joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
xor eax, eax
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
push edi
mov al, 0x6f
mov byte [ebp - 0x20], al
xor eax, eax
push 0x7f
push eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc0], al
lea eax, [ebp - 0xbf]
push eax
mov dword [ebp - 0x38], 0x2a2f2a
mov dword [ebp - 0xc], 0x54534f50
mov dword [ebp - 0x2c], 0x646e6957
mov dword [ebp - 0x28], 0x2073776f
mov dword [ebp - 0x24], 0x6c707845
mov dword [ebp - 0x1f], 0x726572
call fcn.0041ba30
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 0x7d8]
add esp, 0xc
cmp dword [esi + 0x958], 0
jne 0x418b31
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push esi
call fcn.0041a550
add esp, 0x18
mov dword [esi + 0x958], eax
test eax, eax
je 0x418c40
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x418b59
lea esp, [esp]
cmp dword [eax], 0xa0d0a0d
je 0x418b50
inc eax
cmp byte [eax], 0
jne 0x418b40
jmp 0x418b59
mov dword [eax], 0
add eax, 4
push ebx
mov dword [ebp + 8], eax
push 0x2f
lea eax, [edi + 0x4f3ca4]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041b9b0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x958]
push 1
push 0
push 3
push 0
push 0
push 0x50
push eax
push ecx
lea edx, [ebp - 0x38]
push esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
call fcn.0041a5c0
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x418c3f
push 1
push 0
lea edx, [ebp - 0x40]
push edx
push 0
push 0
lea eax, [edi + 0x4f3c64]
push eax
lea ecx, [ebp - 0xc]
push ecx
push ebx
push esi
call fcn.0041a640
add esp, 0x24
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x418be2
push ebx
push esi
call fcn.0041a7a0
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.0041bc80
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041bc80
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc0]
push edx
push eax
push esi
call fcn.0041a6c0
add esp, 0x18
test eax, eax
jle 0x418c2b
cmp dword [ebp + 0x1c], 0
je 0x418c2b
mov dword [edi + 0x2050], 1
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.0041a7a0
push ebx
push esi
call fcn.0041a7a0
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.0041abe0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a5ae
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.0041abe0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a62f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041abe0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a6af
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041abe0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a723
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x96c]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0041abe0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a78f
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x970]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0041abe0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a7f6
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41afe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b046
cmp dword [esi + 0x18], 0
je 0x41b061
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041c8f0
add esp, 8
test eax, eax
jne 0x41b03e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b020
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41b061
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41b061
cmp eax, ecx
je 0x41b03e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41b054
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b0c8
cmp dword [esi + 0x18], 0
je 0x41b0c8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041c8f0
add esp, 8
test eax, eax
jne 0x41b0d0
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b0b0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b0e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b138
cmp dword [esi + 0x18], 0
je 0x41b138
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041c8f0
add esp, 8
test eax, eax
jne 0x41b140
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b120
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b1f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x41b234
cmp dword [eax + 0x18], 0
je 0x41b234
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x41b227
mov esp, ebp
pop ebp
ret

Function at 0x41b240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0041ba30
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41b2cb
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041c050
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00414dc0
add esp, 0x10
test eax, eax
jne 0x41b2d3
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b2a0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b710
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x41b71e
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b71a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x41b71a
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x41b760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x41b784
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41b784
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x41b78c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0041bb60
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0041b9e0
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0041b9b0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x41b81e
mov dword [ebp + 0xc], edx
jmp 0x41b7c9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x41b7e0
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x41b7f6
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x41b803
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0041b9b0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41b7c7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41b850
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41b850
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x41b854
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x41b8d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x41b8f0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b8f0
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x41b8f4
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x41b8f0
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x41c5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41c80c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0041ba30
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41c79c
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41c792
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0040abd0
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41c7bd
inc eax
cmp byte [esi + eax], 0
jne 0x41c7b6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0041b9b0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41c7da
inc edi
cmp byte [edi + ebx], 0
jne 0x41c7d3
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41c7ea
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41c7e2
test esi, esi
je 0x41c7ff
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0041ba00
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40259f
Capabilities:
Query environment variable

Disassembly:
jmp 0x470ded
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x470e01
xor edi, edi
jmp 0x470e45
push ebx
push esi
call fcn.00470ce6
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.004036d4
mov edi, eax
add esp, 0x14
test edi, edi
je 0x470e32
push ebx
push esi
push edi
call fcn.0040380a
add esp, 0xc
push 2
push 0
call fcn.00403328
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x4033d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x49ec70
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x4cbfc4], 1
jge 0x49ecdf
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x49ecb5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x49ecb5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x49ec92
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x49eccb
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x49ecd2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x49edcf
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x49eda0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x49ed95
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x49ed89
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x49ed90
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x49edcf
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x49edca
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x49edb3
mov eax, dword [ebx + 8]
jmp 0x49edcf
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x49edc1
xor eax, eax
jmp 0x49edcf
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x49ecff
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x401190
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
call fcn.00439c9c
xor ebx, ebx
mov esi, 0x69256c
call fcn.0045e958
and al, 0xff
inc ebx
mov byte [esi], al
inc esi
cmp ebx, 0xeed
jl 0x4011a5
mov dword [ebp - 8], 0x468622
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edx, eax
mov esi, 0x465104
mov al, byte [edx]
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
and eax, 0xff
mov al, byte [eax + 0x468422]
mov ecx, dword [ebp - 8]
add al, byte [ecx]
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x69256c], al
inc ebx
inc dword [ebp - 8]
add esi, 4
inc edx
cmp ebx, 0x64
jl 0x4011cb
xor eax, eax
mov edx, dword [0x465294]
xor ebx, ebx
mov esi, 0x69256c
cmp edx, ebx
je 0x40120d
add al, byte [esi]
inc ebx
inc esi
cmp ebx, 0xeed
jl 0x401207
and eax, 0xff
mov al, byte [eax + 0x468422]
mov byte [edx + 0x69256c], al
push 0x468686
mov edx, dword [ebp + 8]
push edx
call fcn.00458c50
add esp, 8
mov esi, eax
xor ebx, ebx
mov edi, 0x69256c
push esi
xor eax, eax
mov al, byte [edi]
push eax
call fcn.0045b67c
add esp, 8
inc ebx
inc edi
cmp ebx, 0xeed
jl 0x401242
call fcn.0045e958
mov ecx, 0x3e8
cdq
idiv ecx
mov edi, edx
xor ebx, ebx
cmp edi, ebx
jle 0x401288
push esi
call fcn.0045e958
and eax, 0xff
push eax
call fcn.0045b67c
add esp, 8
inc ebx
cmp edi, ebx
jg 0x40126f
push esi
call fcn.004587c0
pop ecx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x437eec
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
mov ebx, 0x704268
mov eax, ecx
xor edx, edx
test al, 1
je 0x437f08
shr eax, 1
xor eax, 0xedb88320
jmp 0x437f0a
shr eax, 1
inc edx
cmp edx, 8
jl 0x437efb
mov dword [ebx], eax
inc ecx
add ebx, 4
cmp ecx, 0x100
jl 0x437ef7
mov byte [0x6403a0], 1
pop ebx
pop ebp
ret

Function at 0x437f28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov al, byte [0x6403a0]
test al, al
jne 0x437f41
call fcn.00437eec
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
cmp esi, edx
jle 0x437f6c
xor ecx, ecx
inc edx
mov cl, byte [eax]
inc eax
xor ecx, ebx
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x704268]
xor ecx, ebx
cmp esi, edx
mov ebx, ecx
jg 0x437f4c
mov eax, ebx
pop esi
pop ebx
pop ebp
ret