joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426050
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x46df10
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
je 0x4260c2
push 4
lea eax, [esp + 0x28]
push eax
push 4
push 0
lea ecx, [esp + 0x2c]
call fcn.00402b80
mov ecx, dword [esi + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4260c2
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00429130
mov al, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00429130
xor al, al
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x10

Function at 0x426fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46e1f6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x24
lea eax, [esp + 0xc]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xc0]
mov dword [esp + 0x2c], 0
call fcn.00429140
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
push 0x25
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xcc]
mov dword [esp + 0x2c], 1
call fcn.00429140
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
mov edx, dword [esp + 0x30]
push edx
push 0x89
mov ecx, esi
mov byte [esi + 0xdc], 0
call fcn.004029b0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
Function at 0x427c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x46e449
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x84]
lea ecx, [esp + 0x68]
mov dword [esi + 0xd8], eax
call fcn.004290c0
lea ecx, [esp + 0x20]
push 6
xor edi, edi
push ecx
mov dword [esp + 0x84], edi
call fcn.004284e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 1
call fcn.004290c0
mov ecx, dword [esi + 0xd8]
mov byte [esp + 0x7c], 2
call fcn.0042d320
test eax, eax
jle 0x427e77
mov ecx, dword [esi + 0xd8]
push edi
call fcn.0042d310
mov ecx, eax
call fcn.0042b3a0
cmp eax, 0xa
jne 0x427e63
mov ecx, dword [esi + 0xd8]
push edi
xor ebp, ebp
call fcn.0042d310
mov ecx, eax
call fcn.0042b6c0
test eax, eax
jle 0x427e63
mov ecx, dword [esi + 0xd8]
lea edx, [esp + 0x44]
push edx
push ebp
push edi
call fcn.0042d310
mov ecx, eax
call fcn.0042b6b0
mov ecx, eax
call fcn.00430880
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x80], 3
call fcn.00429140
lea ecx, [esp + 0x44]
mov byte [esp + 0x7c], 2
call fcn.00429130
mov ecx, dword [esi + 0xd8]
push ebp
push edi
call fcn.0042d310
mov ecx, eax
call fcn.0042b6b0
mov ecx, eax
call fcn.00430830
cmp eax, 9
je 0x427de0
cmp eax, 0xc
jne 0x427e47
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x18]
call fcn.004292a0
push 0x4777a8
mov ecx, eax
mov byte [esp + 0x80], 4
call fcn.004291c0
lea ecx, [esp + 0x50]
mov bl, al
mov byte [esp + 0x7c], 2
call fcn.00429130
test bl, bl
je 0x427db6
push str.YingInstall_SoftReadme.MHT
lea ecx, [esp + 0x30]
call fcn.00428f60
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x80], 5
call fcn.00429280
lea ecx, [esp + 0x2c]
jmp 0x427e3d
push str.YingInstall_SoftReadme.HTM
lea ecx, [esp + 0x3c]
call fcn.00428f60
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x80], 6
call fcn.00429280
lea ecx, [esp + 0x38]
jmp 0x427e3d
push 0x477719
lea ecx, [esp + 0x18]
call fcn.00429220
test al, al
je 0x427e47
push 0
push 0
push 0
push 0
sub esp, 0xc
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0xa0], esp
push eax
call fcn.00428fd0
lea ecx, [esp + 0x78]
push ecx
call fcn.00406060
add esp, 0x10
lea ecx, [eax + 4]
mov byte [esp + 0x8c], 7
call fcn.00402b80
push eax
lea ecx, [esi + 0xe0]
call fcn.00423610
lea ecx, [esp + 0x5c]
mov byte [esp + 0x7c], 2
call fcn.00429130
mov ecx, dword [esi + 0xd8]
push edi
inc ebp
call fcn.0042d310
mov ecx, eax
call fcn.0042b6c0
cmp ebp, eax
jl 0x427ce6
mov ecx, dword [esi + 0xd8]
inc edi
call fcn.0042d320
cmp edi, eax
jl 0x427cad
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 1
call fcn.00429130
lea ecx, [esp + 0x20]
mov byte [esp + 0x7c], 0
call fcn.00429130
lea ecx, [esp + 0x68]
mov dword [esp + 0x7c], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 4
Function at 0x427ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46e474
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x1d
lea eax, [esp + 0xc]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xc0]
mov dword [esp + 0x2c], 0
call fcn.00429140
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
push 0x1e
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xcc]
mov dword [esp + 0x2c], 1
call fcn.00429140
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
mov edx, dword [esp + 0x30]
push edx
push 0x87
mov ecx, esi
mov byte [esi + 0xdc], 0
call fcn.004029b0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
Function at 0x429b40
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x46e8bf
mov eax, dword fs:[0]
push eax
mov eax, 0xa030
call fcn.00450c60
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0xa02c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0xa044]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
push 0x477b7d
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa050], ebx
call fcn.00428f60
push 0x477be8
lea ecx, [esp + 0xa05c]
mov byte [esp + 0xa050], 1
call fcn.00402b80
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00450c07
add esp, 0xc
test eax, eax
jne 0x429ce8
mov ecx, dword [esp + 0x14]
push 2
push ebx
push ecx
call fcn.00452257
mov edx, dword [esp + 0x20]
push edx
call fcn.0045215f
add esp, 0x10
cmp eax, ebx
jne 0x429bf7
mov eax, dword [esp + 0x14]
push eax
call fcn.0045090c
add esp, 4
jmp 0x429ce8
cdq
mov ecx, 0xa000
idiv ecx
mov edi, edx
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call fcn.00451efc
add esp, 4
cmp esi, ebx
jle 0x429c6e
mov eax, dword [esp + 0x14]
push eax
push 1
lea ecx, [esp + 0x3c]
push 0xa000
push ecx
call fcn.00451edf
add esp, 0x10
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0xa038], bl
call fcn.00429050
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa050], 2
call fcn.00429280
lea ecx, [esp + 0x24]
mov byte [esp + 0xa04c], 1
call fcn.00429130
sub esi, 1
jne 0x429c14
mov ecx, dword [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x3c]
push edi
push edx
call fcn.00451edf
add esp, 0x10
mov byte [esp + edi + 0x34], bl
cmp edi, ebx
je 0x429cc0
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
call fcn.00429050
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa050], 3
call fcn.00429280
lea ecx, [esp + 0x24]
mov byte [esp + 0xa04c], 1
call fcn.00429130
mov edx, dword [esp + 0x14]
push edx
call fcn.0045090c
add esp, 4
push ebx
sub esp, 0xc
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00428fd0
mov ecx, ebp
call fcn.004298d0
lea ecx, [esp + 0x18]
mov byte [esp + 0xa04c], bl
call fcn.00429130
lea ecx, [esp + 0xa054]
mov dword [esp + 0xa04c], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0xa044]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa02c]
xor ecx, esp
call fcn.0044f50d
add esp, 0xa03c
ret 0xc
Function at 0x430bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f800
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x34]
push 0x14
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x4948b4
mov dword [esi + 0x108], eax
call fcn.0041f860
push eax
lea ecx, [esi + 0xd8]
mov dword [esp + 0x30], 0
call fcn.00429140
or edi, 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], edi
call fcn.00429130
push 0x15
lea edx, [esp + 0x10]
push edx
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xe4]
mov dword [esp + 0x30], 1
call fcn.00429140
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], edi
call fcn.00429130
push 0x16
lea eax, [esp + 0x10]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xf0]
mov dword [esp + 0x30], 2
call fcn.00429140
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], edi
call fcn.00429130
push 0x17
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xfc]
mov dword [esp + 0x30], 3
call fcn.00429140
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], edi
call fcn.00429130
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4

Function at 0x431fb6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x431fda
cmp dword [edi + 0x54], 0
jne 0x431fda
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0043e3a8
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00431f77
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4386f1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x438738
call fcn.0043e3a8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x438738
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x438754
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043826b
mov esi, eax
test edi, edi
je 0x438752
test ebx, ebx
je 0x438752
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x439618
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x46ff44
call fcn.00452a09
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x43963d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x439683
lea ecx, [ebp - 0x10]
call fcn.00402a80
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00438e07
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402d80
mov eax, esi
call fcn.00452ae1
ret 8

Function at 0x43ae7e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x491c04]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x43af1c
push 0x479b24
push 4
push eax
call fcn.0044fb53
push eax
call fcn.00416ca0
add esp, 0x10
push ebx
push edi
call fcn.00452f0d
mov edi, dword [eax]
call fcn.00452f0d
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.004509a6
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.00452f0d
cmp dword [eax], ebx
je 0x43af33
call fcn.00452f0d
push dword [eax]
call fcn.00433122
pop ecx
jmp 0x43af3a
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x43aec4
jmp 0x43afc1
call fcn.00452f0d
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
je 0x43afbd
cmp dword [ebp - 0x11c], esi
jae 0x43afbd
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x160], 0x40
call fcn.004504b0
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x43afac
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43afac
lea ecx, [ebp - 0x160]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x43afac
push ebx
push ebx
push esi
jmp 0x43afb5
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x43afbf
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044f50d
leave
ret
Function at 0x43d029
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x43d071
call fcn.0043e3a8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43d071
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x43d0b4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x43d09d
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x43d09d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x43d0b1
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44f50d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x491c04]
jne 0x44f517
repz ret
jmp fcn.00456645
Function at 0x46481a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00457738
and dword [ebp - 4], 0
cmp dword [0x4973a0], 0
mov ebx, eax
jne 0x4648cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46497c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x480924
push edi
call esi
test eax, eax
je 0x46497c
push eax
call fcn.004576c6
mov dword [esp], 0x480914
push edi
mov dword [0x4973a0], eax
call esi
push eax
call fcn.004576c6
mov dword [esp], 0x480900
push edi
mov dword [0x4973a4], eax
call esi
push eax
call fcn.004576c6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4973a8], eax
call esi
push eax
call fcn.004576c6
pop ecx
mov dword [0x4973b0], eax
test eax, eax
je 0x4648cb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004576c6
pop ecx
mov dword [0x4973ac], eax
mov eax, dword [0x4973ac]
cmp eax, ebx
je 0x464923
cmp dword [0x4973b0], ebx
je 0x464923
push eax
call fcn.00457741
push dword [0x4973b0]
mov esi, eax
call fcn.00457741
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x464923
test edi, edi
je 0x464923
call esi
test eax, eax
je 0x46491a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46491a
test byte [ebp - 0xc], 1
jne 0x464923
or dword [ebp + 0x10], 0x200000
jmp 0x46495c
mov eax, dword [0x4973a4]
cmp eax, ebx
je 0x46495c
push eax
call fcn.00457741
pop ecx
test eax, eax
je 0x46495c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46495c
mov eax, dword [0x4973a8]
cmp eax, ebx
je 0x46495c
push eax
call fcn.00457741
pop ecx
test eax, eax
je 0x46495c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4973a0]
call fcn.00457741
pop ecx
test eax, eax
je 0x46497c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46497e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x79bf2460
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov bl, byte [eax]
push esi
cmp bl, 0xd8
je 0x79bf2491
cmp bl, 0xd7
je 0x79bf2491
mov esi, dword [esp + 0x14]
lea ecx, [eax + 1]
test esi, esi
jle 0x79bf24b9
mov eax, dword [esp + 0x10]
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
sub esi, 1
jne 0x79bf2483
pop esi
pop ebx
ret
mov esi, dword [esp + 0x10]
push esi
inc eax
push eax
call fcn.79bf24de
cmp bl, 0xd8
jne 0x79bf24b9
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
jle 0x79bf24b9
lea esp, [esp]
xor byte [eax + esi], 0xf0
inc eax
cmp eax, ecx
jl 0x79bf24b0
pop esi
pop ebx
ret
Function at 0x1039a132
Capabilities:
Encode data using xor

Disassembly:
cli
retf 0x6651
push ecx
invalid
not al
cmc
shr eax, 1
call fcn.106521db
add al, 0x88
movsb byte es:[edi], byte [esi]
xchg edi, eax
aas
adc al, 0xdd
cmp byte [eax - 0x16121295], dl
loope 0x1039a11a
aad 0xdd
sti
xlatb
fscale
out 0x32, al
xor dword [0x94965702], 0xffffffe6
ror dword [edi + 0x996369e], 3
mov eax, 0x63e5f54f
loop 0x1039a1bb
outsd dx, dword [esi]
and byte [ebp + 0x6aca4e2c], bh
cmc
imul esi
dec edi
jne 0x1039a1a7
inc esi
inc ebx
invalid
shl byte [ebp - 0xd0d00b7], cl
daa
ja 0x1039a1ca
in eax, dx
das
adc eax, 0x65437bdc
pop edi
push ebx
jge 0x1039a21e
pop edi
inc edi
pop ebp
inc ebp
jno 0x1039a22c
invalid
lock sub al, byte [eax]
dec ebx
not dl
invalid
movsd dword es:[edi], dword gs:[esi]
cmp eax, 0x67bc7cea
cmp eax, 0x67bc7cea
inc ecx
pop esi
loopne 0x1039a25a
cmp esi, dword [ecx]
dec edx
mov ah, 0xd
add dword [edx + 0x7b4f7277], 0xee29941
xor dword [edx - 0x4c], ecx
or eax, 0x72778281
dec edi
jnp 0x1039a26b
cdq
loop 0x1039a23b
push cs
outsd dx, dword [esi]
jnp 0x1039a213
dec ebx
iretd
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
das
wait
sbb dword [eax], edi
sub dl, bl
invalid
add ebx, esi
dec ebx
mov word [edx + 0x1c5f9f2a], cs
in eax, dx
mov eax, dword [0x33e3849d]
xchg ecx, eax
repne stosb byte es:[edi], al
stosb byte es:[edi], al
push 0x64
mov byte fs:[0x2563a6fb], al
mov ecx, 0xaaba3db5
sub dword [ebx - 0x1c], 0x992eee09
out dx, al
pop edi
loope 0x1039a2f9
jle 0x1039a216
mov cl, 0x8e
add eax, edx
dec eax
insb byte es:[edi], dx
dec esi
push 0x5e46427e
jle 0x1039a2e3
jl 0x1039a2df
dec ebp
pop ecx
jecxz 0x1039a313
lodsb al, byte [esi]
ror ecx, 1
invalid
cdq
push 0xffffffffffffffd2
invalid
dec ebx
jbe 0x1039a337
dec esp
dec esi
clc
in eax, dx
mov bl, byte [edx - 0x3c2d361b]
cmc
int 0xd3
jmp 0x1039a2de
inc ebp
std
adc eax, 0x5964a6fb
jns 0x1039a2e1
dec edx
sbb dword [ecx], edx
pop es
and ecx, dword [ecx]
sbb eax, 0x7091727
adc eax, 0x2838120c
add al, 0x5b
push ebx
pop ecx
scasd eax, dword es:[edi]
sub eax, 0x1703172f
cmp dword [edi], edx
add dword [edi], esp
mov ebp, dword [esp + ebp*8]
lodsd eax, dword [esi]
cld
mov dl, 0x28
push esi
test dword [ebx + 0x63], 0x487f10cb
sti
dec edi
rol ebx, 1
sal ah, cl
fdiv st(0)
clc
fidiv dword [eax - 5]
cmpsb byte [esi], byte es:[edi]
and al, 0x91
push ebx
dec eax
inc ebp
dec esp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx], ch
mov edx, dword [eax + 0x2264e220]
jge 0x1039a342
aad 0xff
push ebp
aad 0xf9
ret
Function at 0x41cca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48aed8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x4d6394]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x20], 0xd
jne 0x41cdb6
mov eax, dword [esi + 0xb8]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x88]
mov eax, dword [edx + 0x4c]
test eax, eax
je 0x41cdb6
mov dword [ecx + 0x30], 1
mov eax, dword [esi + 0xb8]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0xa8]
mov edx, dword [esi + 0xb8]
mov edi, dword [ecx + 0x15c]
mov dword [edx + 0x88], 3
mov eax, dword [esi + 0xb8]
mov eax, dword [eax + 0x10]
call fcn.004427d1
test edi, edi
jl 0x41cda2
mov ecx, dword [esi + 0xb8]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0xa8]
mov eax, dword [eax + 0x154]
dec eax
cmp edi, eax
jg 0x41cda2
mov ecx, dword [esi + 0xdc]
sub ecx, dword [esi + 0xd8]
test ecx, 0xfffffffc
je 0x41cdb6
mov dword [esp + 0xc], vtable.snh_D_g8NTlr_15FRMD.0
mov dword [esp + 0x48], 0
mov edx, dword [esi]
mov edx, dword [edx + 0x7c]
or eax, 0xffffffff
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0xc]
push eax
push esi
mov ecx, esi
mov dword [esp + 0x34], edi
call edx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x40
push 0x4bb2a0
push 0x4af4e0
call fcn.00472730
add esp, 0xc
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42f880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x42f89d
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x14]
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x42f8cd
lea ebx, [ebx]
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x42f8cd
inc edi
cmp edi, ebx
jb 0x42f8c0
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x42f9d5
cmp eax, 3
jbe 0x42f900
xor esi, esi
mov al, byte [edi + 4]
mov dword [esp + 0x10], ebp
test al, al
je 0x42f93b
cmp al, 0xff
je 0x42f93b
and esi, 3
add esi, esi
or esi, 1
inc ebp
jmp 0x42f8b3
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x42f8e6
movzx ecx, byte [esi + 0x4b3f98]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x4b3f90], 0
mov al, byte [eax + 4]
je 0x42f929
test al, al
je 0x42f929
cmp al, 0xff
jne 0x42f8e6
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
inc ebp
jmp 0x42f8b3
movzx ecx, byte [edi + 3]
movzx edx, al
movzx eax, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
lea esp, [esp]
sub edx, ebp
sub edx, 5
mov eax, edx
test esi, esi
je 0x42f9a7
movzx edx, byte [esi + 0x4b3f98]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x42f98c
cmp bl, 0xff
jne 0x42f9a3
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x42f960
mov ebx, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, eax
shr edx, 8
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 3], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x42f8b3
pop edi
pop ebx
cmp eax, 3
jbe 0x42f9ec
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
lea ecx, [eax - 1]
mov eax, dword [esp + 0x18]
shl esi, cl
and esi, 7
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret