joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421740
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 8
call fcn.00468d20
mov eax, dword [esp + 0xc]
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4217a6
cmp dword [0x584064], 0
mov eax, 0x4e20bc
jne 0x421782
mov eax, str.File_opening_error.
push 0x30
push 0x4e01e0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x4e2070
call fcn.0041a5a0
add esp, 4
xor al, al
pop esi
add esp, 8
ret
push edi
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 8], 0
mov ecx, dword [esp + 0x20]
mov edi, eax
mov eax, dword [esp + 0x1c]
jne 0x421880
lea edx, [eax + ecx]
cmp edi, edx
jae 0x421823
cmp dword [0x584064], 0
mov eax, 0x4e2040
jne 0x4217e2
mov eax, str.File_is_too_small.
push 0x30
push 0x4e01e0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x4e1fdc
push 0x584090
mov edx, 0x400
call fcn.00463e10
push 0x584090
call fcn.0041a5a0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 8
ret
mov edx, edi
sub edx, eax
test dl, 0xf
je 0x421880
cmp dword [0x584064], 0
mov eax, 0x4e1fa0
jne 0x42183f
mov eax, str.File_is_not_suitable_for_bruteforcing.
push 0x30
push 0x4e01e0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push str.Probably_file_isnt_a_doc_file__by_size_:_0x_X_bytes_n
push 0x584090
mov edx, 0x400
call fcn.00463e10
push 0x584090
call fcn.0041a5a0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 8
ret
push ebx
lea edi, [eax + ecx]
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
pop ebx
je 0x421878
cmp dword [esp + 0xc], edi
pop edi
sete al
pop esi
add esp, 8
ret

Function at 0x4218c0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [esp + 4]
movzx eax, byte [edx]
push ebx
lea ecx, [eax + 1]
push ebp
shl eax, 0x18
shl ecx, 0x18
mov ebp, eax
push esi
push edi
mov dword [esp + 0x14], ecx
cmp ebp, ecx
ja 0x421934
mov edi, dword [esp + 0x1c]
mov esi, ebp
imul esi, esi, 0x8088405
inc esi
jmp 0x4218f0
mov ecx, 1
cmp edi, ecx
mov eax, esi
jle 0x421916
jmp 0x421900
mov ebx, eax
shr ebx, 0x18
cmp bl, byte [ecx + edx]
jne 0x421927
imul eax, eax, 0x8088405
inc ecx
inc eax
cmp ecx, edi
jl 0x421900
mov eax, dword [esp + 0x18]
test eax, eax
je 0x421920
mov dword [eax], ebp
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
inc ebp
add esi, 0x8088405
cmp ebp, dword [esp + 0x14]
jbe 0x4218f0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x422500
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], ecx
mov dword [eax + 0x54], ecx
ret
Function at 0x424750
Capabilities:
Read file on windows

Disassembly:
mov eax, 8
call fcn.00468d20
mov eax, dword [esp + 0x10]
push esi
mov esi, ecx
push 0
mov ecx, eax
lea edx, [esp + 8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
push edx
sar ecx, 0x1f
mov ecx, dword [esi]
push eax
push ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x424791
xor al, al
pop esi
add esp, 8
ret 0x14
push ebx
mov ebx, dword [esp + 0x24]
mov edx, ebx
sar edx, 0x1f
push edi
test ebx, ebx
jne 0x4247e7
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esi]
push ebx
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4247ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
xor al, al
pop esi
add esp, 8
ret 0x14
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, edi
jne 0x4247c3
cmp ecx, ebx
jne 0x4247c3
pop edi
pop ebx
mov al, 1
pop esi
add esp, 8
ret 0x14
mov eax, dword [esp + 0x24]
mov edi, eax
or eax, ebx
push ebp
mov ebp, dword [esp + 0x24]
je 0x42483a
test ebx, ebx
jl 0x42480b
jg 0x424804
cmp edi, 0xfffffff
jbe 0x42480b
mov esi, 0xfffffff
jmp 0x42480d
mov esi, edi
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push 0
lea eax, [esp + 0x20]
push eax
push esi
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x424846
cmp dword [esp + 0x1c], esi
jne 0x424846
add ebp, esi
sub edi, esi
sbb ebx, 0
mov eax, edi
or eax, ebx
jne 0x4247f6
pop ebp
pop edi
pop ebx
mov al, 1
pop esi
add esp, 8
ret 0x14
pop ebp
pop edi
pop ebx
xor al, al
pop esi
add esp, 8
ret 0x14

Function at 0x424860
Capabilities:
Write file on windows

Disassembly:
mov eax, 4
call fcn.00468d20
mov eax, dword [esp + 0xc]
push ebp
mov ebp, ecx
push 0
mov ecx, eax
lea edx, [esp + 8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
push edx
sar ecx, 0x1f
mov ecx, dword [ebp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42489c
xor al, al
pop ebp
pop ecx
ret 0x14
push ebx
mov ebx, dword [esp + 0x20]
mov edx, ebx
sar edx, 0x1f
push esi
test ebx, ebx
jne 0x4248e0
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ebp]
push ebx
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4248d2
pop esi
pop ebx
xor al, al
pop ebp
pop ecx
ret 0x14
cmp dword [esp + 0x14], esi
pop esi
pop ebx
sete al
pop ebp
pop ecx
ret 0x14
mov eax, dword [esp + 0x20]
push edi
mov edi, eax
or eax, ebx
je 0x424933
jmp 0x4248f0
test ebx, ebx
jl 0x424905
jg 0x4248fe
cmp edi, 0xfffffff
jbe 0x424905
mov esi, 0xfffffff
jmp 0x424907
mov esi, edi
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42493d
cmp dword [esp + 0x18], esi
jne 0x42493d
sub edi, esi
sbb ebx, 0
mov eax, edi
or eax, ebx
jne 0x4248f0
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
pop ecx
ret 0x14
pop edi
pop esi
pop ebx
xor al, al
pop ebp
pop ecx
ret 0x14
Function at 0x424be0
Capabilities:
Get file size

Disassembly:
mov eax, 4
call fcn.00468d20
mov ecx, dword [ecx]
push esi
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
mov esi, eax
call fcn.0046a720
xor ecx, ecx
add eax, esi
adc edx, ecx
pop esi
pop ecx
ret

Function at 0x424c20
Capabilities:
Get file size

Disassembly:
mov eax, 4
call fcn.00468d20
push esi
push edi
mov esi, ecx
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 8]
push 1
push 0
push 0
push edx
mov edi, eax
call fcn.0046a720
xor ecx, ecx
add eax, edi
adc edx, ecx
sub eax, dword [esp + 0x10]
push 0
sbb edx, dword [esp + 0x18]
mov ecx, edx
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esi]
push eax
sar ecx, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
pop ecx
ret 8

Function at 0x424ce0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x424cf7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
cmp byte [esi + 0x20], 0
je 0x424d12
cmp dword [esi + 0x1c], 8
jb 0x424d08
mov eax, dword [esi + 8]
jmp 0x424d0b
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x1c], 8
jb 0x424d24
mov eax, dword [esi + 8]
push eax
call fcn.004699ce
add esp, 4
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
xor ecx, ecx
mov word [esi + 8], cx
pop esi
ret
Function at 0x424e70
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov eax, 0x24
call fcn.00468d20
mov eax, dword [esp + 0x28]
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x424ea6
mov eax, 0xc0000123
pop esi
add esp, 0x24
ret
push ebx
push edi
lea ecx, [esp + 0xc]
xor eax, eax
push ecx
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov edi, eax
call ebx
test edi, edi
jne 0x424eea
pop edi
pop ebx
mov eax, 0xc0000087
pop esi
add esp, 0x24
ret
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov esi, eax
call ebx
test esi, esi
jne 0x424f0e
pop edi
pop ebx
mov eax, 0xc0000040
pop esi
add esp, 0x24
ret
push 0x1c
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x424f50
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x20]
xor eax, eax
cmp eax, ecx
jl 0x424f50
mov edx, dword [esp + 0xc]
jg 0x424f38
cmp edi, edx
jb 0x424f50
mov eax, dword [esp + 0x38]
mov dword [eax], esi
mov eax, dword [esp + 0x3c]
pop edi
pop ebx
mov dword [eax], edx
mov dword [eax + 4], ecx
xor eax, eax
pop esi
add esp, 0x24
ret
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop ebx
mov eax, 0xc000004e
pop esi
add esp, 0x24
ret
Function at 0x42ba10
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov eax, 0x90
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push esi
mov esi, dword [esp + 0x9c]
push edi
push 0
push 0x80
lea eax, [esp + 0x20]
mov edi, ecx
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x80
call fcn.00424be0
sub eax, 0x84
sbb edx, 0
push edx
push eax
mov ecx, esi
call fcn.00424750
mov eax, dword [edi + 0x28]
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 1
push 0
push eax
call ebx
test eax, eax
je 0x42bada
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [edi + 0x24]
push 0
push 0
push edx
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov ecx, esi
test eax, eax
je 0x42badc
call fcn.00424be0
sub eax, 0x84
cmp eax, 0x500000
jbe 0x42bab9
mov eax, 0x500000
and eax, 0xffffffe0
push eax
mov dword [esp + 0x14], eax
call fcn.004691cd
mov edi, eax
add esp, 4
test edi, edi
jne 0x42bae3
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, esi
call fcn.0043a470
jmp 0x42bb56
mov eax, dword [esp + 0x10]
push 0
push eax
push edi
push 0
push 0
mov ecx, esi
call fcn.00424750
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edi
push 0
push 0
push 0
push edx
call ebx
test eax, eax
jne 0x42bb21
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, esi
call fcn.0043a470
jmp 0x42bb4d
mov ecx, dword [esp + 0x10]
push 0
push ecx
push edi
push 0
push 0
mov ecx, esi
call fcn.00424860
push 0
push 0x84
mov ecx, esi
call fcn.00424c20
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push edi
call fcn.004690f0
add esp, 4
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x90
ret 8
Function at 0x42c3a0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4d7beb
mov eax, dword fs:[0]
push eax
mov eax, 0x12c
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
mov eax, ecx
mov ecx, dword [esp + 0x150]
xor esi, esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], vtable.dwcl::AES.0
mov edi, dword [eax + 0x44]
mov dword [esp + 0x148], esi
call fcn.00424be0
cmp edx, esi
jl 0x42c42d
jg 0x42c41f
cmp eax, edi
jb 0x42c42d
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x18], edi
jmp 0x42c440
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.00424be0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov edi, dword [esp + 0x24]
push 0
push 0x20
lea eax, [edi + 0x24]
push eax
lea ecx, [esp + 0x34]
call fcn.00401b90
cmp dword [esp + 0x1c], 0
jb 0x42c510
ja 0x42c46d
cmp dword [esp + 0x18], 0
jbe 0x42c510
push 0
push 0x10
lea ecx, [esp + 0x134]
push ecx
push ebp
push ebx
mov ecx, esi
call fcn.00424750
mov dl, byte [edi + 0x4a]
mov byte [esp + 0x17], dl
lea esp, [esp]
mov al, byte [edi + 0x49]
test al, al
je 0x42c4c4
xor ecx, ecx
lea esp, [esp]
xor byte [esp + ecx + 0x12c], al
xor byte [esp + ecx + 0x12d], al
xor byte [esp + ecx + 0x12e], al
xor byte [esp + ecx + 0x12f], al
add ecx, 4
cmp ecx, 0x10
jl 0x42c4a0
lea eax, [esp + 0x12c]
mov ecx, eax
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00401c20
add byte [esp + 0x17], 0xff
jne 0x42c490
push 0
push 0x10
lea edx, [esp + 0x134]
push edx
push ebp
push ebx
mov ecx, esi
call fcn.00424860
add ebx, 0x10
adc ebp, 0
cmp ebp, dword [esp + 0x1c]
jb 0x42c46d
ja 0x42c510
cmp ebx, dword [esp + 0x18]
jb 0x42c46d
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], vtable.dwcl::AbstractCipher.0
test eax, eax
je 0x42c531
push eax
call fcn.004690f0
add esp, 4
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x42c542
push eax
call fcn.004690f0
add esp, 4
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.004690b5
add esp, 0x138
ret 8
Function at 0x42cd00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4d82a8
mov eax, dword fs:[0]
push eax
mov eax, 0x20
call fcn.00468d20
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.0041c410
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42cd63
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0042c7f0
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.0041c410
cmp dword [esp + 0x28], 8
jb 0x42cdb0
mov eax, dword [esp + 0x14]
push eax
call fcn.004699ce
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x42e740
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4d7eeb
mov eax, dword fs:[0]
push eax
mov eax, 0x20f4
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x20f0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x2108]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2118]
mov ebx, ecx
lea ecx, [esp + 0x24]
xor edi, edi
xor esi, esi
call fcn.00403ce0
push esi
push 0x18
lea eax, [ebx + 0x24]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x211c], esi
call fcn.004014d0
cmp dword [esp + 0x30], esi
jne 0x42e7cb
mov edx, dword [esp + 0x24]
mov eax, dword [edx]
lea ecx, [esp + 0x24]
call eax
push eax
call fcn.004691cd
add esp, 4
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x24]
mov eax, dword [edx]
lea ecx, [esp + 0x24]
call eax
mov ecx, dword [esp + 0x30]
push eax
add ebx, 0x3c
push ebx
push ecx
call fcn.00468d50
add esp, 0xc
mov ecx, ebp
call fcn.00424be0
mov ebx, eax
and eax, 0xfffffff0
mov ecx, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
test ecx, ecx
jb 0x42e866
ja 0x42e809
test eax, eax
jbe 0x42e866
push 0
push 0x10
lea edx, [esp + 0x20fc]
push edx
push esi
push edi
mov ecx, ebp
call fcn.00424750
push 0x10
lea eax, [esp + 0x20d8]
push eax
lea ecx, [esp + 0x20fc]
push ecx
lea ecx, [esp + 0x30]
call fcn.00401a30
push 0
push 0x10
lea edx, [esp + 0x20dc]
push edx
push esi
push edi
mov ecx, ebp
call fcn.00424860
add edi, 0x10
adc esi, 0
cmp esi, dword [esp + 0x18]
jb 0x42e809
ja 0x42e862
cmp edi, dword [esp + 0x1c]
jb 0x42e809
mov edx, dword [esp + 0x18]
cmp esi, edx
ja 0x42e8ef
jb 0x42e874
cmp edi, ebx
jae 0x42e8ef
lea eax, [esp + 0x20d4]
push eax
lea ecx, [esp + 0x20f8]
push ecx
lea ecx, [esp + 0x2c]
and bl, 0xf
call fcn.00404100
movzx eax, bl
mov dword [esp + 0x1c], eax
cdq
push edx
push eax
mov dword [esp + 0x20], edx
lea edx, [esp + 0x20ec]
push edx
push esi
push edi
mov ecx, ebp
mov dword [esp + 0x28], eax
call fcn.00424750
test bl, bl
jbe 0x42e8d4
mov ecx, dword [esp + 0x1c]
xor eax, eax
lea ecx, [ecx]
mov dl, byte [esp + eax + 0x20d4]
xor byte [esp + eax + 0x20e4], dl
inc eax
sub ecx, 1
jne 0x42e8c0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x20ec]
push edx
push esi
push edi
mov ecx, ebp
call fcn.00424860
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], vtable.dwcl::AbstractCipher.0
test eax, eax
je 0x42e910
push eax
call fcn.004690f0
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x42e921
push eax
call fcn.004690f0
add esp, 4
mov ecx, dword [esp + 0x2108]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20f0]
xor ecx, esp
call fcn.004690b5
add esp, 0x2100
ret 8
Function at 0x42ec60
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4d7f80
mov eax, dword fs:[0]
push eax
mov eax, 0x88
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov edx, dword [esp + 0xa4]
xor eax, eax
mov word [esp + 0x78], ax
mov eax, edx
mov dword [esp + 0xc], 0x4e463c
mov dword [esp + 0x10], str..docx
mov dword [esp + 0x14], str..xls
mov dword [esp + 0x18], str..xlsx
mov dword [esp + 0x1c], str..jpg
mov dword [esp + 0x20], str..jpeg
mov dword [esp + 0x24], str..png
mov dword [esp + 0x28], 0x4e4af4
mov dword [esp + 0x2c], str..dbf
mov dword [esp + 0x30], 0x4e4ae0
mov dword [esp + 0x34], str..pdf
mov dword [esp + 0x38], str..mxl
mov dword [esp + 0x3c], str..epf
mov dword [esp + 0x40], str..erf
mov dword [esp + 0x44], str..geo
mov dword [esp + 0x48], 0x4e4a9c
mov dword [esp + 0x4c], str..xml
mov dword [esp + 0x50], str..xsd
mov dword [esp + 0x54], str..txt
mov dword [esp + 0x8c], 7
mov dword [esp + 0x88], 0
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ed60
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x7c]
call fcn.0041c510
push 1
push 0xffffffffffffffff
push 0x4e174c
lea ecx, [esp + 0x80]
mov dword [esp + 0xa8], 0
call fcn.0041b940
push 0xffffffffffffffff
inc eax
push eax
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x80]
call fcn.0041c930
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xa8], 1
call fcn.0041c410
cmp dword [esp + 0x70], 8
jb 0x42eddc
mov edx, dword [esp + 0x5c]
push edx
call fcn.004699ce
add esp, 4
xor edi, edi
mov edi, edi
mov edx, dword [esp + edi*4 + 0xc]
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42edf0
sub eax, esi
sar eax, 1
push eax
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x80]
call fcn.0041b940
cmp eax, 0xffffffff
jne 0x42ee5b
inc edi
cmp edi, 0x13
jb 0x42ede0
cmp dword [esp + 0x8c], 8
jb 0x42ee31
mov ecx, dword [esp + 0x78]
push ecx
call fcn.004699ce
add esp, 4
xor al, al
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004690b5
add esp, 0x94
ret 4
cmp dword [esp + 0x8c], 8
jb 0x42ee72
mov eax, dword [esp + 0x78]
push eax
call fcn.004699ce
add esp, 4
mov al, 1
jmp 0x42ee33
Function at 0x42f470
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1c
call fcn.00468d20
mov eax, dword [esp + 0x24]
mov eax, dword [eax*4 + 0x528d2c]
mov edx, dword [eax + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
xor esi, esi
push edi
mov edi, dword [eax]
mov dword [esp + 0x10], edx
test edx, edx
jbe 0x42f4c6
lea esp, [esp]
xor ebx, ebx
push ebx
push esi
mov ecx, ebp
call fcn.00424950
xor al, byte [esi + edi]
movzx ecx, al
push ecx
push ebx
push esi
mov ecx, ebp
call fcn.00424980
inc esi
cmp esi, dword [esp + 0x10]
jb 0x42f4a0
mov edx, dword [esp + 0x10]
cmp byte [esp + 0x38], 1
mov byte [esp + 0x34], 1
jbe 0x42f594
mov eax, dword [esp + 0x3c]
mov ecx, eax
neg ecx
sub edi, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edi
lea esp, [esp]
mov ecx, eax
mov esi, eax
neg ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], ecx
mov ebx, edi
mov dword [esp + 0x18], 2
test edx, edx
jbe 0x42f559
mov dword [esp + 0x30], edx
xor edi, edi
push edi
push esi
mov ecx, ebp
call fcn.00424950
xor al, byte [ebx + esi]
mov ecx, ebp
movzx edx, al
push edx
push edi
push esi
call fcn.00424980
push edi
push esi
mov ecx, ebp
call fcn.00424950
xor al, byte [esp + 0x34]
mov ecx, ebp
movzx eax, al
push eax
push edi
push esi
call fcn.00424980
inc esi
sub dword [esp + 0x30], 1
jne 0x42f510
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
add esi, eax
add ebx, ecx
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], esi
jne 0x42f508
mov cl, byte [esp + 0x34]
mov edi, dword [esp + 0x20]
add eax, dword [esp + 0x3c]
add edi, dword [esp + 0x28]
inc cl
mov byte [esp + 0x34], cl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
cmp cl, byte [esp + 0x38]
jb 0x42f4f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10

Function at 0x4314a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d7fc3
mov eax, dword fs:[0]
push eax
mov eax, 4
call fcn.00468d20
push ebx
push esi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov eax, 7
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], ebx
xor ecx, ecx
mov word [esi + 8], cx
mov byte [esi + 0x20], bl
lea ecx, [esi + 0x34]
mov dword [esi], vtable.Decryptor102.0
xor edx, edx
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x18], ebx
mov word [ecx + 4], dx
mov byte [esp + 0x18], 1
mov byte [esi + 0x24], 0x4e
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 0x200
call fcn.0041c620
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
cmp dword [0x56d238], ebx
je 0x43153f
lea ecx, [ecx]
inc dword [esi + 0x50]
mov eax, dword [esi + 0x50]
cmp dword [eax*4 + 0x56d238], ebx
jne 0x431530
mov dword [esi + 0x58], ebx
cmp dword [0x528d2c], ebx
je 0x43155f
lea ebx, [ebx]
inc dword [esi + 0x58]
mov ecx, dword [esi + 0x58]
cmp dword [ecx*4 + 0x528d2c], ebx
jne 0x431550
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret