joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406390
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
movzx eax, byte [edx]
push ebx
push esi
mov esi, ecx
push edi
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
movzx eax, byte [edx + 6]
mov byte [esi + 6], al
movzx eax, byte [edx + 7]
mov byte [esi + 7], al
movzx eax, byte [edx + 8]
mov byte [esi + 8], al
movzx eax, byte [edx + 9]
mov byte [esi + 9], al
movzx eax, byte [edx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [esi + 0xc], al
movzx eax, byte [edx + 0xd]
mov byte [esi + 0xd], al
movzx eax, byte [edx + 0xe]
mov byte [esi + 0xe], al
movzx eax, byte [edx + 0xf]
mov byte [esi + 0xf], al
movzx eax, byte [edx + 0x10]
mov byte [esi + 0x10], al
movzx eax, byte [edx + 0x11]
mov byte [esi + 0x11], al
movzx eax, byte [edx + 0x12]
mov byte [esi + 0x12], al
movzx eax, byte [edx + 0x13]
mov byte [esi + 0x13], al
movzx eax, byte [edx + 0x14]
mov byte [esi + 0x14], al
movzx eax, byte [edx + 0x15]
mov byte [esi + 0x15], al
movzx eax, byte [edx + 0x16]
mov byte [esi + 0x16], al
movzx eax, byte [edx + 0x17]
mov byte [esi + 0x17], al
movzx eax, byte [edx + 0x18]
mov byte [esi + 0x18], al
movzx eax, byte [edx + 0x19]
mov byte [esi + 0x19], al
movzx eax, byte [edx + 0x1a]
mov byte [esi + 0x1a], al
movzx eax, byte [edx + 0x1b]
mov byte [esi + 0x1b], al
movzx eax, byte [edx + 0x1c]
mov byte [esi + 0x1c], al
lea eax, [esi + 0x1d]
movzx ecx, byte [edx + 0x1d]
mov byte [eax], cl
movzx ecx, byte [edx + 0x1e]
mov byte [esi + 0x1e], cl
movzx ecx, byte [edx + 0x1f]
mov byte [esi + 0x1f], cl
mov esi, 8
nop dword [eax + eax]
mov cl, byte [eax + 1]
mov edi, esi
mov dh, byte [eax + 2]
mov bl, byte [eax - 1]
mov bh, byte [eax]
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], dh
and edi, 7
jne 0x4064d9
movzx ecx, cl
movzx edx, bh
mov bh, byte [ecx + str.cw]
movzx ecx, byte [esp + 0xf]
mov cl, byte [ecx + str.cw]
mov byte [esp + 0xe], cl
movzx ecx, bl
mov cl, byte [ecx + str.cw]
mov byte [esp + 0xf], cl
mov ecx, esi
shr ecx, 3
mov bl, byte [ecx + 0x4c8498]
xor bl, byte [edx + str.cw]
mov dh, byte [esp + 0xf]
jmp 0x40650a
cmp edi, 4
jne 0x40650a
mov dl, byte [esp + 0xe]
movzx ecx, bl
mov bl, byte [ecx + str.cw]
movzx ecx, bh
mov bh, byte [ecx + str.cw]
movzx ecx, dl
mov cl, byte [ecx + str.cw]
mov byte [esp + 0xe], cl
movzx ecx, dh
mov dh, byte [ecx + str.cw]
movzx ecx, byte [eax - 0x1d]
inc esi
mov dl, byte [esp + 0xe]
xor cl, bl
mov byte [eax + 3], cl
movzx ecx, byte [eax - 0x1c]
xor cl, bh
mov byte [eax + 4], cl
movzx ecx, byte [eax - 0x1b]
xor cl, dl
mov byte [eax + 5], cl
movzx ecx, byte [eax - 0x1a]
xor cl, dh
mov byte [eax + 6], cl
add eax, 4
cmp esi, 0x3c
jb 0x406480
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4067a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
push ebp
mov ebp, edx
mov ebx, ecx
push esi
push edi
mov esi, ebx
mov edx, 4
lea edi, [ebp + 0xe0]
mov ecx, 4
nop dword [eax + eax]
mov al, byte [edi]
inc edi
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x4067c0
sub edx, 1
jne 0x4067b6
mov byte [esp + 0x13], 0xd
movzx eax, byte [ebx + 9]
mov esi, ebx
mov cl, byte [ebx + 0xd]
mov edi, 4
mov byte [ebx + 0xd], al
movzx eax, byte [ebx + 5]
mov byte [ebx + 9], al
movzx eax, byte [ebx + 1]
mov byte [ebx + 5], al
movzx eax, byte [ebx + 0xa]
mov byte [ebx + 1], cl
mov cl, byte [ebx + 2]
mov byte [ebx + 2], al
movzx eax, byte [ebx + 0xe]
mov byte [ebx + 0xa], cl
mov cl, byte [ebx + 6]
mov byte [ebx + 6], al
movzx eax, byte [ebx + 7]
mov byte [ebx + 0xe], cl
mov cl, byte [ebx + 3]
mov byte [ebx + 3], al
movzx eax, byte [ebx + 0xb]
mov byte [ebx + 7], al
movzx eax, byte [ebx + 0xf]
mov byte [ebx + 0xb], al
mov byte [ebx + 0xf], cl
nop dword [eax]
mov ecx, esi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x4c8398]
mov byte [ecx - 4], al
sub edx, 1
jne 0x406840
inc esi
sub edi, 1
jne 0x406830
mov ch, byte [esp + 0x13]
mov eax, ebx
movzx edx, ch
mov edi, 4
shl edx, 4
add edx, ebp
nop dword [eax]
mov esi, 4
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub esi, 1
jne 0x406875
sub edi, 1
jne 0x406870
test ch, ch
je 0x406899
mov ecx, ebx
call fcn.00406550
dec byte [esp + 0x13]
jmp 0x4067d5
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x407150
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x120
push ebx
push ebp
push esi
mov ebp, ecx
lea esi, [edx + 2]
push edi
mov dword [esp + 0x2c], ebp
xor edi, edi
movzx edx, byte [esi - 2]
lea esi, [esi + 4]
movzx eax, byte [esi - 5]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 4]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 3]
shl edx, 8
or edx, eax
mov dword [esp + edi*4 + 0x30], edx
inc edi
cmp edi, 0x10
jb 0x407165
cmp edi, 0x40
jae 0x4071dc
mov ebx, 0x40
lea eax, [esp + edi*4 + 0x28]
sub ebx, edi
mov edx, dword [eax - 0x34]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebx, 1
jne 0x4071a1
mov eax, dword [ebp + 8]
mov edi, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x24]
xor ebp, ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], eax
jmp 0x40721a
mov edx, dword [esp + 0x18]
mov esi, ebx
mov eax, ebx
rol eax, 7
or ecx, edi
ror esi, 0xb
xor esi, eax
and ecx, dword [esp + 0x10]
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, edx
xor eax, dword [esp + 0x14]
and eax, ebx
xor eax, edx
mov edx, edi
add esi, eax
ror edx, 0xd
add esi, dword [ebp + 0x4c94a8]
mov eax, edi
add esi, dword [esp + ebp + 0x30]
add ebp, 4
add esi, dword [esp + 0x24]
rol eax, 0xa
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [esp + 0x1c]
and eax, edi
or ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
add edx, ecx
mov eax, dword [esp + 0x14]
mov ecx, edi
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
lea edi, [edx + esi]
mov eax, dword [esp + 0x10]
add ebx, esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
cmp ebp, 0x100
jb 0x407216
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
add eax, edi
pop edi
add dword [ebp + 0x18], ebx
add dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
mov eax, dword [esp + 0xc]
add dword [ebp + 0x10], eax
mov eax, dword [esp + 0x1c]
add dword [ebp + 0x14], eax
mov eax, dword [esp + 0x10]
add dword [ebp + 0x1c], eax
mov eax, dword [esp + 0x14]
add dword [ebp + 0x20], eax
mov eax, dword [esp + 0x20]
add dword [ebp + 0x24], eax
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
Function at 0x407580
Capabilities:
Hash data using sha256

Disassembly:
push ecx
movups xmm0, xmmword [edx]
push esi
push edi
mov edi, ecx
push 0x2c
push 0
movups xmmword [edi], xmm0
mov eax, dword [edx + 0x10]
lea esi, [edi + 0x80]
mov dword [edi + 0x10], eax
lea eax, [edi + 0x14]
push eax
call fcn.004a3c90
movups xmm0, xmmword [edi]
mov edx, edi
mov ecx, esi
movaps xmm2, xmmword [0x4d66f0]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi], xmm1
push 0x40
movups xmm0, xmmword [edi + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x10], xmm1
movups xmm0, xmmword [edi + 0x20]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x20], xmm1
movups xmm0, xmmword [edi + 0x30]
pxor xmm0, xmm2
movups xmmword [edi + 0x30], xmm0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
call fcn.004074e0
movups xmm0, xmmword [esi + 8]
mov edx, edi
mov ecx, esi
movaps xmm2, xmmword [0x4d6700]
movups xmmword [edi + 0x60], xmm0
push 0x40
movups xmm0, xmmword [esi + 0x18]
movaps xmm1, xmm2
movups xmmword [edi + 0x70], xmm0
movups xmm0, xmmword [edi]
pxor xmm1, xmm0
movups xmmword [edi], xmm1
movups xmm0, xmmword [edi + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x10], xmm1
movups xmm0, xmmword [edi + 0x20]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x20], xmm1
movups xmm0, xmmword [edi + 0x30]
pxor xmm0, xmm2
movups xmmword [edi + 0x30], xmm0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
call fcn.004074e0
movups xmm0, xmmword [esi + 8]
movups xmmword [edi + 0x40], xmm0
movups xmm0, xmmword [esi + 0x18]
movups xmmword [edi + 0x50], xmm0
push dword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x20], 0x1000000
call fcn.004074e0
push 4
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.004074e0
mov edx, edi
mov ecx, esi
call fcn.004072f0
movups xmm0, xmmword [edi + 0x60]
push 0x20
mov edx, edi
mov ecx, esi
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [edi + 0x70]
mov dword [esi], 0x40
mov dword [esi + 4], 0
movups xmmword [esi + 0x18], xmm0
call fcn.004074e0
add esp, 0x20
mov edx, edi
mov ecx, esi
call fcn.004072f0
movups xmm0, xmmword [edi + 0x40]
mov eax, dword [esp + 0x20]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [edi + 0x50]
mov dword [esi], 0x40
mov dword [esi + 4], 0
movups xmmword [esi + 0x18], xmm0
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
pop edi
pop esi
movups xmmword [eax + 0x10], xmm0
pop ecx
ret
Function at 0x4078c0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0xcc
push edx
lea eax, [esp + 0x8c]
mov dword [esp + 0xc], 0x67452301
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xd0], eax
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.0040c100
mov ecx, dword [esp + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [esp], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 1], al
movzx eax, byte [esp + 0x20]
shr ecx, 8
mov byte [esp + 3], al
mov byte [esp + 2], cl
mov ecx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 4], al
mov eax, ecx
shr eax, 0x10
shr ecx, 8
mov byte [esp + 5], al
movzx eax, byte [esp + 0x1c]
push 1
mov byte [esp + 0xa], cl
lea ecx, [esp + 0xc]
push 0x4cf02c
mov byte [esp + 0xf], al
call fcn.0040c100
mov eax, dword [esp + 0x1c]
and eax, 0x1f8
cmp eax, 0x1c0
je 0x4079a2
push 1
push 0x4cee7c
lea ecx, [esp + 0x10]
call fcn.0040c100
mov eax, dword [esp + 0x1c]
and eax, 0x1f8
cmp eax, 0x1c0
jne 0x407982
push 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x10]
call fcn.0040c100
xor eax, eax
mov edx, eax
mov ecx, 3
and edx, 3
sub ecx, edx
mov edx, eax
shr edx, 2
shl ecx, 3
mov edx, dword [esp + edx*4 + 8]
shr edx, cl
mov byte [esp + eax + 0x68], dl
inc eax
cmp eax, 0x14
jb 0x4079b4
push 0x40
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004a3c90
add esp, 0xc
mov dword [esp + 0x18], 0
lea eax, [esp + 0x28]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
push eax
lea eax, [esp + 0xc]
movq qword [esp + 0x20], xmm0
push eax
mov ecx, eax
movlpd qword [esp + 8], xmm0
call fcn.0040aca0
mov ecx, dword [esp + 0xd0]
test ecx, ecx
je 0x407a30
movups xmm0, xmmword [esp + 0x68]
mov eax, dword [esp + 0x78]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
add esp, 0xcc
ret
Function at 0x40c960
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
sub esp, 0x800
mov eax, 1
push esi
xor esi, esi
nop
mov ecx, eax
mov dword [esp + esi*4 + 0x404], eax
and cl, 0x80
mov dword [esp + eax*4 + 4], esi
movzx edx, cl
lea ecx, [eax + eax]
neg edx
sbb edx, edx
inc esi
and edx, 0x1b
xor edx, ecx
xor edx, eax
movzx eax, dl
cmp esi, 0x100
jl 0x40c970
mov dword [0x4dc7a8], 1
mov esi, 1
mov dword [0x4dc7ac], 2
mov dword [0x4dc7b0], 4
mov dword [0x4dc7b4], 8
mov dword [0x4dc7b8], 0x10
mov dword [0x4dc7bc], 0x20
mov dword [0x4dc7c0], 0x40
mov dword [0x4dc7c4], 0x80
mov dword [0x4dc7c8], 0x1b
mov dword [0x4dc7cc], 0x36
mov byte [0x4dc6a8], 0x63
push ebx
nop
mov ecx, dword [esp + esi*4 + 8]
lea eax, [esp + 0x804]
shl ecx, 2
sub eax, ecx
mov edx, dword [eax]
mov ecx, edx
sar ecx, 7
lea eax, [edx + edx]
or ecx, eax
movzx eax, cl
xor edx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
mov ecx, eax
mov ebx, eax
shr ecx, 7
add eax, eax
or ecx, eax
xor ebx, edx
movzx edx, cl
mov ecx, edx
mov al, dl
shr ecx, 7
add al, al
or cl, al
xor cl, bl
xor cl, dl
xor cl, 0x63
mov byte [esi + 0x4dc6a8], cl
inc esi
cmp esi, 0x100
jl 0x40ca10
xor esi, esi
pop ebx
movzx edx, byte [esi + 0x4dc6a8]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x4dd3d8], ecx
rol ecx, 8
mov dword [esi*4 + 0x4dcfd8], ecx
rol ecx, 8
mov dword [esi*4 + 0x4dcbd8], ecx
rol ecx, 8
mov dword [esi*4 + 0x4dc7d0], ecx
inc esi
cmp esi, 0x100
jl 0x40ca71
mov dword [0x4dcbd0], 1
pop esi
add esp, 0x800
ret
Function at 0x413f60
Capabilities:
Create process on windows
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x67c
push 0x104
lea eax, [ebp - 0x278]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea eax, [ebp - 0x688]
push eax
push str._ComSpec_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x4dc690
mov edx, str._c_rd__s__q__Temp__
lea ecx, [ebp - 0x6c]
call fcn.00405bc0
push str.__timeout_3__del__f__q__
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.00405d20
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 1
push ecx
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.00405d20
push 0x4cf5f8
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.00405d20
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x414004
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x480]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x414051
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414047
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41415d
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x41409f
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414095
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41415d
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov edx, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
cmp edx, 8
jb 0x4140e9
mov ecx, dword [ebp - 0x54]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4140df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41415d
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov edx, dword [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
cmp edx, 8
jb 0x414133
mov ecx, dword [ebp - 0x6c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414129
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41415d
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0
push 0
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x688]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004a9d47
int3
Function at 0x414550
Capabilities:
Copy file

Disassembly:
sub esp, 0x430
lea eax, [esp + 0x20]
push esi
push edi
push 0x208
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.004a3c90
lea ecx, [esp + 0x34]
add esp, 0xc
sub ecx, edi
nop word [eax + eax]
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x414580
push 0x208
lea eax, [esp + 0x234]
push 0
push eax
call fcn.004a3c90
lea ecx, [esp + 0x23c]
add esp, 0xc
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4145b0
lea eax, [esp + 0x28]
mov dword [esp + 0x22], 0
mov dword [esp + 0x10], eax
xorps xmm0, xmm0
lea eax, [esp + 0x230]
movlpd qword [esp + 0x1a], xmm0
mov dword [esp + 0x14], eax
mov eax, 0x654
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop esi
add esp, 0x430
ret

Function at 0x414620
Capabilities:
Copy file

Disassembly:
sub esp, 0x430
lea eax, [esp + 0x20]
push 0x208
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea ecx, [esp + 0x434]
cmp dword [esp + 0x448], 8
lea edx, [esp + 0x20]
cmovae ecx, dword [esp + 0x434]
sub edx, ecx
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x414660
push 0x208
lea eax, [esp + 0x22c]
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea ecx, [esp + 0x44c]
cmp dword [esp + 0x460], 8
lea edx, [esp + 0x228]
cmovae ecx, dword [esp + 0x44c]
sub edx, ecx
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4146b0
xor eax, eax
mov dword [esp], 0
mov word [esp + 0x1c], ax
xorps xmm0, xmm0
lea eax, [esp + 0x20]
movlpd qword [esp + 0x10], xmm0
mov dword [esp + 8], eax
lea eax, [esp + 0x228]
mov dword [esp + 0xc], eax
lea eax, [esp]
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 8], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edx, dword [esp + 0x448]
cmp edx, 8
jb 0x414742
mov ecx, dword [esp + 0x434]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414738
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4147a7
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov edx, dword [esp + 0x460]
xor eax, eax
mov dword [esp + 0x444], 0
mov dword [esp + 0x448], 7
mov word [esp + 0x434], ax
cmp edx, 8
jb 0x4147a0
mov ecx, dword [esp + 0x44c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414796
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4147a7
push edx
push ecx
call fcn.004a24e6
add esp, 8
add esp, 0x430
ret
call fcn.004a9d47
int3
Function at 0x4235b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov eax, ecx
mov ebx, edx
push ebp
push esi
push edi
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x423602
mov al, byte [ebx]
xor esi, esi
mov edi, ebx
test al, al
je 0x4235ee
nop
movzx eax, al
lea edi, [edi + 1]
movzx ecx, byte [eax + 0x4ca7f0]
lea eax, [esi*8]
xor ecx, eax
mov al, byte [edi]
xor esi, ecx
test al, al
jne 0x4235d0
mov ecx, dword [esp + 0x10]
mov eax, esi
xor edx, edx
div dword [ecx]
mov esi, dword [ebp + edx*8 + 4]
mov edi, dword [ebp + edx*8]
jmp 0x42360a
mov esi, dword [eax + 8]
xor edx, edx
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x18]
mov dword [eax], edx
test edi, edi
je 0x42362b
push ebx
push dword [esi + 0xc]
dec edi
call fcn.004221d0
add esp, 8
test eax, eax
je 0x423633
mov esi, dword [esi]
test edi, edi
jne 0x423614
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x433090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x14], edx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
test ebx, ebx
je 0x4331a3
cmp byte [ebx + 9], 0
je 0x4330c8
inc dword [ebx + 0xc]
cmp byte [ebx + 0xa], 0
jne 0x4330c8
call fcn.0042f8f0
mov esi, dword [ebx + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x433190
cmp dword [ebp + 8], 0
je 0x433112
test byte [esi + 0x40], 1
jne 0x433112
mov al, byte [esi + 0x42]
cmp al, 1
je 0x4330ed
cmp al, 2
jne 0x43312f
mov ecx, esi
call fcn.0042fa80
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x43312f
mov ebx, dword [esp + 0x10]
mov edx, edi
push 0
mov ecx, ebx
call fcn.00433090
add esp, 4
jmp 0x433190
push dword [esi + 0x30]
call fcn.0041f4b0
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x43317d
lea edi, [esi + 0x78]
nop dword [eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x43316b
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x43315d
call fcn.0042a600
jmp 0x433162
call fcn.00427070
mov ecx, dword [esp + 0x1c]
call fcn.0042bb90
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x433140
mov esi, dword [esi + 8]
test esi, esi
jne 0x4330d6
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [ebx + 9], 0
je 0x4331a3
add dword [ebx + 0xc], 0xffffffff
jne 0x4331a3
mov ecx, ebx
call fcn.0042f8d0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x4347d3
cmp al, 3
jb 0x43479b
cmp al, 4
jne 0x434756
mov edi, dword [esi + 0x3c]
jmp 0x43479d
mov edx, dword [esi + 0x30]
lea eax, [esp + 0xc]
push eax
push 0
push dword [esi + 0x2c]
mov byte [esi + 0x42], 0
push dword [esi + 0x28]
call fcn.0042fb80
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4347a1
push dword [esi + 0x30]
call fcn.0041f4b0
mov eax, dword [esp + 0x10]
add esp, 4
or dword [esi + 0x3c], eax
mov dword [esi + 0x30], edi
je 0x43479d
cmp byte [esi + 0x42], 1
jne 0x43479d
mov byte [esi + 0x42], 2
jmp 0x43479d
xor edi, edi
test edi, edi
je 0x4347aa
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x42], 0
jne 0x4347bf
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4347d3
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
js 0x4347b6
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edi, dword [esi + eax*4 + 0x78]
movzx eax, word [esi + eax*2 + 0x50]
cmp byte [edi + 5], 0
jne 0x43481f
mov ecx, eax
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.00433c30
test eax, eax
jne 0x4347b8
mov ecx, esi
call fcn.00433e80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x43486b
xor eax, eax
test cl, cl
je 0x4348a5
and byte [esi + 0x40], 0xf9
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x434851
call fcn.0042a600
jmp 0x434856
call fcn.00427070
mov ecx, edi
call fcn.0042bb90
mov cl, byte [esi + 0x44]
movsx eax, cl
cmp word [esi + eax*2 + 0x50], 0
je 0x434824
movsx eax, cl
mov ecx, 0xffff
add word [esi + eax*2 + 0x50], cx
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
cmp byte [eax + 2], 0
je 0x4347b6
cmp byte [eax + 5], 0
jne 0x4347b6
push ebx
push esi
call fcn.004348c0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov byte [esi + 0x42], 0
pop esi
mov dword [ebx], 1
pop ebx
mov esp, ebp
pop ebp
ret