joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4092b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0040b560
add esp, 8
test eax, eax
jne 0x40931b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0040f602
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x409330
push esi
lea ecx, [esp + 0x14]
call fcn.0040ca00
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0040caa0
test edi, edi
je 0x40934e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040f602
add esp, 0x6c
ret

Function at 0x4093c0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040b760
add esp, 4
test eax, eax
jne 0x40941e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0040f602
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.0040caa0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040f602
add esp, 0x64
ret

Function at 0x409440
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.0040b850
add esp, 8
test eax, eax
jne 0x4094bf
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0040f602
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0040c5e0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0040f602
add esp, 0x74
ret

Function at 0x409e70
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409ea2
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.0040d930
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x409ec7
push 0x420c74
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.0040da60
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x40a7f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x40a823
mov dword [esp + 0x10], 0xffffffff
jmp 0x40a829
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40a918
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40a87b
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.0040d930
add esp, 0xc
jmp 0x40a94e
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x40a8a5
push 0x420c74
push 0xfe
lea edx, [eax - 7]
push str..QHImageHlp.c
call fcn.0040da60
add esp, 0xc
jmp 0x40a94e
cmp dword [esp + 0x40], ebx
je 0x40a8eb
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x40a8d1
push 0x420d28
push 0x321
mov edx, 5
push str..QHImageHlp.c
call fcn.0040da60
add esp, 0xc
jmp 0x40a94e
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x40a946
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x40a903
push 0x420d28
mov ebx, esi
push 0x32d
jmp 0x40a8bd
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x40a933
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.0040d930
add esp, 0xc
jmp 0x40a94e
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.00409e70
test eax, eax
je 0x40a94e
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40a958
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040f602
add esp, 0x28
ret
Function at 0x40b3d0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x40b41d
push str.GetFileSizeEx__
push 0x11e
push str..QHImageHlp.c
call fcn.0040d930
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x40b4b4
jg 0x40b443
cmp ebx, ecx
jb 0x40b4b4
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x40b479
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.0040d930
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00409e70
test eax, eax
je 0x40b46f
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40b49a
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40b4c1
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x40b4c1
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x40bd80
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x40bec0
cmp dword [esp + 0x28], ebp
je 0x40bec0
push ebx
push 0x2800
call fcn.004102a3
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x40bde3
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040f602
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
jmp 0x40bdf0
push edi
push str..PhysicalDrive_d
mov ecx, 0x2800
call fcn.00409d00
add esp, 8
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40be96
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.00417800
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push ebx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40be89
mov eax, dword [ebx + 0x18]
cmp eax, ebp
jbe 0x40be89
mov edx, dword [esp + 0x18]
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.0040bb20
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x40bea0
inc edi
cmp edi, 0x10
jl 0x40bdf0
push ebx
call fcn.004101c6
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040f602
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.0040f602
add esp, 0x1c
ret
Function at 0x40bf70
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x40bfaa
cmp dword [esp + 0x34], esi
je 0x40bfaa
push 0x200
call fcn.004102a3
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x40bfb5
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c114
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x40c0aa
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40c00d
mov eax, 0x80000002
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c083
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c078
mov eax, ebx
mov dword [ebx], 0x5c2e5c5c
call fcn.0040bee0
cmp edx, edi
jb 0x40c078
ja 0x40c072
cmp eax, dword [esp + 0x24]
jbe 0x40c078
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x40c000
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
ja 0x40c0c0
cmp dword [esp + 0x24], 0
jbe 0x40c114
mov ecx, dword [esp + 0x24]
push edi
push ecx
push str._012I64X
mov ecx, 0x200
call fcn.00409d00
add esp, 0xc
test eax, eax
jne 0x40c0f9
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.004101c6
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ebx
push edx
push str.MAC:
call fcn.0040bb20
add esp, 0xc
mov dword [esp + 0x18], eax
push ebx
call fcn.004101c6
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x40f0f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41dba0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x42419c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x43f3b0]
xor edi, edi
cmp ecx, edi
jne 0x40f13b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x40f148
mov dword [ebp - 0x14], edi
jmp 0x40f160
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x40f1f6
mov ecx, dword [0x43f3b0]
mov eax, dword [ecx]
cmp eax, edi
je 0x40f127
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40f127
mov ebx, 0x43f3b0
mov dword [ebp - 4], edi
call fcn.0040f210
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x40f19e
push 0x4218c4
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.0041cc4a
mov ecx, dword [0x43f3b0]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x40f1b8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x40f1e2
push 0x4218c4
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.0041cc4a
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x40f1d9
call fcn.0040f570
mov eax, 0x40f1df
ret
mov eax, dword [0x43f3b0]
mov eax, dword [eax]
test eax, eax
je 0x40f1f4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f210
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x40f23d
xor ecx, ecx
jmp 0x40f249
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x40f2fd
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x40f270
mov dword [esp + 0xc], esi
jmp 0x40f2d0
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x40f2c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f2bc
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x40f2d0
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40f2d0
push 0x4211a0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40f2d0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x40f2f3
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x40f262
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x40f311
mov ecx, dword [ebx]
add ecx, 8
call fcn.0040f4a0
test eax, eax
je 0x40f311
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x40f320
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x41dbcb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x42419c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.00417800
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x40f3b8
push 0x4218c4
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.0041cc4a
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x40f602
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42419c]
jne 0x40f60c
repz ret
jmp fcn.0041084d
Function at 0x41697c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004117fb
and dword [ebp - 4], 0
cmp dword [0x425f98], 0
mov ebx, eax
jne 0x416a2d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416ade
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41ef54
push edi
call esi
test eax, eax
je 0x416ade
push eax
call fcn.00411789
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425f98], eax
call esi
push eax
call fcn.00411789
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425f9c], eax
call esi
push eax
call fcn.00411789
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425fa0], eax
call esi
push eax
call fcn.00411789
pop ecx
mov dword [0x425fa8], eax
test eax, eax
je 0x416a2d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411789
pop ecx
mov dword [0x425fa4], eax
mov eax, dword [0x425fa4]
cmp eax, ebx
je 0x416a85
cmp dword [0x425fa8], ebx
je 0x416a85
push eax
call fcn.00411804
push dword [0x425fa8]
mov esi, eax
call fcn.00411804
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416a85
test edi, edi
je 0x416a85
call esi
test eax, eax
je 0x416a7c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416a7c
test byte [ebp - 0xc], 1
jne 0x416a85
or dword [ebp + 0x10], 0x200000
jmp 0x416abe
mov eax, dword [0x425f9c]
cmp eax, ebx
je 0x416abe
push eax
call fcn.00411804
pop ecx
test eax, eax
je 0x416abe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416abe
mov eax, dword [0x425fa0]
cmp eax, ebx
je 0x416abe
push eax
call fcn.00411804
pop ecx
test eax, eax
je 0x416abe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425f98]
call fcn.00411804
pop ecx
test eax, eax
je 0x416ade
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416ae0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b9e0
Capabilities:
Encode data using xor

Disassembly:
cmp eax, dword [ebp - 0x46]
xchg dword [eax + edx*4], ebx
lcall 0xe49c, 0xc9492274
pop ecx
cmp al, 0x5c
jbe 0x40b99f
clc
mov eax, dword [0xcdb18b82]
lodsd eax, dword [esi]
cmp byte [eax + 0x3560674d], dl
pop ss
scasd eax, dword es:[edi]
or eax, 0xfbf9f9f7
pop edi
invalid
push 0xb08ba5bd
sbb esi, dword [eax - 0x5dae34b4]
fadd st(3)
pop ebp
fnstenv [ecx - 6]
sub al, 0x57
adc eax, 0xb63536d9
xchg ebp, eax
js 0x40b949
mov al, 0x4c
retf
jnp 0x40b992
jbe 0x40b9e4
sbb ebp, edi
sbb esp, dword [ecx]
jb 0x40ba09
jp 0x40b931
jl 0x40b923
js 0x40b9ac
sbb dword [ebp - 0x47], ebx
cwde
mov al, 6
xor dword [ebx - 0x629df8df], esp
pop ebp
mov ecx, 0x3106b098
mov dword [0x9d620721], eax
dec edi
stosd dword es:[edi], eax
xchg esi, eax
jae 0x40b96d
mov ebx, 0x35d4c89a
sar dword [ecx], cl
invalid
invalid
popfd
loopne 0x40b967
cmp eax, 0x99c8313
aas
mov ah, 0x6b
les ecx, [eax]
adc eax, dword [ebx - 0x4bc0f664]
imul eax, esp, 8
fcmovbe st(0), st(2)
in eax, dx
mov ebx, 0xa280c53b
imul ecx, dword [ebx], 0x957d3894
xor dword [ecx - 0x34fe85b3], eax
int 0x93
not dword [esi + 0x7015eb1e]
mov eax, 0x146fbcea
cmpsd dword [esi], dword es:[edi]
invalid

Function at 0x422190
Capabilities:
Encode data using xor

Disassembly:
add ebp, ebx
xchg edx, eax
push 0x59
mov dword [0x165d43b5], eax
movsd dword es:[edi], dword [esi]
mov al, 0xf0
popal
xchg ecx, eax
sahf
imul esp, dword [ebp + ebx*8 + 9], 0x5b
jg 0x422174
add cl, cl
retf
shr byte [edi], 0xf9
xchg edx, eax
dec ebx
int3
inc ebp
dec ecx
dec esp
not dword [edi]
loop 0x422142
sub eax, 0xc27baa69
and al, 0xdf
shr dword [esi + 0x53], 1
pop ebp
mov dword [0x20548776], eax
and dword [esi - 0x6bece914], edx
jge 0x42218f
stosd dword es:[edi], eax
popal
cmp byte [edx], 0x19
pop edi
pop esi
invalid
Function at 0x42237c
Capabilities:
Encode data using xor

Disassembly:
and esp, ebp
popfd
xchg ecx, eax
daa
push edx
mov ah, 0x18
xor dword [edi + 4], 0x62
push es
aas
salc
test dword [ebx + 0x57], ecx
xchg ebx, eax
test eax, 0x9d2349e6
jne 0x422408
pop es
adc ch, byte [edi]
jl 0x4223a8
cmp al, 0xbf
xor eax, 0xc0a955e1
push ebx
xchg dword [ebx], edi
in eax, dx
and bl, dl
xchg esp, eax
shl byte [ecx + 0x2c4b681], 0x97
ljmp 0x30da
dec edi
jmp dword [esp + ecx*2 + 0x7403e524]
fxam
and byte [edi], al
stc
mov esp, 0xd98752cf
adc dword [ecx + 0x480e6356], esi
push esi
arpl word [esi], cx
push cs
dec eax
int3
mov eax, dword [0xb8f3470e]
pop edi
xchg esp, eax
jecxz 0x422432
out dx, al
jnp 0x422455
outsb dx, byte [esi]
add eax, 0xd76aaf7f
xchg dl, dl
jae 0x4223c9
add dh, dh
rol dword [ecx + 0x47], cl
or al, 0x6f
mov ecx, eax
xchg ebp, eax
test dword [edx], edi
adc edx, dword [edx]
adc ebx, dword [ebx - 0x5e]
mov edx, 0x3108529c
or byte [ecx], dh
jbe 0x4223e2
jno 0x4223e0
test al, 0x1a
and dword [edi - 0x68], esi
sbb ah, byte [ecx]
ja 0x4223d4
loope 0x422437
add bh, byte [edx]
inc esp
maskmovq mm5, mm2
scasd eax, dword es:[edi]
jmp 0xd7ad4e22
pop eax
sub dh, byte [esi]
mov dl, 0xd6
inc eax
dec esi
jge 0x422492
push esi
invalid
and al, 0x10
dec ebx
mov ebp, 0x56bc0cba
jle 0x422508
jne 0x42241e
mov bh, byte [ebp + 0x2d]
jge 0x4224c3
sbb ebx, ecx
mov ah, byte [ebp + 0x739185f3]
jno 0x4224dc
push eax
aam 0xfc
mov esp, 0x2b4afd26
jmp 0x42242f
add al, 0x4d
sbb eax, edx
push cs
add al, byte [edi - 0x4b]
xor cl, byte [esi + 0x1d0334f1]
mov dword [0xa4422388], eax
sbb esi, ebx
xor bh, 0xe4
mov dh, 0x74
adc cl, dh
je 0x4224d5
int1
inc edx
sub ecx, eax
outsd dx, dword [esi]
and eax, 0x42b479f5
mov cl, 3
out dx, ax
mov dword [0xdf16582], eax
and byte [ebp - 0xf], 0xd
das
dec eax
inc esp
inc esp
add ch, byte [edx + 0x79]
sbb esp, ebx
jns 0x4224aa
xchg ebp, eax
dec ebp
in eax, 0x29
jno 0x422559
dec ebx
pushal
dec edx
jno 0x422489
sub byte [ecx - 0x42997bb], bh
invalid
push cs
push cs
in al, 0x76
pop ebx
xchg bl, dh
push 0x763d3508
or eax, 0x9a2bfd7
and dword [eax], 0x78
jmp 0x42253a
or byte [0xd70d763d], dh
mov edi, 0x208309a2
js 0x422507
sbb eax, 0xcf1b2560
xor al, 0xc1
sub edx, esp
jns 0x422551
pushal
mov bl, 0x8c
push esi
fimul word [edi - 0x78]
jb 0x4224bf
dec ebp
invalid
mov edx, 0xa80e33da
cmc
pop esi
and dl, dl
ficomp word [edx + ecx*4]
sbb ebp, ecx
jmp dword [ebx - 0x3d]
sub eax, 0xb8ec8610
xor dword [edx], esi
rcl byte [esp + edi*2 - 0x4d], cl
push esp
jl 0x42250f
fcmovnbe st(0), st(3)
pushfd
push edx
add edi, dword [0x1e4c762d]
sub dword [ebp - 6], ecx
imul ecx, esp, 0xfd1d061
fcomp qword [ebx + esi*2 - 0x1efd466c]
je 0x422551
stosd dword es:[edi], eax
dec ebp
inc ebp
cmp esp, dword [ebx]
clc
rol byte [esi], 0xec
inc edi
outsb dx, byte [esi]
cmpsb byte [esi], byte es:[edi]
push esp
pop ds
sal dword [ecx], 0xe
scasb al, byte es:[edi]
mov dword [eax + 0x413b6542], esp
or al, 0x4b
shr byte [edi - 0x359eae16], 1
outsb dx, byte [esi]
xchg ebx, eax
dec edx
mov dh, 0x82
imul ecx, dword [edx], 0x862b6341
int3
Function at 0x42ff2c
Capabilities:
Encode data using xor

Disassembly:
fucomi st(4)
sbb byte [eax - 0xedc5d2d], bl
test ch, dh
xchg ebx, eax
cmc
movsd dword es:[edi], dword [esi]
stc
cmc
xor dword [esi + 0x627d56e2], ebp
push esi
jge 0x42ffa3
ja 0x42ff39
div dword [edi]
fdivr qword [esi + 0x1fcf9f79]
into
mov eax, dword [0x66c8fddf]
out 0xb8, eax
sbb eax, 0x397781d6
movsd dword es:[edi], dword [esi]
jge 0xd0c8567c
xor dword [edi + 0x39], 0x1d8d0fa5
push edi
test eax, edx
cmpsd dword [esi], dword es:[edi]
xor al, 0x50
adc eax, 0x667abf2e
jp 0x42ff55
jae 0x42ff2e
popfd
pop ebp
and dl, byte [ebx - 0x24dbd09b]
sbb byte [ebp*4 - 0xb895b4e], bh
insb byte es:[edi], dx
in eax, 0x16
mov bh, 0xc1
scasd eax, dword es:[edi]
aaa
add byte [edx + 0x2c], ah
jns 0x42ffcc
xchg ebx, eax
rcr byte [eax], cl
cmp eax, 0x8e2321bc
insd dword es:[edi], dx
neg dword [ecx + 0x3c]
sbb al, 0x4f
mov al, byte [0x11c2e31c]
test byte [edx + 0x3fd5599a], al
std
int 0x92
cmp ah, bh
xor esp, esi
jno 0x42ffe1
and edi, esi
jge 0x42ff3e
inc ebp
in al, 0xeb
mov eax, dword [0x725b4f4d]
aad 0
in al, 0xbf
pop edx
invalid
push eax
insb byte es:[edi], dx
imul edx, dword [esi + 0xe], 0x7b6fd7c4
pop esp
and eax, 0x2ebe76f8
test dword [eax], eax
sub al, 0xeb
adc dl, cl
cli
lodsb al, byte [esi]
dec ebx
and ah, byte [esi*2 - 0x39ed04b1]
sti
adc al, dh
mov byte [0xd511e27], al
test dword [ecx + 0x37], edx
push edi
daa
cmc
je 0x430023
loopne 0x430028
dec ebp
mov esi, 0xf6026568
add ah, byte [ecx - 0x6a168b92]
adc eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
scasb al, byte es:[edi]
sbb byte [eax + eax*8 + 0x5b83d724], bh
add eax, 0xad3093e6
loope 0x42ffc3
dec ebx
xor dword [eax - 0x2fb7237d], ebp
into
xchg edx, eax
int3
in al, 0xbc
jne 0x42ffab
leave
pop esp
je 0x43001a
xchg ecx, eax
dec edi
rdmsr
xchg esi, eax
mov dh, 0xe9
call 0x1b79ef80
jmp 0xf88b5ae1