joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bbee0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x5bbf00
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c
call fcn.004107c0
jmp 0x5bbf07
xor al, al
jmp 0x5bc010
cmp dword [ebp + 0xc], 0
je 0x5bbf13
cmp dword [ebp + 0x10], 0
jne 0x5bbf1a
xor al, al
jmp 0x5bc010
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5bbf2f
xor al, al
jmp 0x5bc010
mov ecx, dword [ebp - 4]
call fcn.004c9530
movzx edx, al
test edx, edx
je 0x5bbf54
mov ecx, dword [ebp - 4]
call fcn.005bbe90
movzx eax, al
test eax, eax
jne 0x5bbf54
xor al, al
jmp 0x5bc010
mov ecx, dword [ebp - 4]
call fcn.004c9560
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.004c9480
push eax
push 0x5e2bd0
push 0x5e2b90
mov ecx, dword [ebp - 4]
add ecx, 0x1c
call fcn.00403f32
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0x20]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x5bbfaa
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.004c9440
movzx edx, al
test edx, edx
je 0x5bbfae
xor al, al
jmp 0x5bc010
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.004c9470
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0x80]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x5bbfde
xor al, al
jmp 0x5bc010
mov ecx, dword [ebp - 4]
add ecx, 0x34
call fcn.004c9470
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x88]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x5bc00e
xor al, al
jmp 0x5bc010
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5bc130
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x5bc19a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7a
jne 0x5bc19a
mov edx, dword [ebp - 0xc]
shl edx, 1
push edx
call fcn.0056728d
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5bc184
xor al, al
jmp 0x5bc1d4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x5bc19a
jmp 0x5bc1bf
cmp dword [ebp - 8], 0
je 0x5bc1bf
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005bb6a0
add esp, 0x14
mov byte [ebp - 1], al
cmp dword [ebp - 8], 0
je 0x5bc1d1
mov ecx, dword [ebp - 8]
push ecx
call fcn.00553d2a
add esp, 4
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4044b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor edx, edx
mov eax, esi
push edi
mov ecx, edx
movzx ebx, word [esi]
test bx, bx
je 0x4044db
inc ecx
lea eax, [eax + 2]
cmp ecx, 0x2319
jl 0x404518
cmp word [eax], dx
jne 0x4044ca
mov eax, dword [0x44a06c]
add eax, 0x2c443b0
mov edx, 0x1f37
and eax, 0x1f4a2f69
mov ecx, 0x4016d0
imul eax, eax, 0xf8c90fe
push 0x61
pop edi
add eax, 0x57f2e538
add edx, edi
lea ecx, [ecx + 2]
cmp edx, 0x18f4
ja 0x404524
movzx edi, word [ecx]
test edi, edi
jne 0x404502
jmp 0x404529
mov eax, dword [0x44a06c]
and eax, 0xe93a2a8e
jmp 0x4044e0
or eax, 0xcef1a57c
add eax, 0x1b2a824f
mov edi, 0xd39
imul eax, eax, 0x5bc789ae
mov edx, esi
mov ecx, ebx
jmp 0x40454f
add edi, ecx
lea edx, [edx + 2]
cmp edi, 0x11f
ja 0x404555
movzx ecx, word [edx]
test ecx, ecx
jne 0x40453f
jmp 0x40455a
add eax, 0x1a51c67a
mov edx, dword [ebp - 4]
or eax, 0xf71b9521
sub eax, 0x3326864a
xor edi, edi
and eax, 0x6b97b3c8
imul ecx, eax, 0xefa4bf71
mov eax, edi
cmp byte [edx], al
je 0x404590
inc eax
cmp eax, 0xda0
jg 0x40458a
cmp byte [eax + edx], 0
jne 0x40457a
jmp 0x404590
add ecx, 0x40fb186
lea eax, [ecx + 0x14ea1c1]
mov ecx, edi
xor eax, 0xffeff9de
or eax, 0x9665898e
test bx, bx
je 0x4045bf
inc ecx
lea esi, [esi + 2]
cmp ecx, 0xa38
jg 0x4045ba
cmp word [esi], di
jne 0x4045a7
jmp 0x4045bf
sub eax, 0x7475695
add eax, 0xcff818f8
mov ecx, 0xaaa
push 0x67
imul eax, eax, 0x7bd8cca
mov edx, 0x4016fc
pop esi
add ecx, esi
lea edx, [edx + 2]
cmp ecx, 0x1f6
ja 0x4045ed
movzx esi, word [edx]
test esi, esi
jne 0x4045d7
jmp 0x4045f2
add eax, 0x3e0110ef
pop edi
add eax, 0x2040af44
and eax, 0xd0235f1b
pop esi
mov dword [0x44a06c], eax
pop ebx
leave
ret
Function at 0x408288
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ecx
xor eax, eax
mov dword [ebp - 0x28], 0x40
mov dword [ebp - 0x24], 0x2c
mov dword [ebp - 0x20], 0xffffff94
sub ebx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x4082ae
mov dword [ebp - 0x38], 0x10
xorps xmm1, xmm1
mov dword [ebp - 0x34], 0x4a
mov dword [ebp - 0x30], 0x5f
mov dword [ebp - 0x2c], 0xffffff6b
movups xmm0, xmmword [ebp - 0x38]
movzx edx, bl
mov dword [ebp - 0xc], ebx
psubd xmm1, xmm0
mov dword [ebp - 0x10], edx
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
add eax, 0x28
mov dword [ebp - 0x1c], eax
cmp edx, eax
jge 0x40847e
push esi
mov esi, dword [0x44a1d8]
push edi
mov dword [ebp - 0x28], 0x52
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x20], 0xffffff31
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x30], 0x22
mov dword [ebp - 0x2c], 0xffffffab
push 0x59
sub esi, 0x627de308
xor eax, eax
pop ecx
add ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x40834f
push 0x33
mov dword [ebp - 0x14], ecx
xor eax, eax
pop edi
inc eax
cmp eax, 0x563
je 0x408374
cmp byte [eax + 0x401710], 0
jne 0x408361
jmp 0x40837a
xor esi, 0x22757fe0
or esi, 0x57c58a46
imul esi, esi, 0x51013de7
xor eax, eax
mov dword [0x44a1d8], esi
add edi, dword [ebp + eax*4 - 0x34]
inc eax
cmp eax, 3
jl 0x40838e
movzx eax, cl
mov dword [ebp - 4], eax
cmp eax, edi
jge 0x408468
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x44], 0x24
mov dword [ebp - 0x40], 0x2b
mov dword [ebp - 0x3c], 0xffffff98
movups xmm2, xmmword [ebp - 0x48]
mov dword [ebp - 0x58], 0x29
mov dword [ebp - 0x54], 0x3a
mov dword [ebp - 0x50], 0x64
mov dword [ebp - 0x4c], 0xfffffefb
movups xmm3, xmmword [ebp - 0x58]
movups xmm1, xmm2
mov eax, esi
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd edx, xmm1
movups xmm1, xmm3
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
add edx, 0x16
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
add ecx, 0x42
imul eax, ecx
mov ecx, dword [ebp - 8]
add eax, dword [ebp - 4]
movzx eax, byte [eax + ecx]
mov ecx, esi
imul ecx, edx
mov edx, dword [ebp - 0x18]
add ecx, dword [ebp - 4]
inc bl
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov byte [ecx + edx], al
movzx eax, bl
mov dword [ebp - 4], eax
cmp eax, edi
jl 0x4083ec
mov esi, dword [0x44a1d8]
mov ebx, dword [ebp - 0xc]
inc bl
movzx eax, bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 0x1c]
jl 0x408344
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4084fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [0x44a1b0]
push edi
push 0x54
xor edi, edi
mov dword [ebp - 8], ecx
pop eax
mov dword [ebp - 0xc], edi
mov ebx, edi
mov dword [ebp - 0x2c], 0x30
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x3a
mov dword [ebp - 0x1c], 0xfffffeee
mov ecx, 0x401770
mov al, 0x69
sub al, 0x30
cmp al, 9
ja 0x408548
inc ecx
mov al, byte [ecx]
test al, al
jne 0x408539
jmp 0x40854e
add esi, 0x5a486a30
sub esp, 0xc
mov edx, 0x401770
mov ecx, 0x401300
xor esi, 0x2173fa8d
call fcn.004044b0
mov edx, dword [ebp - 0xc]
add esp, 0xc
sub edx, dword [ebp + ebx*4 - 0x2c]
inc ebx
mov dword [ebp - 0xc], edx
cmp ebx, 5
jl 0x408532
mov ebx, edi
mov dword [ebp - 0x24], 0x56
mov dword [ebp - 0x20], 0xf
mov eax, edi
mov dword [ebp - 0x1c], 0xffffff9b
sub ebx, dword [ebp + eax*4 - 0x24]
xor esi, 0x31dbd9f1
inc eax
cmp eax, 3
jl 0x408592
mov dword [ebp - 0x28], 0x41
mov dword [ebp - 0x24], 0x3f
mov dword [ebp - 0x20], 0x29
mov dword [ebp - 0x1c], 0xffffff26
movups xmm1, xmmword [ebp - 0x28]
push 0x2a
mov dword [ebp - 0x2c], 0x12
movaps xmm0, xmm1
mov dword [ebp - 0x28], 7
psrldq xmm0, 8
paddd xmm1, xmm0
mov dword [ebp - 0x24], 0x5f
movups xmm0, xmm1
mov dword [ebp - 0x20], 0xd
psrldq xmm0, 4
paddd xmm1, xmm0
mov dword [ebp - 0x1c], 0xffffffa2
movd eax, xmm1
add eax, 0x34
mov dword [ebp - 0x10], eax
pop eax
sub eax, dword [ebp + edi*4 - 0x2c]
inc edi
cmp edi, 5
jl 0x40860a
mov ecx, dword [ebp - 8]
add esi, 0x4335abb1
movzx edi, bl
mov dword [ebp - 0x18], eax
mov dword [0x44a1b0], esi
mov dl, byte [edx + ecx]
mov byte [ebp - 1], dl
cmp edi, dword [ebp - 0x10]
jge 0x408702
mov dword [ebp - 0x28], 0x54
mov dword [ebp - 0x24], 0x23
mov dword [ebp - 0x20], 0x11
mov dword [ebp - 0x1c], 0xffffff81
movups xmm2, xmmword [ebp - 0x28]
xorps xmm1, xmm1
mov dword [ebp - 0xc], 0x66
psubd xmm1, xmm2
mov edx, 0x14d5
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
add eax, 0xa
mov dword [ebp - 0x14], eax
mov eax, 0x4016c8
add edx, dword [ebp - 0xc]
inc eax
cmp edx, 0x1234
ja 0x4086b3
movsx ecx, byte [eax]
mov dword [ebp - 0xc], ecx
test ecx, ecx
mov ecx, dword [ebp - 8]
jne 0x408692
xor esi, 0xb6bf336d
jmp 0x4086d7
sub esp, 0xc
mov edx, 0x4016f0
mov ecx, 0x40131c
call fcn.004044b0
add esp, 0xc
xor esi, 0xbf4563fd
mov ecx, dword [ebp - 8]
add esi, 0x3aa19134
mov eax, dword [ebp - 0x14]
and esi, 0xd401c89
add eax, edi
inc bl
mov al, byte [eax + ecx]
mov byte [edi + ecx], al
movzx edi, bl
cmp edi, dword [ebp - 0x10]
jl 0x408658
mov eax, dword [ebp - 0x18]
mov dl, byte [ebp - 1]
mov dword [0x44a1b0], esi
pop edi
pop esi
mov byte [eax + ecx], dl
pop ebx
leave
ret
Function at 0x40a6e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x41
mov ebx, edx
mov dword [ebp - 8], 0x57
mov edi, ecx
mov dword [ebp - 4], 0xffffff68
pop esi
xor eax, eax
add esi, dword [ebp + eax*4 - 8]
inc eax
cmp eax, 2
jl 0x40a702
mov edx, dword [ebp + 8]
cmp esi, edx
jae 0x40a725
sub edi, ebx
lea ecx, [esi + ebx]
sub edx, esi
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x40a71a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d3b1
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0x4454da
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
push 5
pop ecx
mov esi, 0x401cb8
mov dword [ebp - 0x18], 0x83b0bdc9
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x14], 0x2763b54d
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x10], 0x9c2515e4
mov dword [ebp - 0xc], 0xa69fac54
mov ecx, eax
mov dword [ebp - 8], 0x325de5ec
movsw word es:[edi], word [esi]
mov dword [ebp - 4], 0x11de9ef0
movsb byte es:[edi], byte [esi]
mov edi, eax
mov byte [ebp + ecx - 0x158], cl
inc ecx
cmp ecx, 0x100
jb 0x445526
mov esi, eax
xor edx, edx
mov bl, byte [ebp + esi - 0x158]
push 0x16
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x3c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x158]
mov byte [ebp + esi - 0x158], al
inc esi
mov byte [ebp + edi - 0x158], bl
cmp esi, 0x100
jb 0x445538
xor ebx, ebx
mov edi, ebx
mov esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x158]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x158]
mov byte [ebp + edi - 0x158], al
mov byte [ebp + ebx - 0x158], cl
movzx eax, byte [ebp + edi - 0x158]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x158]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x58], al
inc esi
cmp esi, 0x18
jb 0x44557b
mov eax, dword [0x44ba1c]
lea edi, [ebp - 0x38]
mov esi, 0x40227c
mov dword [ebp - 8], 0x62f0138c
xor ebx, ebx
mov word [ebp - 4], 0x2e2d
and eax, 0xc2280421
mov byte [ebp - 0x40], bl
mov dword [ebp - 0x24], eax
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, ebx
mov byte [ebp + eax - 0x158], al
inc eax
cmp eax, 0x100
jb 0x4455fa
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x158]
push 0x12
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x38]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x158]
mov byte [ebp + esi - 0x158], al
inc esi
mov byte [ebp + edi - 0x158], bl
cmp esi, 0x100
jb 0x44560b
xor ebx, ebx
mov edi, ebx
mov esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x158]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x158]
mov byte [ebp + edi - 0x158], al
mov byte [ebp + ebx - 0x158], cl
movzx eax, byte [ebp + edi - 0x158]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x158]
xor al, byte [ebp + esi - 8]
mov byte [ebp + esi - 0x20], al
inc esi
cmp esi, 6
jb 0x44564e
xor ebx, ebx
mov dword [ebp - 0xc], 0x54
push 0x51
mov byte [ebp - 0x1a], bl
pop eax
mov dword [ebp - 8], 0x60
mov dword [ebp - 4], 0xfffffefb
add eax, dword [ebp + ebx*4 - 0xc]
inc ebx
cmp ebx, 3
jl 0x4456b8
mov ecx, dword [ebp - 0x24]
pop edi
pop esi
or ecx, 0x29962f7f
pop ebx
mov dword [0x44ba1c], ecx
lea ecx, [ebp - 0x20]
push eax
call fcn.0041d4e5
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.0041d4c4
call eax
leave
ret
Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret

Function at 0x401750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
stosd dword es:[edi], eax
or eax, 0x5cc0c8
push eax
add ecx, 0x2d
push 0x40d274
push ecx
call dword [0x6640c180]
out dx, al
lodsb al, byte [esi]
add dh, byte [edx + 0xcc4110b]
test esp, edi
or ecx, dword [edi]
push eax
push 0x40cc54
call dword [0x407d64]
add esp, 8
inc ebp
pop ebp
dec edi
push ss
jo 0x401776
inc eax
add byte [eax - 0x41a074ab], dl
push ebp
mov ebx, dword [edi - 0x42]
Function at 0x77d32606
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push edi
xor edi, edi
inc ebx
sub eax, edi
je 0x77d3ce40
dec eax
je 0x77d37d22
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
loopne 0x77d3ce74
and eax, 0x25319800
add byte [eax], al
add byte [edx], dh
jbe 0x77d3ce66
push ss
xor dh, byte [esi]
jo 0x77d3ce57
add byte [eax], al
inc edx
add al, ah
xor dword [0x1a001800], esp
add byte [eax], cl
xor ah, byte [0xc400600]
cmp bh, 0xff
add byte [eax], al
jl 0x77d3cea5
or al, 0x80
invalid
and eax, 0x252b5400
add byte [edx + 0x4802bd], ah
mov byte [0x4802bd], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [ebx], cl
add byte [esi + 0x43000c01], dh
add byte [edx], bh
add byte [eax + eax + 0x57], bl
add byte [ecx], cl
dec esi
add byte [eax + eax + 0x4f], al
add byte [edi], dl
push ebx
add byte [eax + eax + 0x73], bl
add byte [ecx], bh
jae 0x77d3cea4
je 0x77d3cea6
add byte [ebp], ah
insd dword es:[edi], dx
add byte [ebx], dh
add byte [edx], dh
add byte gs:[ebp], ch
xor eax, dword [eax]
xor al, byte [eax]
pop esp
add byte [ecx], cl
dec ebp
add byte [ebp], cl
xor eax, dword [eax]
xor al, byte [eax]
add byte cs:[eax + eax + 0x4c], al
add byte [eax + eax + 0x49], bl
add byte [ebp], cl
dec ebp
add byte [ebx], dh
add byte [edx], dh
add byte [esi], ch
add byte [eax + eax + 0x4c], al
add byte [eax + eax], cl
add byte [eax], al
add byte [eax], al
add byte [ebx], cl
add byte [ecx], cl
add byte [edi + 0x68000801], bh
xor esp, dword [0x25323000]
add byte [eax + 0x33], dh
and eax, 0x25323800
add byte [eax], bl
xor al, 0x25
add byte [eax + 0x32], al
and eax, 0x30000000
jbe 0x77d3cead
adc dh, byte [eax]
jbe 0x77d3cef1
rol byte [ecx], 1
add byte [edx], bh
add byte [eax + eax], bh
mov byte [edx], dh
and eax, 0x14001200
add byte [eax + 0x4002532], dh
inc eax
or byte [eax + 1], al
shl dl, 0x99
jl 0x77d3cf2d
xor dword [0x2bdb300], esp
dec eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or byte [eax], al
or eax, dword [eax]
add byte [ecx], 8
add byte [ebx], al
cmp al, byte [eax]
pop esp
add byte [edi], dl
dec ecx
add byte [esi], cl
inc esp
add byte [edi], cl
push edi
add byte [ebx], dl
pop esp
add byte [ebx], dh
jns 0x77d3cf42
jae 0x77d3cf44
Function at 0x77d39710
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x77d39723
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x77d3971f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x77d39750
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x77d3978f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x77d39785
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x77d39791
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x77d39775
xor eax, eax
pop edi
pop esi
pop ebx
Function at 0x40b2f0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b39f
push esi
call fcn.004202c0
add esp, 4
test al, al
jne 0x40b39f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x40b317
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00429d10
add esp, 0xc
test eax, eax
je 0x40b34b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00429d10
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40b34d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x40b37e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0041d590
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x40b360
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x417880
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6c3], 0
je 0x41791f
cmp dword [edi + 0x19c], 0
je 0x4178d7
push edi
call fcn.00406150
push 1
push edi
mov byte [esp + 0x14], al
call fcn.004063e0
push dword [edi + 0x14c]
mov eax, dword [edi + 0x19c]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push dword [esp + 0x28]
push edi
call fcn.004063e0
add esp, 0x28
pop edi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x4178ec
sub eax, 1
je 0x4178ec
sub eax, 1
jne 0x41791f
push dword [edi + 0x148]
lea eax, [ecx*2 + 0x45ca08]
push 1
add eax, ecx
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
pop edi
ret

Function at 0x419f80
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x419f9a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x45ce8c
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x419fe3
test ebp, ebp
je 0x419fd4
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x41a009
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a009
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x41a0bf
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a026
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41a0b5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41a0b5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a058
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a070
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x41a080
test ebp, ebp
je 0x41a0ac
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x469004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x469004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret