joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444660
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x481340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push edi
mov edi, dword [ebp + 0x10]
push 0x40
push 0
push eax
call fcn.004552e0
push dword [ebp + 0xc]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0
push esi
push eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0xc3d2e1f0
call fcn.00442780
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x444755
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x68]
lea ecx, [eax*8]
mov eax, edx
shr eax, 0x1d
or ecx, eax
lea eax, [edx*8]
mov dword [ebp - 0xc], eax
and edx, 0x3f
mov dword [ebp - 8], ecx
mov eax, 0x38
sub eax, edx
mov ecx, pe_nt_image_headers32
sub ecx, edx
cmp edx, 0x38
cmovae eax, ecx
push eax
lea eax, [ebp - 0x68]
push 0x472ff0
push eax
call fcn.00442780
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x444755
push 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00442780
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x444755
mov eax, dword [ebp - 0x60]
mov dword [edi], eax
mov eax, dword [ebp - 0x5c]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x58]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x54]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x50]
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x68]
push 0x5c
push eax
call fcn.0042f390
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.00446e61
mov esp, ebp
pop ebp
ret
Function at 0x445ca0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x481340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x40
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004552e0
mov esi, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0x67452301
mov dword [ebp - 0x54], 0xefcdab89
mov dword [ebp - 0x50], 0x98badcfe
mov dword [ebp - 0x4c], 0x10325476
mov dword [ebp - 0x48], 0xc3d2e1f0
test esi, esi
je 0x445d44
mov dword [ebp - 0x60], esi
cmp esi, 0x40
jb 0x445d32
nop dword [eax]
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.004448f0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x445dfd
sub esi, 0x40
add edi, 0x40
cmp esi, 0x40
jae 0x445d10
test esi, esi
je 0x445d44
push esi
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.00454d60
add esp, 0xc
mov ecx, dword [ebp - 0x60]
lea edx, [ebp - 0x44]
and ecx, 0x3f
mov byte [ebp + ecx - 0x44], 0x80
inc ecx
add edx, ecx
cmp ecx, 0x38
ja 0x445d67
mov eax, 0x38
sub eax, ecx
push eax
push 0
push edx
jmp 0x445d94
mov eax, 0x40
sub eax, ecx
push eax
push 0
push edx
call fcn.004552e0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004448f0
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x445dfd
push 0x38
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004552e0
mov eax, dword [ebp - 0x5c]
add esp, 0xc
mov ecx, dword [ebp - 0x60]
lea edx, [eax*8]
mov eax, ecx
shr eax, 0x1d
or edx, eax
shl ecx, 3
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x60]
bswap edx
bswap ecx
push eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
call fcn.004448f0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x445dfd
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x58]
bswap eax
mov dword [ecx], eax
mov eax, dword [ebp - 0x54]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x50]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x4c]
bswap eax
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x48]
bswap eax
mov dword [ecx + 0x10], eax
lea eax, [ebp - 0x60]
push 0x5c
push eax
call fcn.0042f390
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00446e61
mov esp, ebp
pop ebp
ret
Function at 0x445e60
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
test ecx, ecx
je 0x445e7b
cmp ecx, 1
je 0x445e7b
mov eax, 0xffffff8c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test ecx, ecx
push ebx
mov edx, 0x367cd507
mov dword [ebp - 4], 0xc1059ed8
push esi
mov dword [eax], 0
mov ebx, 0xa54ff53a
mov dword [eax + 4], 0
mov esi, 0x1f83d9ab
mov eax, 0xbb67ae85
mov ecx, 0x5be0cd19
cmovne eax, edx
mov edx, 0x3070dd17
mov dword [ebp - 8], eax
mov eax, 0x3c6ef372
cmovne eax, edx
mov edx, 0x9b05688c
mov dword [ebp - 0xc], eax
mov eax, 0xf70e5939
cmovne ebx, eax
mov eax, 0xffc00b31
push edi
mov edi, 0x510e527f
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0xc]
cmovne edi, eax
mov eax, 0x64f98fa7
cmovne esi, eax
mov eax, 0x68581511
cmovne edx, eax
test ebx, ebx
mov ebx, dword [ebp + 8]
mov eax, 0xbefa4fa4
cmovne ecx, eax
mov eax, 0x6a09e667
cmovne eax, dword [ebp - 4]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax + 0x68], ecx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x447320
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
movups xmm0, xmmword [ecx]
mov ecx, dword [edx]
lea eax, [edx + eax*4]
dec ecx
pxor xmm0, xmmword [eax + 8]
add eax, 0x18
cmp dword [ebp + 0xc], 0
jne 0x44736c
test ecx, ecx
je 0x44735d
nop word [eax + eax]
aesdec xmm0, xmmword [eax]
add eax, 0x10
sub ecx, 1
jne 0x447350
aesdeclast xmm0, xmmword [eax]
mov eax, dword [ebp + 0x14]
movups xmmword [eax], xmm0
xor eax, eax
pop ebp
ret
test ecx, ecx
je 0x44737d
aesenc xmm0, xmmword [eax]
add eax, 0x10
sub ecx, 1
jne 0x447370
aesenclast xmm0, xmmword [eax]
mov eax, dword [ebp + 0x14]
movups xmmword [eax], xmm0
xor eax, eax
pop ebp
ret

Function at 0x447500
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
shl eax, 4
add eax, edx
movups xmm0, xmmword [eax]
sub eax, 0x10
movups xmmword [ecx], xmm0
add ecx, 0x10
cmp eax, edx
jbe 0x447533
aesimc xmm0, xmmword [eax]
sub eax, 0x10
movups xmmword [ecx], xmm0
lea ecx, [ecx + 0x10]
cmp eax, edx
ja 0x447521
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
pop ebp
ret
Function at 0x4475a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 8]
movups xmmword [eax], xmm0
movups xmm2, xmmword [eax]
aeskeygenassist xmm0, xmm2, 1
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 2
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movups xmmword [eax + 0x10], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm2, xmm3
pxor xmm2, xmm1
pslldq xmm3, 4
pxor xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
movups xmmword [eax + 0x20], xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movups xmmword [eax + 0x30], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm2, xmm3
pxor xmm2, xmm1
pslldq xmm3, 4
pxor xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
movups xmmword [eax + 0x40], xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movups xmmword [eax + 0x50], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm2, xmm3
pxor xmm2, xmm1
pslldq xmm3, 4
pxor xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm0, xmm0, 0xff
movups xmmword [eax + 0x60], xmm2
pxor xmm0, xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movups xmmword [eax + 0x70], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm2, xmm3
pxor xmm2, xmm1
pslldq xmm3, 4
pxor xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
movups xmmword [eax + 0x80], xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movups xmmword [eax + 0x90], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm0, xmm3
pxor xmm0, xmm1
pslldq xmm3, 4
pxor xmm0, xmm3
movups xmmword [eax + 0xa0], xmm0
pop ebp
ret
Function at 0x4488f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], eax
test ecx, ecx
je 0x44897e
mov eax, dword [ebp + 0xc]
dec ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [eax + ecx*4]
sub ebx, eax
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], ebx
nop
mov ebx, dword [ebx + ecx]
mov esi, dword [ecx]
mov edi, esi
xor edi, ebx
mov ecx, esi
sub ecx, ebx
mov edx, edi
not edx
mov eax, edi
and eax, ebx
and ecx, edx
or ecx, eax
sub ebx, esi
mov eax, dword [ebp - 8]
and ebx, edx
mov edx, dword [ebp - 4]
and edi, esi
shr ecx, 0x1f
or ebx, edi
or eax, ecx
shr ebx, 0x1f
mov ecx, 1
sub ecx, eax
or eax, ebx
and ecx, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
or edx, ecx
mov ecx, dword [ebp - 0xc]
dec eax
mov ebx, dword [ebp + 8]
sub ecx, 4
mov dword [ebp - 4], edx
mov dword [ebp + 0x10], eax
mov dword [ebp - 0xc], ecx
test eax, eax
jne 0x448920
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x448dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
test ebx, ebx
je 0x448dfd
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
sub ecx, edi
mov dword [ebp + 8], ecx
nop word [eax + eax]
mov dl, byte [ecx + edi]
lea edi, [edi + 1]
mov cl, byte [edi - 1]
movzx esi, cl
movzx ecx, dl
xor esi, ecx
mov ecx, dword [ebp + 8]
or eax, esi
sub ebx, 1
jne 0x448de0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44de76
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44deb5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44deb5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44deb5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44deb5
cmp dword [ecx + 0x74], 0xe
jbe 0x44deb5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44e6e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042c6f0
Function at 0x44ea70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x481340]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
test ebx, ebx
je 0x44ebcd
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movups xmmword [edi + 0x168], xmm0
push esi
lea esi, [edi + 0x168]
mov dword [ebp - 0x20], esi
movups xmmword [edi + 0x178], xmm0
mov dword [edi + 0x188], eax
mov dword [edi + 0x148], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x150], 0
mov dword [edi + 0x154], 0
cmp ebx, 0xc
jne 0x44eb0b
movq xmm0, qword [ecx]
movq qword [esi], xmm0
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov byte [edi + 0x177], 1
jmp 0x44eba5
mov eax, ebx
movlpd qword [ebp - 0x14], xmm0
mov edx, 8
mul edx
bswap eax
bswap edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov edi, 0x10
cmp ebx, edi
cmovb edi, ebx
test edi, edi
je 0x44eb49
mov eax, esi
mov edx, ecx
mov esi, edi
mov cl, byte [edx]
lea edx, [edx + 1]
xor byte [eax], cl
lea eax, [eax + 1]
sub esi, 1
jne 0x44eb37
mov esi, dword [ebp - 0x20]
push esi
push esi
push dword [ebp - 0x1c]
call fcn.0044ee30
mov ecx, dword [ebp - 0x18]
add esp, 0xc
add ecx, edi
mov dword [ebp - 0x18], ecx
sub ebx, edi
jne 0x44eb23
mov edi, dword [ebp - 0x1c]
lea edx, [ebp - 0x13]
mov ebx, 4
lea ecx, [edi + 0x169]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
xor byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 4]
xor byte [ecx - 4], al
movzx eax, byte [edx - 3]
xor byte [ecx - 3], al
movzx eax, byte [edx - 2]
xor byte [ecx - 2], al
sub ebx, 1
jne 0x44eb73
push esi
push esi
push edi
call fcn.0044ee30
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x158]
push eax
push 0x10
push esi
push edi
call fcn.0044d5b0
add esp, 0x14
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00446e61
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop edi
xor ecx, ebp
pop ebx
call fcn.00446e61
mov esp, ebp
pop ebp
ret
Function at 0x451610
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, dword [ecx]
xor ebx, dword [eax]
mov ecx, dword [ecx + 4]
xor ecx, dword [eax + 4]
mov eax, ecx
shr eax, 0x18
movzx esi, byte [eax + 0x474cf8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x474df8]
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x474ef8]
or esi, eax
movzx eax, cl
shl esi, 8
movzx eax, byte [eax + 0x474bf8]
or esi, eax
mov eax, ebx
shr eax, 0x18
mov edx, esi
rol edx, 8
movzx ecx, byte [eax + 0x474bf8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x474cf8]
or ecx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x474df8]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx eax, byte [eax + 0x474ef8]
or ecx, eax
xor edx, ecx
mov ecx, dword [ebp + 0x10]
mov eax, edx
rol eax, 0x10
xor esi, eax
mov eax, esi
ror eax, 8
xor edx, eax
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, esi
xor dword [ecx + 4], edx
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret
Function at 0x452960
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push 0x4753e8
push 0x4752e8
mov eax, dword [edx]
xor eax, dword [ecx]
mov dword [ebp + 0xc], eax
mov eax, dword [edx + 4]
xor eax, dword [ecx + 4]
mov dword [ebp + 0x10], eax
mov eax, dword [edx + 8]
xor eax, dword [ecx + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 0xc]
xor eax, dword [ecx + 0xc]
push 0x4751e8
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str.cw
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00452870
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00452700
mov edx, dword [ebp + 0x14]
add esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [edx]
xor eax, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [edx + 4]
xor eax, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
xor eax, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
xor eax, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov esp, ebp
pop ebp
ret

Function at 0x452a00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0x14]
sub esp, 0xc
push ebx
mov bl, al
shr eax, 5
push esi
and bl, 0x1f
push edi
and eax, 0x80000003
jns 0x452a21
dec eax
or eax, 0xfffffffc
inc eax
mov esi, dword [ebp + 0x10]
mov dl, bl
mov edi, dword [ebp + 8]
movzx ecx, al
mov dword [ebp + 0x14], 4
mov ecx, dword [esi + ecx*4]
bswap ecx
mov dword [ebp - 4], ecx
mov cl, 0x20
sub cl, bl
neg dl
sbb dl, dl
and dl, cl
sub dword [ebp + 0xc], edi
movzx ecx, dl
mov dword [ebp - 8], ecx
movzx ecx, bl
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
inc al
lea edi, [edi + 4]
and al, 3
movzx ecx, al
mov esi, dword [esi + ecx*4]
mov ecx, dword [ebp - 8]
bswap esi
mov edx, esi
shr edx, cl
mov ecx, dword [ebp - 0xc]
shl ebx, cl
mov ecx, dword [ebp + 0xc]
or edx, ebx
bswap edx
mov ebx, esi
mov esi, dword [ebp + 0x10]
xor edx, dword [ecx + edi - 4]
sub dword [ebp + 0x14], 1
mov dword [edi - 4], edx
jne 0x452a57
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45cdc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45cded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45cded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x45d271
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x475be8
push 0x475be0
push str.FlsAlloc
push 0x1f
call fcn.0045d554
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45d2a5
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x45d2ab
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x45d2ef
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x475bf8
push 0x475bf0
push str.FlsGetValue
push 0x21
call fcn.0045d554
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45d326
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x45d32e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x475c00
push 0x475bf8
push str.FlsSetValue
push 0x22
call fcn.0045d554
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45d368
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x461976
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x461a13
push ebx
push esi
call fcn.00461a16
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0046187a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4619c0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x461a12
push edi
push eax
call fcn.0045f07f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4619e0
call fcn.0045e6d4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x461a11
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0046187a
add esp, 0x20
test eax, eax
jne 0x4619ff
push edi
call fcn.0045e6d4
jmp 0x461a07
push ebx
call fcn.0045e6d4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x404f95
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 4], 0
lea ecx, [ebp - 8]
and dword [ebp - 0xc], 0
lea edx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], eax
push ecx
mov ecx, eax
call fcn.00410740
mov esi, eax
test esi, esi
js 0x405045
mov ecx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 4]
call fcn.00410740
mov esi, eax
test esi, esi
jne 0x40503e
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [ebp - 4]
push 0x2f
pop ecx
movzx eax, word [edi]
cmp cx, ax
je 0x404ffc
push 0x2d
pop ecx
cmp cx, ax
jne 0x40506f
lea esi, [edi + 2]
push esi
push str.standalone
call ebx
test eax, eax
jne 0x405010
mov eax, dword [ebp + 8]
jmp 0x40501f
push esi
push str.standalone:temp
call ebx
test eax, eax
jne 0x405067
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
mov dword [eax], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00410740
mov esi, eax
test esi, esi
je 0x404fe6
xor eax, eax
test esi, esi
cmovns esi, eax
mov edi, dword [ebp - 4]
test edi, edi
je 0x40505c
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push str.standalone:delete
call ebx
mov esi, 0x80070057
jmp 0x405048
Function at 0x40a0ea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor bl, bl
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x40a15c
mov eax, dword [edi + 0xc]
lea edx, [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov esi, eax
test esi, esi
js 0x40a246
lea eax, [ebp + 0xc]
xor ebx, ebx
push eax
inc ebx
push ebx
push 0
push dword [edi + 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x40a251
cmp esi, 0x80070003
je 0x40a251
test esi, esi
js 0x40a246
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
mov dword [ebp + 8], 4
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push str.Size
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40a239
mov eax, dword [ebp - 4]
and dword [edi + 0x4c], 0
mov dword [edi + 0x48], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp + 8], 4
push eax
push 0
push 0
push str.Progress
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40a239
mov eax, dword [ebp - 4]
xor ecx, ecx
mov dword [edi + 0x50], eax
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x74]
mov dword [edi + 0x54], ecx
push eax
push ecx
push ecx
push str.LastAttemptHigh
push dword [ebp + 0xc]
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x40a239
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [edi + 0x70]
push eax
push 0
push 0
push str.LastAttemptLow
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test bl, bl
je 0x40a246
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov esi, ebx
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], eax
jmp 0x40a246