joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f5d3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 4], eax
push 0xffff
push dword [0x4e9694]
xchg esi, eax
dec esi
add bh, bh
xor eax, 0x4fb09a
call fcn.00402d7b
push 6
push 0xffff
push 0x463edf
push dword [0x4fb09a]
call fcn.00403008
jne 0x43f77d
mov eax, 1
mov dword [0x4692c4], eax
mov eax, 1
mov dword [0x4692c8], eax
mov eax, 1
push eax
call fcn.0042ebd2
mov eax, 0
mov dword [0x4692c4], eax
mov eax, 0
mov dword [0x4692c8], eax
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x43f67c
mov dword [0x468dce], 0xb8a
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
mul ecx
add eax, 0x4e975a
mov edi, eax
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub edx, edx
mov ecx, 0xb
cmp ecx, eax
je 0x43f6b8
mov ecx, 0x1d
cmp ecx, eax
je 0x43f6b8
mov ecx, 0x24
cmp ecx, eax
je 0x43f6b8
mov ecx, 0x14
cmp ecx, eax
jne 0x43f723
mov eax, dword [ebp + 8]
test eax, eax
je 0x43f71c
mov eax, dword [0x469140]
mov dword [0x468dd6], eax
push dword [0x4e969c]
call fcn.00402c93
push 0x463ee5
call fcn.00402c93
push dword [0x4e9698]
call fcn.00402c93
push 0x463eea
call fcn.00402c93
mov eax, 1
push eax
call fcn.0040713b
push eax
call fcn.00402c93
call fcn.00402ccc
mov eax, dword [0x468d68]
mov dword [0x468dd6], eax
call fcn.0040939e
jmp 0x43f721
call fcn.0043ec55
jmp 0x43f778
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, 8
sub edx, edx
cmp dword [esi], eax
jne 0x43f736
or edx, 1
mov dword [esi], edx
add esi, 4
mov eax, dword [0x4691d4]
mov dword [esi], eax
add esi, 4
mov eax, 0x10
sub esi, 4
sub edx, edx
cmp dword [esi], eax
jne 0x43f756
or edx, 1
sub esi, 4
and dword [esi], edx
je 0x43f76f
mov eax, 0x20
mov dword [0x4691d4], eax
mov eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0043e03c
jmp 0x43f864
call fcn.00401e33
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push 0x4617e5
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.004072c8
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
test eax, eax
je 0x43f85b
mov eax, dword [ebp + 8]
test eax, eax
je 0x43f854
call fcn.00401e33
mov dword [esi], 0x7530
mov eax, 0xb9a
add dword [esi], eax
push dword [esi]
push 0xffff
push str.PROC_FUNC_based_indirection_not_supported_for_STRINGS___use_____instead
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d5ff
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
call fcn.0043ec55
jmp 0x43f864
mov eax, dword [ebp + 8]
push eax
call fcn.0043e03c
invalid
Function at 0x441412
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push 0x1020
push 0x40
inc eax
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
loopne 0x441430
or byte [eax + eax], al
add byte [ecx + 0x805dc45], cl
add al, 0
invalid
mov dword [ebp - 0x28], eax
add eax, 0x408
mov dword [ebp - 0x2c], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 0x18], eax
sub eax, eax
mov dword [ebp - 4], eax
sub eax, eax
mov dword [ebp - 8], eax
sub eax, eax
mov dword [ebp - 0x14], eax
mov ebx, dword [0x4e9694]
movzx eax, byte [ebx]
cmp eax, 0x5e
jne 0x4415c7
mov eax, 1
mov dword [ebp - 0x18], eax
call fcn.0040939e
push 0xffff
add bh, bh
xor eax, 0x4e9694
push dword [0x4fb09a]
call fcn.00402d7b
push 6
push 0xffff
push 0x46483f
push dword [0x4fb09a]
call fcn.00403008
je 0x441506
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0x547
add eax, 0x6010000
push dword [esi]
push 0xffff
push str.can_only_use_pointers_to_VARiables
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d5ff
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
mov eax, 1
push eax
call fcn.0042ebd2
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x44152f
mov dword [0x468dce], 0x548
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
mul ecx
add eax, 0x4e975a
mov edi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub edx, edx
mov ecx, 6
cmp ecx, eax
je 0x44156b
mov ecx, 7
cmp ecx, eax
je 0x44156b
mov ecx, 8
cmp ecx, eax
je 0x44156b
mov ecx, 0xa
cmp ecx, eax
je 0x4415c7
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0x549
add dword [esi], eax
push dword [esi]
push 0xffff
push str.can_only_use_pointers_to_BYTEs__WORDs__DWORDs__or_FILEs
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d5ff
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
push 0xffff
push dword [0x4e9694]
invalid
invalid
invalid
mov al, 0x4f
Function at 0x44837c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0x1020
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
add eax, 0x408
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
mov dword [ebp - 0x14], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 4], eax
push 0x404
push dword [0x4e968c]
push dword [ebp - 0x14]
call fcn.00402d7b
push 0x404
push dword [0x4e9694]
push dword [ebp - 8]
call fcn.00402d7b
push 0xffff
push dword [ebp - 8]
push dword [0x4fb09a]
call fcn.00402d7b
push 6
push 0xffff
push str.WRITE
push dword [0x4fb09a]
call fcn.00403008
jne 0x448495
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0x749
add dword [esi], eax
push dword [esi]
push 0xffff
push 0x4658c8
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push dword [0x4e968c]
push dword [0x4fb09a]
call fcn.00402d7b
sti
invalid
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
lcall 0xde9b, 0xe8004fb0
sti
inc dword [ebx + 0xe8b04ee]
call fcn.0040939e
call fcn.00401e33
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push 0x4658ca
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
lcall 0x1000, 0x5004fb0
add byte [eax], al

Function at 0x449362
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0xc18
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
add al, 0
add byte [ecx + 0x805f045], cl
add al, 0
add byte [ecx + 0x805ec45], cl
add al, 0
add byte [eax], bh

Function at 0x449e9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push 0x1c38
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], eax
add eax, 0x408
mov dword [ebp - 0x28], eax
add eax, 0x408
mov dword [ebp - 0x2c], eax
add eax, 0x408
mov dword [ebp - 0x30], eax
add eax, 0x408
mov dword [ebp - 0x34], eax
add eax, 0x408
mov dword [ebp - 0x38], eax
Function at 0x44c22f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push 0xc20
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
add eax, 0x408
mov dword [ebp - 0x28], eax
add eax, 0x408
mov dword [ebp - 0x2c], eax
add eax, 0x408
mov dword [ebp - 0x30], eax
add eax, 8
mov eax, dword [0x4692d0]
push eax
call fcn.00405d4f
mov eax, dword [0x4692cc]
push eax
call fcn.00405d4f
mov eax, 0
mov dword [ebp - 8], eax
mov eax, 0
mov dword [ebp - 0x1c], eax
push 0x404
push dword [0x4e968c]
push dword [0x4e96e0]
call fcn.00402d7b
push 4
push dword [0x4e968c]
push dword [0x4e96e4]
call fcn.00402d7b
push 0x404
push dword [0x4e9698]
push dword [ebp - 0x24]
call fcn.00402d7b
mov eax, dword [0x469198]
mov dword [ebp - 4], eax
sub eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x44c2ed

Function at 0x44e3f2
Capabilities:
Write file on windows

Disassembly:
call fcn.0040939e
mov eax, 0
push eax
call fcn.0042ebd2
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x44e420
mov dword [0x468dce], 0x965
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48

Function at 0x44e96e
Capabilities:
Write file on windows

Disassembly:
call fcn.0040619a
push 0xffff
push eax
push dword [0x4fb09a]
call fcn.00402d7b
mov ebx, dword [0x4fb09a]
movzx eax, byte [ebx]
cmp eax, 0x3b
jne 0x44e997
call fcn.0040939e
mov eax, dword [0x4fdf3c]
push eax
call fcn.00405d4f
mov eax, 0
mov dword [0x4fdf3c], eax
mov eax, dword [0x4fdf38]
push eax
call fcn.00405d4f
add dword [0x4fdf38], 1
mov eax, dword [0x4fdf34]
cmp eax, dword [0x4fdf38]
jge 0x44e9e1
mov eax, dword [0x4fdf38]
mov dword [esi], eax
add esi, 4
sub esi, 4
mov eax, dword [esi]
mov dword [0x4fdf34], eax
jmp 0x44e9f2
add dword [0x4fdf34], 1
mov eax, dword [0x4fdf34]
mov dword [0x4fdf38], eax
mov eax, dword [0x469140]
mov dword [0x468dd6], eax
push dword [0x4e969c]
call fcn.00402c93
push str.__REPEAT
call fcn.00402c93
call fcn.00402ccc
mov eax, dword [0x468d68]
mov dword [0x468dd6], eax
call fcn.00404b21
or edx, 1
test edx, edx
je 0x44ea25
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0x98e
add dword [esi], eax
push dword [esi]
push 0xffff
push 0x466314
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]

Function at 0x44ee8c
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x4fdf30]
push eax
call fcn.00405d4f
mov eax, 0
mov dword [0x4fdf30], eax
mov eax, dword [0x4fdf2c]
push eax
call fcn.00405d4f
add dword [0x4fdf2c], 1
dec edi
add byte [ecx], al

Function at 0x44fadd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 0xc], eax
call fcn.0040939e

Function at 0x450558
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push 0xc18
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
add byte [ecx + 0x4589e045], cl
in al, dx
Function at 0x4518a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
call fcn.0040939e
sub eax, eax
mov dword [ebp - 4], eax
call fcn.00401e33
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push 0x466972
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.004072c8
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
and eax, 1
xor eax, 1
je 0x451984
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0xaf5
add dword [esi], eax
push dword [esi]
push 0xffff
push str.number_or_constant_identifier_expected
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d5ff
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
push 6
push 0xffff
add byte [eax], al
push 0x4669a5
push dword [0x4fb09a]
call fcn.00403008
jne 0x451aa8
mov eax, 1
mov dword [0x4692c8], eax
inc esi
add byte [eax], bh
push eax
invalid

Function at 0x451d9e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
sub eax, eax
mov dword [0x4691c0], eax
call fcn.0040939e

Function at 0x453da2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x810
push 0x40
invalid
invalid

Function at 0x45446b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0xc18
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
mov dword [ebp - 0x14], eax
add eax, 0x408
sub eax, eax
mov dword [0x4691d0], eax
cmp dword [0x4691ac], 1
jle 0x454530
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0xbc5
add byte [ecx], al
push es

Function at 0x4571ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
add byte [ecx + 0x4589f045], cl
hlt
add eax, 0x408
mov eax, dword [0x4691a8]
inc esi
add byte [ebx], bh
add eax, 0x4691e8

Function at 0x45768f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x810

Function at 0x457be1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x810
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0xceb
add dword [esi], eax
push dword [esi]
push 0xffff
inc dword [eax]
add byte [eax - 0x64], ch
jae 0x457c69
add bh, bh
xor eax, 0x4fb09a
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40a60b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40a61a
pop dword [ebp - 0xc]
mov eax, 0x41ee7d0a
sub eax, 0x41add6f0
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x3712d91d
sub dword [ebp - 0x1c], 0xe8c093d2
mov dword [ebp - 0x18], 0x62814f71
sub dword [ebp - 0x18], 0x304e032c
mov dword [ebp - 0x14], 0xfaa6a2a6
add dword [ebp - 0x14], 0x51a5a188
mov dword [ebp - 0x10], 0xf80c3866
add dword [ebp - 0x10], 0x7f3c79a
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x7abd00b3
add eax, 0x8583cfa1
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x2b105b8c
sub dword [ebp - 0x1c], 0xb69df236
mov dword [ebp - 0x18], 0x7c08e378
sub dword [ebp - 0x18], 0x3a9c8203
mov dword [ebp - 0x14], 0xc8eaeec8
sub dword [ebp - 0x14], 0x657b825c
mov dword [ebp - 0x10], 0xfe94c7e4
add dword [ebp - 0x10], 0x16b381c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x839b6a78
sub eax, 0x835a9a2c
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3b318
push 0
call eax
mov ecx, 0x2c886791
sub ecx, 0x2c881a46
mov esi, eax
mov edi, 0x41b000
add edi, dword [ebp - 0xc]
mov edx, 0x580a2d31
mov ebx, dword [edi]
add dword [ebp - 4], eax
xor ebx, edx
mov dword [ebp - 4], 0x93e06022
mov dword [esi], ebx
sub dword [ebp - 8], 0x30992efa
add esi, 4
add edi, 0xdbbd0256
add edi, 0x2442fdae
loop 0x40a730
add eax, 0x127ff
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xdfb88869
add ecx, 0x20877797
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4063fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406422
xor eax, eax
test eax, eax
je 0x406434
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406434
xor ecx, ecx
jmp 0x406437
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406523
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232c4], 0
push esi
jne 0x40655a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406534
mov dword [ecx*4 + 0x4232c0], eax
inc ecx
cmp ecx, 0x100
jl 0x40652f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40658b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232c0]
xor eax, esi
inc ecx
dec edx
jne 0x40656d
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43aef6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x43afa9
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x445072
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x445147
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x445147
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x445147
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x4450cd
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x445147
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x445112
test dl, dl
je 0x44510e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x445112
add ecx, 2
add eax, 2
test dl, dl
jne 0x4450f2
xor eax, eax
jmp 0x445117
sbb eax, eax
or eax, 1
test eax, eax
jne 0x445129
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x445134
inc esi
cmp esi, ebp
jae 0x445147
mov edx, dword [esp + 0x10]
jmp 0x4450e8
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x4453ab
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4453b6
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x4453ca
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4453ce
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x445407
cmp dword [edi + ecx], 0x4550
jne 0x445407
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x445407
test byte [edi + ecx + 0x16], 2
je 0x445407
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x44540c
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x445448
xor eax, eax
jmp 0x44542b
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x445451
inc edx
movzx eax, dx
cmp eax, edi
jl 0x44542b
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x445457
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x44548f
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x44549d
add edx, 0x20
cmp eax, edx
jne 0x4454ae
test bx, bx
je 0x4454e3
add esi, 2
add edi, 2
jmp 0x44547f
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x4454bc
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x4454ca
add edx, 0x20
sub ecx, edx
je 0x4454e3
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x445478
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x445528
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x4455e9
test ecx, ecx
je 0x4455e9
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x4455e9
test ebx, ebx
je 0x4455e9
mov ebx, eax
add ebx, edx
je 0x4455e9
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x4455e9
cmp dword [edx + eax + 0x14], 0
je 0x4455e9
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x4455e9
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4455d9
test dl, dl
je 0x4455d5
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4455d9
add edi, 2
add esi, 2
test dl, dl
jne 0x4455b9
xor eax, eax
jmp 0x4455de
sbb eax, eax
or eax, 1
test eax, eax
je 0x4455f5
inc ebp
cmp ebp, dword [esp + 4]
jb 0x4455a6
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8