joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426620
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47046b
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x48b084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x4267fd
mov eax, dword [edi]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004478b8
xor ebx, ebx
mov dword [edi + 4], eax
add esp, 4
cmp dword [edi], ebx
jle 0x4267c8
nop
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov edx, dword [eax + ebx*4]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x48], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4266e2
sub eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
push edx
call fcn.0040c1a0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00416660
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
mov eax, dword [edi + 0xc]
push ecx
cmp dword [edi + 0x10], eax
je 0x42672d
mov ecx, eax
call fcn.0040af10
add dword [edi + 0xc], 0x18
jmp 0x426736
push eax
lea ecx, [edi + 8]
call fcn.0040fc10
mov ecx, dword [edi + 0xc]
add ecx, 0xffffffe8
cmp dword [ecx + 0x14], 0x10
jb 0x426744
mov ecx, dword [ecx]
mov eax, dword [edi + 4]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
mov dword [eax + ebx*4], ecx
cmp edx, 0x10
jb 0x426782
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x426778
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4267f8
push edx
push ecx
call fcn.00447495
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4267bc
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4267b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4267f8
push edx
push ecx
call fcn.00447495
add esp, 8
inc ebx
cmp ebx, dword [edi]
jl 0x4266c0
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push dword [ebp - 0x44]
mov dword [eax + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446e47
mov esp, ebp
pop ebp
ret
call fcn.0044c379
push str.Failed_to_parse_command_line_arguments
lea ecx, [ebp - 0x1c]
call fcn.00401270
push 0x489adc
lea eax, [ebp - 0x1c]
push eax
call fcn.00448905
int3
Function at 0x427410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x14
push esi
sub eax, 1
je 0x4274f2
sub eax, 1
je 0x427495
mov dword [ebp - 0x14], 7
xor ecx, ecx
mov dword [ebp - 0x10], 0xff00e5
mov dword [ebp - 0xc], 0xfd00f9
mov dword [ebp - 8], 0xe200fb
mov dword [ebp - 4], 0x9700f8
nop dword [eax]
lea eax, [ecx + 0x90]
xor word [ebp + ecx*2 - 0x10], ax
inc ecx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jb 0x427450
mov esi, dword [ebp + 8]
xor ecx, ecx
mov word [ebp + eax*2 - 0x10], cx
xor eax, eax
mov dword [esi + 0x10], ecx
lea ecx, [ebp - 0x10]
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427482
lea eax, [ebp - 0x10]
jmp 0x427551
mov dword [ebp - 0x10], 5
xor ecx, ecx
mov dword [ebp - 0xc], 0xe500f8
mov dword [ebp - 8], 0xe300e6
mov dword [ebp - 4], 0x9500e7
lea eax, [ecx + 0x90]
xor word [ebp + ecx*2 - 0xc], ax
inc ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jb 0x4274b3
mov esi, dword [ebp + 8]
xor ecx, ecx
mov word [ebp + eax*2 - 0xc], cx
xor eax, eax
mov dword [esi + 0x10], ecx
lea ecx, [ebp - 0xc]
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4274e5
jmp 0x42754e
mov eax, 4
mov dword [ebp - 0xc], 0xe500f8
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 8], 0xe300e6
mov dword [ebp - 4], 0x94
lea eax, [ecx + 0x90]
xor word [ebp + ecx*2 - 0xc], ax
inc ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jb 0x427511
mov esi, dword [ebp + 8]
xor ecx, ecx
mov word [ebp + eax*2 - 0xc], cx
xor eax, eax
mov dword [esi + 0x10], ecx
lea ecx, [ebp - 0xc]
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427543
lea eax, [ebp - 0xc]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040c1a0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x443ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x48b084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x14], 0xf400c4
mov dword [ebp - 0x10], 0xf200fe
mov dword [ebp - 0xc], 0xfa00f9
mov dword [ebp - 8], 0x9700f8
nop dword [eax]
lea ecx, [eax + 0x90]
xor word [ebp + eax*2 - 0x14], cx
inc eax
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x443ee0
xor eax, eax
mov word [ebp + ecx*2 - 0x14], ax
lea ecx, [ebp - 0x14]
mov dword [esi + 0x10], eax
lea edx, [ecx + 2]
mov dword [esi + 0x14], 7
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x443f10
sub ecx, edx
lea eax, [ebp - 0x14]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040c1a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00446e47
mov esp, ebp
pop ebp
ret

Function at 0x443f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x48b084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x71]
mov dword [ebp - 0x78], edi
call fcn.00441b50
mov esi, eax
xor eax, eax
mov ecx, dword [esi]
lea edx, [esi + 4]
test ecx, ecx
je 0x443f82
lea ecx, [eax + 0x90]
xor word [edx + eax*2], cx
inc eax
mov ecx, dword [esi]
cmp eax, ecx
jb 0x443f71
xor eax, eax
mov word [edx + ecx*2], ax
mov ecx, edx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x443fa0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040c1a0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00446e47
mov esp, ebp
pop ebp
ret
Function at 0x45e87d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045e6f3

Function at 0x4651ab
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046512d
Function at 0x4016be
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
cmp eax, ecx
je 0x4017f4
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x4016e1
cmp dword [edx + 0x10], esi
jne 0x4016d9
xor eax, eax
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], getpeername
mov eax, dword [edx + 0x20]
mov dword [esp], eax
call dword [ebp + 0x10]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x4017f4
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp + 0xc]
add ecx, esi
sub eax, esi
lea edx, [ecx + 0xf8]
movzx ecx, word [ecx + 6]
mov dword [ebp - 0x24], eax
imul ecx, ecx, 0x28
add ecx, edx
cmp edx, ecx
je 0x4017ed
mov esi, dword [edx + 0xc]
cmp eax, esi
jb 0x40176e
mov edi, dword [edx + 0x10]
add edi, esi
cmp edi, eax
jb 0x40176e
add eax, dword [edx + 0x14]
sub eax, esi
jne 0x401773
jmp 0x4017ed
add edx, 0x28
jmp 0x40174d
xor edi, edi
mov dword [esp + 4], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [ebp + 0x14]
sub esp, 0x10
inc eax
je 0x4017ed
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [ebp + 0x18]
sub esp, 0x14
test eax, eax
je 0x4017ed
cmp dword [ebp - 0x24], 8
jne 0x4017ed
cmp byte [ebp - 0x20], 0xb8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jne 0x4017ed
shrd eax, edx, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [ebp + 0x1c]
push ebx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x4017f8
mov dword [esp], ebx
call dword [ebp + 0x1c]
push eax
xor eax, eax
xor edx, edx
leave
ret 0x18

Function at 0x40180c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x401815
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x401838
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x401838
mov eax, ebx
jmp 0x40184d
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x401824
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret
Function at 0x401865
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
pop edx
pop ecx
push edx
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x4018be
mov al, cl
cmp al, 0x61
jb 0x401898
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4018be
mov al, cl
cmp al, 0x61
jb 0x4018b0
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x401888
cmp edx, dword ss:[esp + 0x18]
je 0x4018d1
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x401880
xor eax, eax
jmp 0x4018d5
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret

Function at 0x401906
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x401a1c
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x401a23
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x401975
cmp al, 0x61
jb 0x40196d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40195f
cmp edx, dword ss:[esp + 0x14]
je 0x401986
dec ecx
jne 0x401952
xor eax, eax
jmp 0x401a1c
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x401a1c
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x401a1c
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x4019cc
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x4019db
jmp 0x4019c2
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x401a23
test eax, eax
je 0x401a1c
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x401a17
cmp al, 0x61
jb 0x401a0f
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x401a01
call 0x401920
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x401a75
mov al, cl
cmp al, 0x61
jb 0x401a4f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x401a75
mov al, cl
cmp al, 0x61
jb 0x401a67
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x401a3f
cmp edx, dword ss:[esp + 0x18]
je 0x401a88
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x401a37
xor eax, eax
jmp 0x401a8c
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x401920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x401a1c
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x401a23
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x401975
cmp al, 0x61
jb 0x40196d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40195f
cmp edx, dword ss:[esp + 0x14]
je 0x401986
dec ecx
jne 0x401952
xor eax, eax
jmp 0x401a1c
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x401a1c
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x401a1c
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x4019cc
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x4019db
jmp 0x4019c2
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x401a23
test eax, eax
je 0x401a1c
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x401a17
cmp al, 0x61
jb 0x401a0f
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x401a01
call 0x401920
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x401a75
mov al, cl
cmp al, 0x61
jb 0x401a4f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x401a75
mov al, cl
cmp al, 0x61
jb 0x401a67
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x401a3f
cmp edx, dword ss:[esp + 0x18]
je 0x401a88
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x401a37
xor eax, eax
jmp 0x401a8c
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x401a23
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x401a1c
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x401a23
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x401975
cmp al, 0x61
jb 0x40196d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40195f
cmp edx, dword ss:[esp + 0x14]
je 0x401986
dec ecx
jne 0x401952
xor eax, eax
jmp 0x401a1c
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x401a1c
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x401a1c
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x4019cc
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x4019db
jmp 0x4019c2
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x401a23
test eax, eax
je 0x401a1c
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x401a17
cmp al, 0x61
jb 0x401a0f
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x401a01
call 0x401920
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x401a75
mov al, cl
cmp al, 0x61
jb 0x401a4f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x401a75
mov al, cl
cmp al, 0x61
jb 0x401a67
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x401a3f
cmp edx, dword ss:[esp + 0x18]
je 0x401a88
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x401a37
xor eax, eax
jmp 0x401a8c
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x402c34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x402c60
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044dd18
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402c71
push ebx
call fcn.0044dd24
add esp, 4
pop eax
mov dword [ebp - 4], eax
test eax, eax
je 0x402cd9
mov ecx, dword [eax + 4]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x402cd9
mov edx, ebx
mov esp, ecx
or bh, bl
cmp edx, 0xff
cmovbe edx, ebx
mov ebx, edx
and esp, 0xfffffffc
shl ebx, 0x10
sub ecx, esp
or bx, dx
cmp edx, 0xffff
cmovbe edx, ebx
lea ebx, [eax + 8]
test esp, esp
je 0x402cba
add esp, ebx
xor dword [ebx], edx
add ebx, 4
cmp esp, ebx
jne 0x402cb1
test ecx, ecx
je 0x402cd9
xor byte [ebx], dl
test ecx, 2
je 0x402cd9
xor byte [ebx + 1], dh
test ecx, 1
je 0x402cd9
shr edx, 0x10
xor byte [ebx + 2], dl
leave
ret 8

Function at 0x402dcc
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add eax, 8
push dword [ebp + 0x18]
push ecx
push eax
call dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add eax, 8
push dword [ebp + 0x18]
push ecx
push eax
call dword [ebp + 0x14]
push 0x98ee1a75
push 0x6a4abc5b
call dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, 8
push ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
add ecx, 8
push ecx
call eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add eax, 8
push dword [ebp + 0x18]
push ecx
push eax
call dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add eax, 8
push dword [ebp + 0x18]
push ecx
push eax
call dword [ebp + 0x14]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x410b75
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x410c29
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00410b05
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x410c02
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410c35
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x410c50
test ebp, ebp
je 0x410c50
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x410c58
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x410c98
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x410cf4
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x410cef
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x410cda
test dl, dl
je 0x410cd6
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x410cda
add ecx, 2
add eax, 2
test dl, dl
jne 0x410cba
xor eax, eax
jmp 0x410cdf
sbb eax, eax
or eax, 1
test eax, eax
je 0x410cfe
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x410ca7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret