joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180424c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181d2030
push edi
mov edi, ecx
cmp dword [0x181d2030], ebx
je 0x18042509
push ecx
mov ecx, esi
call fcn.1803ae69
mov ebx, eax
mov ecx, ebx
call fcn.1801d0b7
test ebx, ebx
js 0x18042577
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x180424eb
lfence
cmp byte [edi + 0x3c], 0
je 0x18042585
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x1804257e
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x180425b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1804254c
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1804257e
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1804256e
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1804258d
lfence
mov eax, ebx
jmp 0x18042598
mov esi, 0x80004005
jmp 0x18042591
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18042596
call fcn.18042484
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e2a8
leave
ret 4

Function at 0x1804597c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe fcn.180459b7
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1804599e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x180459af
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x180459b9
inc edi
add eax, 0x28
cmp edi, esi
jb 0x18045994
Function at 0x18047503
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.1804594c
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.180458ad
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x180478b4

Function at 0x1804859c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x181d000c]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x14], 0
push ebx
push esi
mov byte [ebp - 0x41], cl
mov bh, dl
push edi
lea ecx, [ebp - 0x14]
call fcn.18014de5
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
and dword [ebp - 0x10], 0
push edi
call fcn.180074da
mov bl, byte [ebp + 8]
mov eax, str.MicrosoftEdgeComRegisterShellARM64.exe
test bl, bl
jne 0x180485e1
mov eax, str.MicrosoftEdgeUpdateComRegisterShell64.exe
push eax
lea ecx, [ebp - 0x10]
call fcn.1800f7d5
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x180485fd
call fcn.1801baa5
mov ebx, eax
jmp 0x180486ff
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18048612
mov ebx, 0x80070002
jmp 0x180486ff
and dword [ebp - 0xc], 0
call fcn.18006f7b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800768f
mov eax, 0x18172bcc
mov edx, eax
test bh, bh
jne 0x18048634
mov edx, str._unregister
cmp byte [ebp - 0x41], 0
mov ecx, eax
jne 0x18048641
mov ecx, str._user
test bl, bl
je 0x1804864a
mov eax, str._arm64
push edx
push ecx
push eax
lea eax, [ebp - 0xc]
push str._s__s__s
push eax
call fcn.18016b1d
add esp, 0x14
lea eax, [ebp - 0x40]
push 0x2c
push 0
push eax
call fcn.18132f50
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.18017792
push 0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x40]
call fcn.18017900
mov ebx, eax
test ebx, ebx
jns 0x180486cc
movzx ecx, byte [0x181d605a]
neg ecx
sbb ecx, ecx
and ecx, 0x181d5f50
je 0x180486ec
push 7
pop edx
push 0xfffffffffffffffe
pop eax
lfence
push eax
push edx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
call fcn.18008b3f
push ebx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x54]
push str._Failed_to_start_COM_register_process__0x_x_
push eax
call fcn.18007210
add esp, 0xc
jmp 0x180486ec
push 0x7530
lea ecx, [ebp - 0x40]
call fcn.18017a54
movzx ebx, al
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8fa4c
add ebx, 0x800705b4
lea ecx, [ebp - 0x40]
call fcn.180178b8
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f52
lea ecx, [esi - 0x10]
call fcn.18006f52
lea ecx, [edi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e2a8
leave
ret
Function at 0x1809bed6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x181d000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x19c], ebx
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1a0], eax
mov byte [ebx], 0
call fcn.1809c31a
and dword [ebp - 8], 0
call fcn.18006f7b
push eax
lea ecx, [ebp - 8]
call fcn.1800768f
push 0xc02
lea ecx, [ebp - 8]
call fcn.180076c8
xor eax, eax
mov dword [ebp - 0x44], 0x1819d530
push 0x14c
push eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x198]
push eax
call fcn.18132f50
add esp, 0xc
lea eax, [ebp - 0x44]
push esi
push ecx
push eax
lea ecx, [ebp - 0x198]
call fcn.18110afc
lea ecx, [ebp - 0x198]
call fcn.18110c84
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test eax, eax
jns 0x1809bfb4
push 4
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete cl
test eax, eax
mov byte [ebx], cl
setne bl
jmp 0x1809bff9
push 0
lea ecx, [ebp - 0x194]
call fcn.1800bc14
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 0x194]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x181d30e8
call fcn.18026921
lea ecx, [ebp - 0x44]
call fcn.1809b94b
mov ecx, dword [ebp - 0x19c]
mov al, byte [ebp - 0x68]
mov byte [ecx], al
mov ecx, dword [ebp - 0x1a0]
mov al, byte [ebp - 0x67]
mov byte [ecx], al
lea ecx, [ebp - 0x198]
call fcn.18110bd5
lea ecx, [ebp - 0x44]
call fcn.18044923
lea ecx, [edi - 0x10]
call fcn.18006f52
lea ecx, [esi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e2a8
leave
ret
Function at 0x1809c169
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x181d000c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
push ebx
mov ebx, edx
push esi
mov esi, ecx
mov dword [ebp - 0x184], ebx
push edi
mov edx, esi
mov byte [ebx], 0
lea ecx, [ebp - 0xc]
call fcn.1809c31a
and dword [ebp - 8], 0
call fcn.18006f7b
push eax
lea ecx, [ebp - 8]
call fcn.1800768f
push dword [esi]
lea eax, [ebp - 8]
push 0xbff
push eax
call fcn.18042617
xor eax, eax
mov dword [ebp - 0x44], 0x1819d530
add esp, 0xc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
push 0x138
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x180]
push eax
call fcn.18132f50
pop ecx
pop ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x180]
call fcn.1811118e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x180]
call fcn.181112bf
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test eax, eax
jns 0x1809c24a
push 4
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete cl
test eax, eax
mov byte [ebx], cl
setne bl
jmp 0x1809c27a
push 0
lea ecx, [ebp - 0x17c]
call fcn.1800bc14
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 0x17c]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x44]
call fcn.1809b94b
mov ecx, dword [ebp - 0x184]
mov al, byte [ebp - 0x54]
mov byte [ecx], al
lea ecx, [ebp - 0x180]
call fcn.18111245
lea ecx, [ebp - 0x44]
call fcn.18044923
lea ecx, [edi - 0x10]
call fcn.18006f52
lea ecx, [esi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e2a8
leave
ret
Function at 0x181102fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x181d000c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x181d49a0]
push edi
push 0xf0
push eax
xor edi, edi
mov dword [ebp - 0x130], ecx
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x18110481
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x18110481
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x18110481
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x18110480
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x134], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x181103f9
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.18132f50
add esp, 0xc
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
push 3
push esi
call fcn.1804bc4f
push dword [ebp - 0x108]
mov eax, dword [ebp - 0x130]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
inc eax
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x104]
cmp dword [ebp - 0x108], eax
je 0x1811046e
push dword [ebp - 0x108]
call fcn.18136e63
pop ecx
jmp 0x1811046e
mov ecx, 0x1234
cmp cx, ax
jne 0x1811046e
or dword [ebp - 0x128], 0xffffffff
lea eax, [ebp - 0x234]
push 3
push esi
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x238], eax
call fcn.1804bc4f
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x124], eax
cmp eax, ecx
je 0x1811044b
push eax
call fcn.18136e63
pop ecx
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x130]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
je 0x1811047e
add esi, dword [ebp - 0x134]
test edi, edi
jne 0x1811035b
jmp 0x18110480
xor edi, edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1811e2a8
leave
ret 4
Function at 0x18112782
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x181d000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.18111867
lea esi, [edi + 0x1e4]
xor ecx, ecx
mov eax, dword [esi]
inc ecx
mov ebx, 0x100
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
or eax, ecx
jge 0x181127c0
push ebx
mov ecx, esi
call fcn.1800771c
push ebx
push dword [esi]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.18009eb8
push 1
mov ecx, edi
call fcn.18114568
push 8
call fcn.1811eb58
mov esi, eax
lea eax, [ebp - 0x10]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov eax, dword [edi + 0x1c4]
mov dword [edi + 0x1c4], esi
test eax, eax
je 0x18112817
push 8
push eax
call fcn.1811e7d6
pop ecx
pop ecx
push 0x7d9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor esi, esi
push esi
push 1
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 0x181c6364
push 3
push esi
push 0x181b394c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1811287c
mov ecx, dword [edi + 0x1ec]
mov ebx, dword [ebp - 8]
mov dword [ebp - 8], esi
test ecx, ecx
je 0x18112876
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x181623e8]
call esi
xor esi, esi
mov dword [edi + 0x1ec], ebx
mov ecx, edi
call fcn.181139e7
mov dword [ebp - 0xc], esi
call fcn.18006f7b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800768f
push 0xbdc
lea ecx, [ebp - 0xc]
call fcn.180076c8
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.181145da
mov ecx, edi
call fcn.18114539
push 0x7db
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov eax, dword [ebp - 8]
test eax, eax
je 0x181128ea
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x181623e8]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e2a8
leave
ret 0x10

Function at 0x18113abf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d000c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.1802702d
test al, al
je 0x18113af6
push 0x7dc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x18113b2e
and dword [ebp - 8], 0
call fcn.18006f7b
push eax
lea ecx, [ebp - 8]
call fcn.1800768f
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.180076c8
lea eax, [ebp - 8]
mov ecx, esi
push eax
push 0x7dc
call fcn.181138f3
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1811e2a8
leave
ret 8
Function at 0xa98058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa981a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9806a
add dl, dl
jne 0xa98089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa980dc
xor eax, eax
add dl, dl
jne 0xa98096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9817d
add dl, dl
jne 0xa980a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa980b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa980bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa980c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa980d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa98075
mov eax, 1
add dl, dl
jne 0xa980ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa980f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa980e1
sub eax, ebx
mov ebx, 1
jne 0xa98128
mov ecx, 1
add dl, dl
jne 0xa9810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa98119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa98105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa98075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa98136
cmp eax, 0x7d00
jae 0xa9816d
cmp eax, 0x500
jb 0xa98168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa98075
cmp eax, 0x7f
ja 0xa98170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa98075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa98075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x2c674c48
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x65de243a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x43d250
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5747c8]
xor edx, edx
cmp eax, edx
jne 0x43d276
xor eax, eax
mov byte [eax + 0x5746c8], al
inc eax
cmp eax, 0x100
jl 0x43d25e
mov dword [0x5747c8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5746c8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x43d307
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x43d2da
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x43d2a8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x43d380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x43d3d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43d3ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x441a61
cmp eax, 8
jg 0x441a61
cmp dword [esp + 0x8c], 2
jl 0x441a61
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x441a61
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x441a61
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4418c7
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x441a4a
mov ebp, dword [0x4c7694]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x4418f9
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x441a31
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x441919
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x4c7684]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x441958
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x4c7688]
lea ecx, [esp + 0x28]
push ecx
call dword [0x4c76c8]
test eax, eax
jne 0x441a18
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.00440e50
cmp eax, 1
jne 0x441a42
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00441700
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x44190d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x441a4a
jmp 0x4418e4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.00440a50
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c