, edx
shl ebx, 5
add edi, ebx
mov ebx, edx
shr ebx, 2
add edi, ebx
sub ecx, eax
xor edx, edi
cmp ecx, eax
jae 0x435830
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, edx
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x435881
cmp byte [eax + 4], 4
jne 0x43587b
cmp dword [eax + 0xc], ebp
jne 0x43587b
mov ecx, ebp
lea edi, [eax + 0x10]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x435897
mov esi, dword [esp + 0x18]
mov eax, dword [eax]
test eax, eax
jne 0x435861
mov eax, dword [esp + 0x14]
push edx
push esi
push eax
mov ebx, ebp
call fcn.004356a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov cl, byte [eax + 5]
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x10]
movzx edx, byte [edx + 0x14]
xor ebx, ebx
mov bl, cl
not edx
and ebx, 3
test bl, dl
je 0x435892
pop edi
pop esi
xor cl, 3
pop ebp
mov byte [eax + 5], cl
pop ebx
ret

Function at 0x4358c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, ebp
shr eax, 5
push esi
inc eax
cmp ebp, eax
push edi
mov edx, ebp
mov edi, ebp
jb 0x4358fe
mov ecx, dword [esp + 0x18]
lea ecx, [ecx + ebp*2 - 2]
mov edi, edi
mov esi, edx
shl esi, 5
mov ebx, edx
shr ebx, 2
add esi, ebx
movzx ebx, word [ecx]
add esi, ebx
xor edx, esi
lea esi, [eax + eax]
sub edi, eax
sub ecx, esi
cmp edi, eax
jae 0x4358e0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, edx
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x435936
cmp byte [eax + 4], 9
jne 0x435930
cmp dword [eax + 0xc], ebp
jne 0x435930
mov esi, dword [esp + 0x18]
lea ecx, [ebp + ebp]
lea edi, [eax + 0x10]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x435950
mov eax, dword [eax]
test eax, eax
jne 0x435914
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
mov ebx, ebp
call fcn.00435750
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esp + 0x14]
mov cl, byte [eax + 5]
mov esi, dword [esi + 0x10]
xor edx, edx
xor ebx, ebx
mov bl, byte [esi + 0x14]
mov dl, cl
not ebx
and edx, 3
test bl, dl
je 0x43594b
pop edi
pop esi
xor cl, 3
pop ebp
mov byte [eax + 5], cl
pop ebx
ret