joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c10
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x974
push esi
push edi
sub esp, 0xc
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.00410450
lea ecx, [ebp - 0xa4]
push ecx
call fcn.00404970
mov esi, eax
add esp, 0x10
mov ecx, 0xf
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
push 0x33501e9
lea ecx, [ebp - 0x14]
call fcn.00410410
push 0
push 0
push 0
push 1
lea ecx, [ebp + 0x18]
call fcn.00410650
push eax
call dword [0x356b764]
mov edx, dword [0x355aa14]
mov esi, eax
mov eax, dword [ebp - 0x64]
push edx
push eax
mov dword [ebp - 0x18], esi
xor edi, edi
call dword [0x356b840]
test eax, eax
jne 0x405c87
lea edi, [eax + 1]
test esi, esi
je 0x405dea
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x58]
push 0
push 0
push 3
push 0
push 0
push ecx
push edx
push esi
call dword [0x356b864]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x405de3
mov edx, dword [ebp - 0x3c]
mov eax, edi
neg eax
sbb eax, eax
push 0
and eax, 0x800000
add eax, 0x400100
push eax
mov eax, dword [0x355a860]
push 0
push 0
push eax
push edx
push 0x335335c
push ecx
call dword [0x356b8a4]
mov esi, eax
test esi, esi
je 0x405dd6
test edi, edi
je 0x405d06
or dword [ebp - 4], 0x10300
push 4
lea eax, [ebp - 4]
push eax
push 0x1f
push esi
call dword [0x356b65c]
push 0
push 0
push 0
push 0
push esi
call dword [0x356b82c]
push 0
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1a4]
push edx
push 0x13
push esi
mov edi, eax
mov dword [ebp - 0x20], 0x100
call dword [0x356b8bc]
test eax, eax
jne 0x405d4c
mov esi, dword [ebp + 8]
push 0x3353368
mov ecx, esi
call fcn.00410410
jmp 0x405df8
lea eax, [ebp - 0x1a4]
push eax
call fcn.00411680
add esp, 4
cmp eax, 0xc8
jne 0x405d38
test edi, edi
je 0x405dcf
lea ecx, [ebp - 8]
push ecx
push 0x7cf
lea edx, [ebp - 0x974]
push edx
push esi
call dword [0x356b78c]
test eax, eax
je 0x405dcf
mov eax, dword [ebp - 8]
test eax, eax
je 0x405dcf
mov byte [ebp + eax - 0x974], 0
lea eax, [ebp - 0x974]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004105a0
push eax
lea ecx, [ebp - 0x14]
call fcn.004104f0
lea ecx, [ebp - 0x2c]
call fcn.00410490
lea edx, [ebp - 8]
push edx
push 0x7cf
lea eax, [ebp - 0x974]
push eax
push esi
call dword [0x356b78c]
test eax, eax
jne 0x405d81
push esi
call dword [0x356b760]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [0x356b760]
mov esi, dword [ebp - 0x18]
push esi
call dword [0x356b760]
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
mov ecx, esi
call fcn.00410450
lea ecx, [ebp - 0x14]
call fcn.00410490
lea ecx, [ebp + 0xc]
call fcn.00410490
lea ecx, [ebp + 0x18]
call fcn.00410490
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406f00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x40
push 0
push esi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x406f1a
mov eax, 1
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x406fc8
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x406fc8
push edi
push ebx
push 0xf8
push eax
lea edi, [esi + 0x40]
push edi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x406f51
mov eax, 1
pop edi
pop ebp
ret
cmp dword [edi], 0x4550
jne 0x406fc0
mov ecx, 0x10b
cmp word [esi + 0x58], cx
jne 0x406fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0x406fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
mov dword [esi + 0x140], eax
call fcn.00411740
add esp, 4
mov dword [esi + 0x138], eax
test eax, eax
jne 0x406f97
mov eax, 3
pop edi
pop ebp
ret
movzx edx, word [esi + 0x54]
mov ecx, dword [esi + 0x3c]
lea ecx, [edx + ecx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call dword [ebp + 8]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
pop ebp
ret
mov eax, 2
pop edi
pop ebp
ret
mov eax, 2
pop ebp
ret

Function at 0x4076c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4076fc
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x4076fc
mov edx, 0x10b
cmp word [eax + ecx + 0x18], dx
jne 0x4076fc
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + ecx + 0x78]
push edx
push ecx
push eax
call fcn.00407600
add esp, 0xc
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40f980
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 8], 0
xor eax, eax
cmp dword [edi], 0x4550
jne 0x40fa5e
push 0x44
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x60]
push eax
call fcn.0041d248
mov eax, dword [ebp + 0x10]
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 4
push 1
push 0
push 0
push eax
push ecx
call dword [0x356b710]
test eax, eax
je 0x40fb19
push ebx
push 4
push 0x1000
push 4
push 0
call dword [0x356b7cc]
mov ebx, eax
mov dword [ebx], 0x10007
mov edx, dword [ebp - 0x18]
push ebx
push edx
mov dword [ebp - 0xc], ebx
call dword [0x356b868]
test eax, eax
je 0x40fa5b
mov ecx, dword [ebx + 0xa4]
mov edx, dword [ebp - 0x1c]
push 0
push 4
lea eax, [ebp - 8]
push eax
add ecx, 8
push ecx
push edx
call dword [0x356b86c]
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov edx, dword [ebp - 0x1c]
push 0x40
push 0x3000
push eax
push ecx
push edx
call dword [0x356b6b8]
mov ebx, eax
test ebx, ebx
jne 0x40fa64
mov eax, dword [ebp - 0x18]
push eax
call dword [0x356b880]
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x54]
mov edx, dword [ebp - 0x1c]
push 0
push ecx
push esi
push ebx
push edx
call dword [0x356b6c8]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 4], eax
cmp cx, word [edi + 6]
jae 0x40fad0
mov dword [ebp + 0xc], eax
jmp 0x40fa90
mov edx, dword [esi + 0x3c]
add edx, dword [ebp + 0xc]
mov ecx, dword [edx + esi + 0x108]
lea eax, [edx + esi + 0xf8]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
push 0
push ecx
mov ecx, dword [ebp - 0x1c]
add edx, esi
push edx
add eax, ebx
push eax
push ecx
call dword [0x356b6c8]
mov eax, dword [ebp - 4]
movzx edx, word [edi + 6]
add dword [ebp + 0xc], 0x28
inc eax
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x40fa90
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esi + 0xa4]
add eax, 8
push eax
push ecx
call dword [0x356b6c8]
mov edx, dword [edi + 0x28]
add edx, ebx
mov dword [esi + 0xb0], edx
mov eax, dword [ebp - 0x18]
push esi
push eax
call dword [0x356b69c]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [0x356b880]
mov eax, dword [ebp - 0x14]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x41a73e
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x41a81d
mov esi, edx
shr esi, 3
push edi
jmp 0x41a760
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3354148]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3354148]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3354148]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3354148]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3354148]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3354148]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3354148]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x3354148]
add ecx, 8
sub edx, 8
dec esi
jne 0x41a760
pop edi
test edx, edx
je 0x41a83a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x3354148]
inc ecx
dec edx
jne 0x41a821
not eax
pop esi
pop ebp
ret

Function at 0x41a840
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x3354148]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x3354148]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x41a990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [0x3350080]
test eax, eax
jne 0x41a9b3
mov eax, 0x200
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
push ebx
push edi
mov edx, eax
xor edi, edi
and edx, 1
je 0x41a9cb
mov dword [ebp - 8], 1
mov edi, dword [ebp - 8]
test al, 2
je 0x41a9d2
or edi, 2
test al, 4
je 0x41a9d9
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x41a9e3
or edi, 0x10
test al, 0x20
je 0x41a9ea
or edi, 0x20
test ecx, ecx
je 0x41a9f6
or edi, 0x40000000
jmp 0x41a9fc
or edi, 0x80000000
or edi, 0x1000000
mov dword [ebp - 8], edi
test edx, edx
jne 0x41aa12
or edi, 0x800000
mov dword [ebp - 8], edi
push 0
push esi
call dword [0x335007c]
mov dword [ebp - 0x10], eax
cmp eax, 0x28
jbe 0x41aab9
mov edi, dword [0x3350078]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [0x3350074]
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
lea edx, [ebp - 4]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 0x14]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [ebp - 4], dx
jne 0x41aab6
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x10], ecx
jbe 0x41aab6
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [ebp - 0xc]
push edx
push 4
lea eax, [ebp - 0x18]
push eax
push esi
call ebx
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x41aaaf
cmp eax, 0x454e
je 0x41aaaf
cmp eax, 0x454c
je 0x41aaaf
cmp eax, 0x4550
jne 0x41aab6
or dword [ebp - 8], 0x400000
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41aac2
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41aace
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x38]
test esi, esi
je 0x41ab48
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.0041d480
mov dword [esi + 4], edx
push 0
mov ecx, ebx
sub ecx, 0xd53e8000
mov edx, edi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [esi], eax
call fcn.0041d480
mov ecx, dword [ebp - 0x44]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x48]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [esi + 0xc], edx
call fcn.0041d480
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x41ab70
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.0041a930
movzx ecx, word [ebp - 4]
movzx edx, word [ebp - 8]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [esi], ecx
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ad30
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x41ae1b
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x41ad67
cmp dword [esi + 0x40], edi
jae 0x41ad67
push eax
call fcn.004120b0
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x41ad7f
lea eax, [edi + edi]
push eax
call fcn.00411670
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0041d254
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x41ae18
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x3354148]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x3354148]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x41ad97
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x41ae5a
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x41ae3f
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0041d254
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41ae7c
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call dword [0x3350094]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41c2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x41c4e5
cmp dword [esi + 0x6af90], 3
jb 0x41c347
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebx, ebx
je 0x41c387
mov edx, dword [esi + 0x6af84]
sub edx, ebx
cmp edx, 0x7efa
ja 0x41c387
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x41c36f
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.00419c30
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x41c387
mov edi, eax
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x41c464
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.00419700
sub dword [esi + 0x6af90], edi
add esp, 0xc
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
cmp edi, dword [esi + 0x6af98]
ja 0x41c42e
cmp eax, 3
jb 0x41c42e
mov eax, 1
sub edi, eax
lea ecx, [ecx]
add dword [esi + 0x6af84], eax
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov ebx, dword [esi + 0x6af7c]
shl ebx, 5
xor ecx, ebx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub edi, eax
mov dword [esi + edx*4 + 0x2af70], ebx
mov edx, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + edx*4 + 0x4af70], ecx
jne 0x41c3d0
add dword [esi + 0x6af84], eax
jmp 0x41c487
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
xor edi, edi
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
jmp 0x41c487
movzx edx, byte [ecx + esi + 0x1af70]
push edx
push 0
push esi
call fcn.00419700
dec dword [esi + 0x6af90]
add esp, 0xc
inc dword [esi + 0x6af84]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x41c4c3
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x41c4a0
lea ecx, [eax + esi + 0x1af70]
jmp 0x41c4a2
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.0041c140
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x41c4d8
push esi
call fcn.00419d90
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x41c2f3
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x41c4f8
lea ecx, [eax + esi + 0x1af70]
jmp 0x41c4fa
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.0041c140
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4baaa0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
push eax
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4ba070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4baaa0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ba05c
push eax
call esi
mov ecx, dword [0x4baaa0]

Function at 0x417a34
Capabilities:
Get common file path

Disassembly:
push eax
ret
Function at 0x424811
Capabilities:
Encode data using xor

Disassembly:
push es
or byte [esi + 0x6d5fb64b], dl
jnp 0x424836
mov dword [edi - 0x31], ecx
invalid
ja 0x4247e7
mov al, 0x73
push es
jae 0x42483f
std
jnp 0x424835
inc ebp
aas
add cl, al
xor al, 0x43
fsubr dword [edx]
xlatb
sal dword [ebx + eax*2], 0xd8
sub dl, bh
cmp eax, 0x8a39e844
cmp dl, dh
mov dword [0x4d590ec0], eax
or eax, dword [ebp - 0x54fde1da]
inc edi
scasb al, byte es:[edi]
pop edx
std
or esi, dword [edi - 4]
mov dword [0xc9402b58], eax
adc dl, byte [ebp + 1]
in al, dx
cmp byte [ecx], 0xc3
add al, 0x9c
add eax, 0xc2e211fd
sar byte [eax], 0x2d
ret

Function at 0x4268e8
Capabilities:
Encode data using xor

Disassembly:
std
pop ebp
lcall 0xdb4a, 0xe9b8a8eb
jmp 0x579243fa
mov dl, 0x2f
xor eax, 0x1fd2f1f
xor eax, 0x530edfed
ror eax, cl
neg byte [edx + 0x6b631857]
sbb byte [ebx + 0x6b], ah
inc ebp
adc al, 0x3c
cld
aas
xor dword [ebp + 0x79648f3f], ecx
jle 0x4268c1
insb byte es:[edi], dx
in eax, 0x6a
test eax, 0x276fe700
mov edi, 0x4b4c3d7b
imul eax, dword [edx + 0x1c737370], 0x2d
enter 0x76f0, 0x63
arpl sp, ax
or eax, 0xd8287a83
arpl sp, ax
or eax, 0xd8287a83
lahf
movsb byte es:[edi], byte [esi]
pushal
insd dword es:[edi], dx
out 0xb9, eax
cmc
jg 0x4268a5
call 0x1dd0d464
inc ebp
cmp al, 0x41
xor byte [esi - 0x45], dh
loopne 0x426900
sal bh, cl
dec eax
pop ebp
inc edi
getsec
enter 0x449a, 0x1f
invalid

Function at 0x42e70c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
nop
sub al, 0xa9
or dword [eax], 0x6726cfe
into
outsd dx, dword [esi]
and bh, bl
or al, 0xae
and dh, byte [esi + 0x69]
mov word [edi + 0x40], ds
dec ebx
sbb byte [eax], al
dec ecx
ficom word gs:[ebx]
bound eax, qword [eax - 0x2a]
bound esi, qword [ebx]
mov ah, 0x93
adc dword [edx + 0x21656987], eax
inc esi
sub bl, byte ss:[ecx]
sbb dl, al
fidiv dword [ebx + 0x5a82fef7]
mov esi, 0x292db25f
xchg edx, eax
out dx, al
test byte [edi - 0x20], dl
loop 0x42e761
test al, 0x75
jne 0x42e6a4
or dword [edi], eax
push esi
jae 0x42e6e7
movsb byte es:[edi], byte [esi]
ret 0x65e2
insd dword es:[edi], dx
dec ebp
movsb byte es:[edi], byte [esi]
and byte [ecx - 0xa334b8e], 0x61
mov edx, 0x786bce6e
Function at 0x43135d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00431550
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0043c0a5
xor ebx, ebx
cmp eax, ebx
jne 0x43150b
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00431550
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00438d84
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.0048a679
add esp, 0x10
test eax, eax
jne 0x431426
push esi
call fcn.0042ea0f
mov esi, eax
cmp esi, ebx
pop ecx
je 0x431426
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x431411
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x431426
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x43141f
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0043d5b8
cmp byte [esp + 0x13], bl
je 0x431456
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0043158d
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4314c6
push 0x14
call fcn.004898e6
cmp eax, ebx
pop ecx
je 0x431480
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x431482
xor edi, edi
cmp edi, ebx
je 0x4314c6
push esi
push edi
call fcn.00430ab3
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00430b7b
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00430ca4
add esp, 0x18
call fcn.00431550
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0043b772
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4314dd
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4314ef
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x431532
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x431532
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00430b7b
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00430ca4
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45afd0
Capabilities:
Encode data using xor

Disassembly:
sub dword [edi], 0x4e0e7f67
mov cs, word [edx - 0x69]
dec ebx
fcmovnb st(0), st(7)
mov dword [0x5fbbffe0], eax
jne fcn.0045b04e
pop esi
sub al, byte [edx - 0x77]
dec edx
fsubr dword [esi + 0x31644061]
dec eax
sub byte [esi], ch
jle 0x45afae
invalid
sub ebx, edx
scasd eax, dword es:[edi]
push ebp
inc esp
test dword [esi + 0x3486d848], 0x839b6ca6
ljmp 0x1a7c
mov ch, 0xa
invalid
jl 0x45b019