joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449e4d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
cmp dword [0x512790], 0
jne 0x449e6c
cmp dword [0x512794], 0
je 0x449fa2
mov eax, dword [ebp + 8]
cmp eax, dword [0x512584]
jg 0x449fa2
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x51255c
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x400
mov esi, 0x513800
push esi
push dword [ebp + 0xc]
call fcn.004297a2
lea eax, [ebp + 0x10]
push eax
push esi
mov esi, 0x513000
push esi
call dword [sym.imp.USER32.dll_wvsprintfW]
cmp eax, 0x3b0
jle 0x449ec5
xor eax, eax
mov word [0x513760], ax
test byte [0x512ff8], 1
jne 0x449ee5
or dword [0x512ff8], 1
call fcn.00429942
mov dword [0x512ff0], eax
mov dword [0x512ff4], edx
call fcn.00429942
mov edi, eax
lea eax, [ebp - 0x24]
push eax
mov ebx, edx
push ebx
push edi
push dword [0x512ff4]
push dword [0x512ff0]
call fcn.00429977
lea eax, [ebp - 0xa4]
push eax
mov dword [0x512ff0], edi
mov dword [0x512ff4], ebx
call fcn.00449bfb
push esi
push dword [ebp + 8]
xor ebx, ebx
push ebx
call fcn.00449cb3
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xa4]
push eax
push str._s___s___s___i___s_r_n
mov esi, 0x5127f0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, eax
add esp, 0x1c
cmp edi, ebx
jle 0x449f8b
cmp dword [0x512794], ebx
je 0x449f5e
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x512790], ebx
je 0x449f8b
cmp edi, 0x400
jne 0x449f80
push 0xd
pop eax
push 0xa
mov word [0x512fec], ax
pop eax
mov word [0x512fee], ax
push esi
push 0x512588
call fcn.00449d35
push 0x51255c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44a076
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [0x514000], esi
je 0x44a0b2
push str.CreateLogFile
push 0x291
push str..LogFile.cpp
push str.INT3_in__S_line__u__function__S
push 1
call fcn.00449e4d
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44a1bb
push ebx
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
inc ebx
push ebx
push str.D:_A_OICI_GA___WD_
mov dword [0x514000], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
cmp eax, esi
je 0x44a119
cmp dword [ebp - 4], esi
je 0x44a0ed
cmp dword [ebp - 0xc], esi
je 0x44a0ed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
cmp eax, esi
je 0x44a119
mov eax, dword [ebp - 4]
mov dword [0x512518], 0xc
mov dword [0x51251c], eax
mov dword [0x512520], esi
mov dword [0x512524], 0x512518
mov dword [0x512528], ebx
mov dword [ebp - 8], esi
push esi
push esi
push 2
push dword [0x512524]
push 3
push 0x40000000
push 0x512588
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44a15d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x44a18c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x64
jl 0x44a11c
jmp 0x44a18c
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 2
lea eax, [ebp - 8]
push eax
push 0x9c040
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
lea eax, [ebp - 0x14]
push eax
push 2
push 0x47be14
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x44a1a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44a1b3
cmp dword [0x512794], esi
je 0x44a1b3
push str.UsbTreeView:_error_creating_the_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov dword [0x514000], esi
pop ebx
pop esi
leave
ret
Function at 0x44a1be
Capabilities:
Check if file exists
Create thread
Delete file
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
push 0x51255c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
cmp dword [0x512790], ebx
je 0x44a30b
cmp word [0x512588], bx
je 0x44a30b
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, 0x512588
push esi
lea eax, [ebp - 0x210]
push eax
call edi
push 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push esi
call fcn.00426c66
test eax, eax
je 0x44a286
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44a286
push 0x2e
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov ebx, eax
test ebx, ebx
je 0x44a284
xor eax, eax
mov word [ebx], ax
push esi
lea eax, [ebp - 0x620]
push eax
call edi
add ebx, 2
push ebx
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x620]
push eax
push str._s__u._s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
xor ebx, ebx
cmp dword [0x512790], ebx
je 0x44a2d6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44a29f
call fcn.0044a076
cmp dword [0x512798], ebx
je 0x44a2d6
mov al, byte [0x512588]
push ebx
mov esi, str..X:
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
push ebx
push 3
movsw word es:[edi], word [esi]
push ebx
push 3
movsb byte es:[edi], byte [esi]
mov byte [ebp - 4], al
push 0xc0000000
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x49ef84], eax
pop edi
pop esi
cmp dword [0x512548], ebx
jne 0x44a30b
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x512548], eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x449fa4
push ebx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x512544], eax
mov dword [0x51279c], 1
pop ebx
leave
ret

Function at 0x44bd44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push 0x5c
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
jne 0x44bd64
mov esi, dword [ebp + 8]
push str.api_ms_win_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, esi
jne 0x44bd79
xor eax, eax
inc eax
jmp 0x44bdc2
push 0x104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x44bdc0
test esi, esi
je 0x44bdc0
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push 0x44f22c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call fcn.00426c66
test eax, eax
jne 0x44bd74
xor eax, eax
pop esi
leave
ret 4
Function at 0x44bdc7
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x6a8
push esi
push edi
mov esi, str.psapi.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x44be19
push esi
call fcn.00427c78
mov edi, eax
test edi, edi
jne 0x44be19
cmp dword [0x505628], 0x500
jbe 0x44be12
push 0x10
push dword [0x49daa4]
push str.Error:_psapi.dll_not_loaded
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x44bfbc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.EnumProcessModules
push edi
call esi
push str.GetModuleFileNameExW
push edi
mov ebx, eax
call esi
xor esi, esi
mov dword [ebp + 0x68], eax
cmp ebx, esi
je 0x44bfa7
cmp eax, esi
je 0x44bfa7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 0x74], eax
cmp eax, esi
je 0x44bfb9
push 0x18c
xor edi, edi
lea eax, [ebp - 0x42c]
push esi
inc edi
push eax
mov dword [ebp + 0x6c], edi
mov dword [ebp - 0x430], esi
call fcn.00444396
add esp, 0xc
push 0x40
lea eax, [ebp - 0x2a0]
push eax
mov dword [ebp + 0x70], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x40
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x70]
push eax
push 0x190
lea eax, [ebp - 0x430]
push eax
push dword [ebp + 0x74]
call ebx
test eax, eax
je 0x44bf99
mov esi, dword [ebp + 0x70]
shr esi, 2
cmp esi, edi
jle 0x44bf99
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp + edi*4 - 0x430]
push dword [ebp + 0x74]
call dword [ebp + 0x68]
test eax, eax
je 0x44bf2b
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x220]
push eax
call ebx
lea ecx, [ebp - 0x220]
cmp ecx, eax
je 0x44bf2b
lea eax, [ebp - 0x18]
push eax
mov eax, ecx
push eax
call ebx
lea ecx, [ebp - 0x220]
cmp ecx, eax
je 0x44bf2b
mov eax, ecx
push eax
call fcn.0044bd44
test eax, eax
jne 0x44bf32
inc edi
cmp edi, esi
jl 0x44bed5
jmp 0x44bf99
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44bf59
test al, 6
je 0x44bf59
and eax, 0xfffffff9
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x630]
push str.ERROR:_System_DLL_was_not_loaded_from__S:_r_n_r_n_S_r_n_r_nProbably_it_is_Malware_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push dword [0x49daa4]
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
and dword [ebp + 0x6c], 0
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x6c]
jmp 0x44bfbb
push esi
push 0x47d010
push 0x47d00c
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x44c156
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov ebx, 0x5057c0
push ebx
lea eax, [ebp - 0x664]
push str.__s.dll
push eax
call esi
and dword [ebp - 0x254], 0
push 0x24c
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.00444396
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esp, 0x18
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x44c1ea
push ebx
lea eax, [ebp - 0x664]
push str._s.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x44c1ea
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
test byte [ebp - 0x254], 0x10
jne 0x44c234
lea eax, [ebp - 0x228]
push eax
call fcn.0044bd44
test eax, eax
je 0x44c213
lea eax, [ebp - 0x228]
push eax
call fcn.0044bfc3
test eax, eax
je 0x44c24c
cmp word [ebp - 0x20], 0
je 0x44c234
lea eax, [ebp - 0x20]
push eax
call fcn.0044bd44
test eax, eax
je 0x44c234
lea eax, [ebp - 0x20]
push eax
call fcn.0044bfc3
test eax, eax
je 0x44c26d
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44c1ea
xor esi, esi
jmp 0x44c27d
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x44c1e3
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x44c1e3

Function at 0x44c28d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0x810
cmp dword [0x505c1c], eax
je 0x44c2a3
inc eax
leave
ret
push esi
push edi
mov edi, 0x206
push edi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push 0
push eax
call fcn.00444396
add esp, 0xc
push 0x5052d8
mov esi, 0x5057c0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x44c37b
lea eax, [ebp - 0x410]
push eax
call fcn.0044c156
test eax, eax
je 0x44c37b
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x810]
push str.Suspicious_System_DLL___S__found_in_UsbTreeViews_folder____abort_for_safety
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
push edi
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.00444396
add esp, 0x18
push 0x104
lea eax, [ebp - 0x208]
push eax
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, esi
jne 0x44c35e
push str._n_nHint:_Starting_applications_from_TEMP_folder_is_risky.
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10
push 0x4530e0
lea eax, [ebp - 0x810]
push eax
push dword [0x505c28]
call fcn.0044b4ea
xor eax, eax
jmp 0x44c37e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0xf5b45a4
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2c7723e2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4496a3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4537b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00402bb0
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.00417de0
lea ecx, [esi + 0x1e58]
mov byte [esp + 0x18], 1
call fcn.0042c330
mov eax, dword [esp + 0x20]
mov dword [esi + 0x28], eax
mov byte [esi + 0x1e54], bl
mov byte [esi + 0x1e55], bl
mov dword [esi + 0x1e40], ebx
mov dword [esi + 0x1e48], ebx
mov dword [esi + 0x1e4c], ebx
mov dword [esi + 0x1e50], ebx
mov dword [esi + 0x1eb4], esi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x412910
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x459314], 0
jne 0x41291e
call fcn.00412880
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x41294d
test dl, 7
je 0x41294d
movzx ecx, byte [edx]
movzx edi, al
xor ecx, edi
shr eax, 8
xor eax, dword [ecx*4 + 0x459310]
dec esi
inc edx
test esi, esi
ja 0x412930
cmp esi, 8
jb 0x4129dc
mov edi, esi
shr edi, 3
jmp 0x412960
xor eax, dword [edx]
add edx, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x459310]
sub esi, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x459310]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x459310]
mov ecx, eax
movzx eax, cl
mov eax, dword [eax*4 + 0x459310]
xor eax, dword [edx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x459310]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x459310]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x459310]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x459310]
sub edi, 1
jne 0x412960
xor ecx, ecx
test esi, esi
jbe 0x4129fc
push ebx
movzx edi, byte [ecx + edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x459310]
inc ecx
cmp ecx, esi
jb 0x4129e3
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x412a90
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [esp + 4]
inc eax
mov edx, 4
push esi
jmp 0x412aa0
movzx esi, byte [eax - 1]
mov esi, dword [esi*4 + 0x459310]
xor dword [ecx + 0x204], esi
movzx esi, byte [eax]
mov esi, dword [esi*4 + 0x459310]
xor dword [ecx + 0x208], esi
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x459310]
xor dword [ecx + 0x20c], esi
movzx esi, byte [eax + 2]
mov esi, dword [esi*4 + 0x459310]
xor dword [ecx + 0x210], esi
add eax, 4
sub edx, 1
jne 0x412aa0
pop esi
ret 4

Function at 0x412af0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
mov esi, ecx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412b00
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.00412910
mov word [esi + 0x214], ax
shr eax, 0x10
xor ecx, ecx
mov word [esi + 0x216], ax
xor eax, eax
mov word [esi + 0x21a], ax
mov word [esi + 0x218], cx
mov byte [esi + 0x21e], cl
mov byte [esi + 0x21d], cl
mov byte [esi + 0x21c], cl
mov al, byte [edi]
test al, al
je 0x412ba6
lea ecx, [ecx]
add byte [esi + 0x21c], al
xor byte [esi + 0x21d], al
mov dl, byte [esi + 0x21e]
add dl, al
rol dl, 1
movzx ecx, al
mov byte [esi + 0x21e], dl
mov dx, word [ecx*4 + 0x459310]
xor dx, word [esi + 0x218]
movzx ax, al
xor dx, ax
mov word [esi + 0x218], dx
mov cx, word [ecx*4 + 0x459312]
add cx, ax
add word [esi + 0x21a], cx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x412b50
pop edi
pop esi
ret 4
Function at 0x412c90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, ecx
test edi, edi
je 0x412d4a
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x412cb0
mov ecx, 0x1234
add word [eax + 0x214], cx
movzx ecx, word [eax + 0x214]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [edx*4 + 0x459310]
xor word [eax + 0x216], dx
mov bx, word [eax + 0x21a]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [edx*4 + 0x459312]
sub word [eax + 0x218], dx
movzx edx, word [eax + 0x218]
xor edx, ecx
mov word [eax + 0x214], dx
mov edx, 1
mov ecx, edx
dec edi
ror bx, cl
inc esi
xor bx, word [eax + 0x216]
ror bx, cl
movzx ecx, bx
xor word [eax + 0x214], cx
mov word [eax + 0x21a], cx
movzx ecx, word [eax + 0x214]
shr ecx, 8
xor byte [esi - 1], cl
test edi, edi
jne 0x412cb0
pop esi
pop ebx
pop edi
ret 8
Function at 0x413db0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov edx, dword [esi]
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
cmp eax, edx
jbe 0x413e18
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp edx, ecx
jb 0x413df4
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
lea ebx, [ebx]
mov ebp, dword [edx + eax]
xor ebp, dword [eax]
inc ecx
mov dword [ebx + eax], ebp
add eax, 4
cmp ecx, dword [esi]
jbe 0x413de0
mov ebx, dword [esp + 0x14]
mov eax, dword [edi]
sub eax, dword [esi]
lea edx, [edi + ecx*4]
add eax, eax
add eax, eax
push eax
push edx
lea eax, [ebx + ecx*4]
push eax
call fcn.0043e4c0
mov ecx, dword [edi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], ecx
pop ebx
ret 0xc
jae 0x413e68
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp eax, ecx
jb 0x413e44
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
mov ebp, dword [eax + edx]
xor ebp, dword [eax]
inc ecx
mov dword [eax + ebx], ebp
add eax, 4
cmp ecx, dword [edi]
jbe 0x413e30
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
sub edx, dword [edi]
lea eax, [esi + ecx*4]
add edx, edx
add edx, edx
push edx
push eax
lea ecx, [ebx + ecx*4]
push ecx
call fcn.0043e4c0
mov edx, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], edx
pop ebx
ret 0xc
test eax, eax
jbe 0x413e82
mov edx, edi
lea ecx, [esi + eax*4]
sub edx, esi
mov ebx, dword [ecx + edx]
xor ebx, dword [ecx]
jne 0x413e82
dec eax
sub ecx, 4
test eax, eax
ja 0x413e73
mov edx, dword [esp + 0x14]
mov dword [edx], eax
test eax, eax
jbe 0x413ea3
sub edi, esi
lea ecx, [esi + eax*4]
sub edx, esi
mov esi, dword [ecx + edi]
xor esi, dword [ecx]
dec eax
mov dword [ecx + edx], esi
sub ecx, 4
test eax, eax
ja 0x413e93
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x413eb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebp
push esi
mov esi, dword [esp + 0x5c]
cmp dword [esi], 0
je 0x413fda
mov ebp, dword [esp + 0x60]
mov eax, dword [ebp]
test eax, eax
je 0x413fda
mov ecx, ebp
lea edx, [esp + 8]
sub ecx, edx
push edi
lea ebx, [ebx]
mov edi, dword [0x4599c4]
lea edx, [ecx + eax*4]
sub eax, 1
mov edx, dword [esp + edx + 0xc]
mov edx, dword [edi + edx*4]
mov dword [esp + eax*4 + 0x10], edx
jne 0x413ee0
mov edi, dword [esp + 0x5c]
push ebx
push 0x90
push eax
push edi
call fcn.0043e830
mov ebx, dword [esi]
add esp, 0xc
test ebx, ebx
je 0x413f87
mov ebp, dword [0x4599c0]
lea esp, [esp]
mov eax, dword [esi + ebx*4]
mov ecx, dword [0x4599c4]
mov esi, dword [ecx + eax*4]
cmp esi, 0x7fff
je 0x413f7a
mov edx, dword [esp + 0x68]
mov eax, dword [edx]
test eax, eax
je 0x413f7a
lea ecx, [ebx + eax]
lea edx, [edi + ecx*4 - 4]
jmp 0x413f50
mov ecx, dword [esp + eax*4 + 0x10]
cmp ecx, 0x7fff
je 0x413f72
add ecx, esi
cmp ecx, 0x7fff
jb 0x413f6c
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
dec eax
sub edx, 4
test eax, eax
jne 0x413f50
sub ebx, 1
mov esi, dword [esp + 0x64]
jne 0x413f20
mov ebp, dword [esp + 0x68]
mov edx, dword [esi]
mov eax, dword [ebp]
lea ecx, [edx + eax - 1]
cmp ecx, 0x11
mov dword [edi], ecx
pop ebx
jle 0x413fb7
lea eax, [edi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
nop
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], 0
sub eax, 4
sub edx, 1
jne 0x413fa0
cmp dword [edi], 0x11
jbe 0x413fd1
mov dword [edi], 0x11
mov eax, dword [edi]
cmp dword [edi + eax*4], 0
jne 0x413fd1
dec eax
mov dword [edi], eax
test eax, eax
jne 0x413fc2
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov ecx, dword [esp + 0x58]
pop esi
mov dword [ecx], 0
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x4162c0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp edi, 0xff
jne 0x4162d6
cmp byte [esi + 8], 0
je 0x41632e
mov eax, edi
sub eax, 1
je 0x4162e9
sub eax, 1
je 0x416314
sub eax, 0xfd
jne 0x4162f2
cmp dword [0x45d404], 0
jne 0x4162f8
mov dword [0x45d404], edi
inc dword [0x45d408]
call fcn.0041a970
cmp byte [esi + 0xa], 0
je 0x41630e
call fcn.00435970
push edi
call fcn.0043fdf9
mov eax, dword [0x45d404]
test eax, eax
je 0x416322
cmp eax, 1
jne 0x4162f8
mov dword [0x45d404], 2
jmp 0x4162f8
pop edi
pop esi
ret 4

Function at 0x416420
Capabilities:
Terminate process

Disassembly:
cmp byte [0x4599cc], 0
push esi
mov esi, ecx
jne 0x41644e
mov eax, dword [esp + 8]
push eax
push 0xce4
call fcn.00430730
push eax
push 0
push esi
call fcn.00416180
add esp, 0x10
mov ecx, esi
call fcn.00416340
mov eax, dword [0x45d404]
test eax, eax
je 0x41645c
cmp eax, 1
jne 0x416466
mov dword [0x45d404], 2
inc dword [0x45d408]
call fcn.0041a970
cmp byte [esi + 0xa], 0
pop esi
je 0x41647d
call fcn.00435970
push 2
call fcn.0043fdf9
int3

Function at 0x416490
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
call fcn.00416340
mov eax, dword [esp + 8]
push eax
push 0xe5a
call fcn.00430730
push eax
push 0
push esi
call fcn.00416180
inc dword [0x45d408]
add esp, 0x10
mov dword [0x45d404], 5
call fcn.0041a970
cmp byte [esi + 0xa], 0
pop esi
je 0x4164d4
call fcn.00435970
push 5
call fcn.0043fdf9
int3

Function at 0x4164e0
Capabilities:
Terminate process

Disassembly:
cmp byte [0x4599cc], 0
push esi
mov esi, ecx
jne 0x41650e
mov eax, dword [esp + 8]
push eax
push 0xce2
call fcn.00430730
push eax
push 0
push esi
call fcn.00416180
add esp, 0x10
mov ecx, esi
call fcn.00416340
mov eax, dword [0x45d404]
test eax, eax
je 0x41651c
cmp eax, 1
jne 0x416526
mov dword [0x45d404], 2
inc dword [0x45d408]
call fcn.0041a970
cmp byte [esi + 0xa], 0
pop esi
je 0x41653d
call fcn.00435970
push 2
call fcn.0043fdf9
int3