joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4204cf
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetCommandLineW]
movzx ecx, word [eax]
push 0x20
pop ebx
push 2
pop edx
push 0x22
pop esi
cmp cx, si
jne 0x4204f9
add eax, edx
movzx ecx, word [eax]
cmp cx, si
je 0x42050c
test cx, cx
jne 0x4204e8
jmp 0x420516
cmp cx, bx
jbe 0x42050e
add eax, edx
cmp word [eax], bx
ja 0x4204fe
jmp 0x42050e
cmp cx, bx
ja 0x420516
add eax, edx
movzx ecx, word [eax]
test cx, cx
jne 0x420507
xor esi, esi
push eax
mov dword [0x4b85d4], esi
call main
mov edx, eax
and eax, 0x60
jne 0x420579
test dl, 8
je 0x420535
push 8
pop eax
jmp 0x420579
test edx, 0x1eee
jne 0x420541
xor eax, eax
jmp 0x420579
push edi
xor edi, edi
inc edi
mov ecx, esi
shl edi, cl
test edi, 0x1eee
je 0x420560
test edx, edi
je 0x420560
mov eax, edx
sub eax, edi
test eax, 0x1eee
jne 0x420572
inc esi
cmp esi, ebx
jb 0x420542
test dl, 4
je 0x420576
test edx, 0x100
jne 0x420576
xor eax, eax
jmp 0x420578
mov eax, edx
pop edi
pop esi
pop ebx
ret

Function at 0x424137
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [0x4b85d4]
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
mov dword [0x4ad774], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x4ad770], eax
test eax, eax
jne 0x42415b
xor eax, eax
ret
mov edx, 0x9c9c
cmp dword [eax], edx
jne 0x424158
mov ecx, dword [eax + 4]
push esi
push edi
mov edi, 0x20001
lea esi, [edi - 1]
cmp ecx, esi
je 0x42417d
cmp ecx, edi
jne 0x4241d8
cmp ecx, esi
jne 0x424181
cmp dword [eax], edx
jne 0x4241d8
cmp ecx, edi
jne 0x424189
cmp dword [eax], edx
jne 0x4241d8
cmp ecx, esi
jne 0x424191
cmp dword [eax], edx
jne 0x4241d8
push edx
push eax
push 0x4ad77c
call main
add esp, 0xc
cmp dword [0x4ad7a0], 0
mov dword [0x4ad780], esi
je 0x4241d8
cmp dword [0x4ad794], 0
je 0x4241d8
cmp dword [0x4ad79c], 0
je 0x4241d8
cmp dword [0x4b85c8], 0
jne 0x4241d3
cmp dword [0x4ad7a4], 0
je 0x4241d8
xor eax, eax
inc eax
jmp 0x4241da
xor eax, eax
pop edi
pop esi
ret

Function at 0x42afcc
Capabilities:
Connect to http server

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
call fcn.00436f6e
mov ebx, 0x4aaafc
test eax, eax
je 0x42afee
push ebx
push 0x404330
call main
pop ecx
pop ecx
mov eax, dword [0x4ab504]
test eax, eax
je 0x42affc
mov esi, 0x800000
push 1
neg eax
push esi
sbb eax, eax
push 3
and eax, 0x16b
mov ecx, 0x402759
push ecx
add eax, 0x50
movzx eax, ax
push ecx
push eax
push ebx
push dword [0x4aaac8]
call dword [sym.imp.WININET.dll_InternetConnectA]
xor esi, esi
inc esi
mov dword [0x4aaacc], eax
mov dword [0x4ad760], esi
mov dword [0x4aaad4], edi
test eax, eax
jne 0x42b061
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x42b07a
call fcn.00436f6e
test eax, eax
je 0x42b05d
push 0x404348
call main
xor eax, eax
jmp 0x42b07c
push edi
push edi
push 0x1427
push dword [0x4b7f40]
mov dword [0x4ad760], edi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x42b219
Capabilities:
Send data

Disassembly:
mov ecx, dword [0x4ab514]
test ecx, ecx
jne 0x42b23c
xor eax, eax
push eax
push eax
push 0x1427
push dword [0x4b7f40]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
ret
mov eax, dword [0x4ab508]
push esi
push edi
push 0x4ab510
push dword [0x4ab50c]
add eax, ecx
push eax
push dword [0x4aaad0]
xor edi, edi
inc edi
mov dword [0x4ad760], edi
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x42b294
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x42b2bd
call fcn.00436f6e
test eax, eax
je 0x42b290
push esi
push 0x4043b0
call main
pop ecx
pop ecx
xor eax, eax
jmp 0x42b2bf
xor eax, eax
cmp dword [0x4aaa9c], 3
mov dword [0x4ad760], eax
jne 0x42b2aa
mov dword [0x4aaa90], edi
push eax
push eax
push 0x1427
push dword [0x4b7f40]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, edi
pop edi
pop esi
ret
Function at 0x437d76
Capabilities:
Create process memory minidump

Disassembly:
push 0x448
push 0x474310
call fcn.0045d100
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp dword [0x4ad784], eax
je 0x437fa3
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x437db1
cmp dword [ebp + 0x18], eax
je 0x437fa3
cmp dword [ebp + 0x1c], eax
je 0x437fa3
push 0x410
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.0045cf3c
add esp, 0xc
mov di, word [0x4adf20]
test di, di
je 0x437e3f
mov edx, 0x404cd4
mov eax, 0x4adf20
mov ecx, eax
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x437e06
test bx, bx
je 0x437e00
mov bx, word [ecx + 2]
cmp bx, word [edx + 2]
jne 0x437e06
add ecx, 4
add edx, 4
test bx, bx
jne 0x437dde
xor ebx, ebx
mov ecx, ebx
jmp 0x437e0d
sbb ecx, ecx
sbb ecx, 0xffffffff
xor ebx, ebx
test ecx, ecx
jne 0x437e16
xor ebx, ebx
inc ebx
jmp 0x437e3f
movzx ecx, di
lea edx, [ebp - 0x458]
mov dword [edx], eax
test cx, cx
je 0x437e2e
add eax, 2
cmp word [eax], bx
jne 0x437e26
add edx, 4
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x437e1f
mov ebx, dword [ebp - 0x1c]
test esi, esi
je 0x437e57
push 0x104
push 0x4b76b2
push 0x404cdc
call main
call fcn.0043c90e
test eax, eax
je 0x437fa3
push 0
push 0x40000000
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x14]
push 0x4bf768
lea eax, [ebp + 0x20]
push eax
call main
test eax, eax
je 0x437fa3
lea eax, [ebp - 0x458]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], 0x4b71dc
mov eax, dword [0x4ad788]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], esi
mov ecx, dword [0x4ad790]
test ecx, ecx
je 0x437ecb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x43cbd2
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1c], eax
cmp dword [0x4b71dc], 0
je 0x437ef1
mov eax, dword [0x4b71e0]
test esi, esi
je 0x437efa
or eax, 0x400
jmp 0x437ef6
mov eax, 0x121
test esi, esi
jne 0x437eff
or eax, 0x200
xor ebx, ebx
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x20]
push edx
push ebx
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x2c]
and ecx, edx
push ecx
push eax
push dword [ebp + 0x20]
push dword [0x4ad784]
push dword [0x4ad7a4]
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
jne 0x437f34
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x437f9c
mov dword [ebp - 4], 0xfffffffe
push dword [ebp + 0x20]
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x437f59
push 0x41
push 0x4b7670
push 0x4b76b2
call main
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call main
test eax, eax
je 0x437fa3
cmp dword [edi + 0xc], ebx
je 0x437fa3
test esi, esi
je 0x437f87
cmp dword [0x4b78cc], 0
jne 0x437f87
mov ecx, dword [0x4ad78c]
mov dword [0x4b78cc], ecx
xor eax, eax
inc eax
jmp 0x437fa5
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.0045d145
ret 0x1c
Function at 0x45cba8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a95cc]
jne 0x45d3a3
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4c1f28], eax
mov dword [0x4c1f24], ecx
mov dword [0x4c1f20], edx
mov dword [0x4c1f1c], ebx
mov dword [0x4c1f18], esi
mov dword [0x4c1f14], edi
mov word [0x4c1f40], ss
mov word [0x4c1f34], cs
mov word [0x4c1f10], ds
mov word [0x4c1f0c], es
mov word [0x4c1f08], fs
mov word [0x4c1f04], gs
pushfd
pop dword [0x4c1f38]
mov eax, dword [ebp]
mov dword [0x4c1f2c], eax
mov eax, dword [ebp + 4]
mov dword [0x4c1f30], eax
lea eax, [ebp + 8]
mov dword [0x4c1f3c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4c1e78], 0x10001
mov eax, dword [0x4c1f30]
mov dword [0x4c1e2c], eax
mov dword [0x4c1e20], 0xc0000409
mov dword [0x4c1e24], 1
mov eax, dword [0x4a95cc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4a95d0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4c1e70], eax
push 1
call fcn.00461c79
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x41c788
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4c1e70], 0
jne 0x45d48f
push 1
call fcn.00461c79
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x472681
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x474053
call fcn.0045fd0a
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x4726aa
cmp dword [0x4c2d14], edi
je 0x472794
push 2
pop ebx
jmp 0x4726c4
cmp edi, 1
jne 0x472794
mov eax, ebx
call fcn.004734cc
test al, al
je 0x472794
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.004734ee
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x472776
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x47270b
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov esi, eax
call fcn.00472d6b
test eax, eax
je 0x4727a8
push 0x1c049f
push 0
call main
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x4aa988], 0
push ebx
mov ecx, 0x4c2d20
call main
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.00472dfc
mov esi, eax
test esi, esi
je 0x4726f7
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.0047350f
inc edi
cmp edi, 2
jl 0x472692
mov eax, esi
call fcn.0045fda9
ret 0x18
push ebx
mov ecx, 0x4c2d20
call main
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x472788
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x4727e3
cmp dword [ebp - 0x20], 3
jne 0x4727de
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x4727de
and cl, 0xf
cmp cl, 4
je 0x4727e3
push 2
pop esi
jmp 0x472788
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.0047350f
xor eax, eax
jmp 0x4727a0
Function at 0x472c6c
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x4740c4
call fcn.0045fd0a
mov esi, dword [ebp + 8]
cmp esi, dword [0x4c2d1c]
jne 0x472c8a
xor al, al
jmp 0x472d63
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x472c9b
xor ecx, ecx
cmp dword [0x4c2d14], ecx
jmp 0x472ca6
mov eax, esi
call fcn.004734cc
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x472c83
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.004734ee
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x472d24
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x472cda
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.00472d6b
test eax, eax
je 0x472d49
push 0x1c04c2
xor ebx, ebx
push ebx
call main
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x4c2d20
mov dword [eax + 0x4aa988], ebx
call main
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.00472dfc
mov ebx, eax
test ebx, ebx
je 0x472cce
jmp 0x472d56
push dword [ebp + 8]
mov ecx, 0x4c2d20
call main
lea ecx, [ebp + 0xf]
call fcn.0047350f
test ebx, ebx
sete al
call fcn.0045fda9
ret 8
Function at 0x473530
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x47411a
call fcn.0045fd0a
mov esi, dword [ebp + 8]
cmp esi, dword [0x4c2d1c]
jne 0x47354e
xor eax, eax
jmp 0x4736b3
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x473571
cmp dword [0x4c2d14], ebx
je 0x473673
push 2
pop edi
jmp 0x47358b
cmp ebx, 1
jne 0x473673
mov eax, esi
call fcn.004734cc
test al, al
je 0x473673
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.004734ee
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x473636
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4735bf
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x4735eb
cmp dword [ebp - 0x1c], 1
je 0x4735e8
cmp dword [ebp - 0x1c], 2
jne 0x4735eb
push 2
pop edi
mov eax, edi
call fcn.00472d6b
test eax, eax
je 0x473653
push 0x1c0496
xor edi, edi
push edi
call main
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x4c2d20
mov dword [eax + 0x4aa988], edi
call main
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.00472dfc
mov edi, eax
test edi, edi
je 0x4735b3
jmp 0x473664
push dword [ebp - 0x10]
mov ecx, 0x4c2d20
call main
test edi, edi
je 0x47367f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.0047350f
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x473559
jmp 0x47368e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.0047350f
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x4736a9
cmp dword [ebp - 0x1c], 2
je 0x4736a1
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x4736b1
push ecx
call main
jmp 0x4736af
push esi
call main
mov ecx, eax
mov eax, ecx
call fcn.0045fda9
ret 4
Function at 0x4029c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
lea edi, [ebp - 0x25c]
mov ecx, 0x97
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [str.073110116101114110101116082101097100070105108101]
push ecx
call fcn.004013f3
add esp, 8
mov esi, esp
lea edx, [ebp - 0x104]
push edx
mov edi, esp
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.00402b65
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00402b65
mov dword [0x40acf8], eax
call fcn.00401d70
test eax, eax
jne 0x402a60
call fcn.00402331
call fcn.0040260d
call fcn.004018cb
xor eax, eax
jmp 0x402b50
mov eax, dword [ebp + 0x10]
push eax
call fcn.00402c80
add esp, 4
test eax, eax
je 0x402a85
push str.start
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00402fa0
add esp, 8
test eax, eax
jne 0x402af1
push 0x44
push 0
lea edx, [ebp - 0x25c]
push edx
call fcn.00403020
add esp, 0xc
mov dword [ebp - 0x230], 1
mov word [ebp - 0x22c], 5
push str.__start
push 0x40abf4
call fcn.00402e90
add esp, 8
mov esi, esp
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x25c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x40abf4
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.00402b65
xor eax, eax
jmp 0x402b50
call fcn.00402985
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x208]
push edx
push 0x40abf4
call fcn.00401d9b
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.00402c80
add esp, 4
cmp eax, 0x26
jne 0x402b46
lea ecx, [ebp - 0x208]
push ecx
call fcn.00402075
add esp, 4
call fcn.0040260d
mov eax, 1
pop edi
pop esi
add esp, 0x25c
cmp ebp, esp
call fcn.00402b65
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1005a3dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1005a3ec
pop dword [ebp - 0x48]
mov eax, 0x1005a3ec
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x2c4fc748
add dword [ebp - 0x58], 0x22027e03
mov dword [ebp - 0x54], 0xc559b0e2
sub dword [ebp - 0x54], 0x9326649d
mov dword [ebp - 0x50], 0x85a29274
sub dword [ebp - 0x50], 0x39564e46
mov dword [ebp - 0x4c], 0xf33e3777
add dword [ebp - 0x4c], 0xcc1c889
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xb1039180
add dword [ebp - 0x58], 0xc36ed7d6
mov dword [ebp - 0x54], 0x246fadd8
sub dword [ebp - 0x54], 0xe3034c63
mov dword [ebp - 0x50], 0xfd28dd2
add dword [ebp - 0x50], 0x539cde9a
mov dword [ebp - 0x4c], 0xdf4b06dc
add dword [ebp - 0x4c], 0x20b4f924
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x876032eb
sub eax, 0x7757c2c7
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3dc4a
push 0
call eax
mov ecx, 0x6d42d848
add ecx, 0x92bd7144
xor edi, edi
add edi, eax
mov esi, 0x4986c60b
sub esi, 0x397b360b
add esi, dword [ebp - 0x48]
mov ebx, 0xacc1352f
sub ebx, 0x3ab0c96
add dword [ebp - 0x1c], edi
mov edx, dword [esi]
xor dword [ebp - 4], 0x4fbdf4fc
sub edx, ebx
mov dword [edi], edx
add edi, 0x8288fd19
sub edi, 0x8288fd15
add esi, 0xa5e259f7
add esi, 0x5a1da60d
loop 0x1005a506
add eax, 0xd8a9b429
add eax, 0x275764da
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1006ffd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push esi
push edi
call fcn.1006e8e4
mov edi, dword [esp + 0x38]
push eax
push edi
call sub.glib_lite.dll_Ordinal_413
mov esi, eax
pop ecx
pop ecx
mov eax, dword [esi + 0x74]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1006fffb
xor eax, eax
jmp 0x10070184
cmp eax, dword [esi + 0x1f0]
je 0x1006fff4
push ebx
push ebp
lea ebx, [esi + 0xc]
push ebx
call sub.glib_lite.dll_Ordinal_213
pop ecx
jmp 0x10070014
lea ebx, [esi + 0xc]
push dword [esp + 0x44]
push edi
call fcn.1002a825
pop ecx
pop ecx
test eax, eax
jne 0x10070175
push ebx
call sub.glib_lite.dll_Ordinal_212
mov eax, dword [esi + 0x1f8]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
lea eax, [esi + 0xc]
push eax
call sub.glib_lite.dll_Ordinal_213
push edi
call fcn.1002b710
add esp, 0xc
cmp ebp, edx
jb 0x1007005b
ja 0x10070055
cmp ebx, eax
jbe 0x1007005b
sub ebx, eax
sbb ebp, edx
jmp 0x1007006c
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push ebp
push ebx
push edi
call fcn.1002d6cd
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, 4
je 0x1007009b
cmp dword [edi + 0x168], 0
jne 0x10070175
cmp eax, 2
je 0x10070011
call fcn.10083a8f
push eax
push dword [esi + 0x1f0]
call sub.glib_lite.dll_Ordinal_413
push eax
call fcn.10083a5e
add esp, 0xc
push edx
push eax
call fcn.10083a8f
push eax
push dword [esi + 0x1f0]
call sub.glib_lite.dll_Ordinal_413
pop ecx
pop ecx
push eax
call fcn.10083975
mov dword [esp + 0x24], eax
lea eax, [esi + 0xc]
push eax
mov dword [esp + 0x24], edx
call sub.glib_lite.dll_Ordinal_212
mov edi, dword [esi + 0x78]
add esp, 0x10
add edi, ebx
mov ebx, dword [esi + 0x7c]
adc ebx, ebp
cmp dword [esp + 0x10], 1
jne 0x100700fd
add edi, dword [esp + 0x24]
adc ebx, dword [esp + 0x28]
push esi
call fcn.1006e427
lea eax, [esp + 0x30]
xor ebp, ebp
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push ebp
push dword [esi + 0x1f0]
call fcn.10030026
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x58]
push dword [esp + 0x58]
push ebx
push edi
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esi + 0x1f0]
call fcn.1005a3dd
mov eax, dword [esi + 0x1f8]
add esp, 0x3c
cmp dword [eax + 8], ebp
jne 0x10070160
push dword [esp + 0x20]
push dword [esi + 0x1f0]
call fcn.10030542
pop ecx
pop ecx
push esi
call fcn.1006f830
push 3
push esi
call fcn.1006de9e
add esp, 0xc
xor eax, eax
jmp 0x10070182
lea eax, [esi + 0xc]
push eax
call sub.glib_lite.dll_Ordinal_212
pop ecx
push 0xfffffffffffffffe
pop eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x406e61
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x431414], 0
jne 0x406e9f
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406e75
mov dword [ecx*4 + 0x431410], eax
inc ecx
cmp ecx, 0x100
jl 0x406e70
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ecc
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x431410]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ead
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx