joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 4], edx
call fcn.00441ce0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x20]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.0043c6b0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x441db3
cmp dword [eax + 4], ecx
jae 0x441de1
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea ecx, [0x441350]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x14]
mov dword [esp], ecx
call fcn.00463960
mov eax, dword [esp + 0x10]
movzx ecx, byte [0x6fbf88]
test cl, cl
je 0x441e0e
lea eax, [0x5e5d60]
mov dword [esp], eax
call fcn.00463960
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.00441ce0
lea eax, [0x6f23bc]
mov dword [esp], eax
call fcn.00402d90
mov eax, dword [esp + 4]
test eax, eax
je 0x441e46
lea eax, [0x5e5c20]
mov dword [esp], eax
call fcn.00463960
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.00441ce0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [esp], ecx
call fcn.00448b50
mov eax, dword [esp + 4]
test byte [eax], al
mov eax, dword [eax + 0x1178]
test eax, eax
je 0x441e8a
lea eax, [0x5e5d18]
mov dword [esp], eax
call fcn.00463960
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.00441ce0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [esp], ecx
call fcn.00448b50
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 4]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x160], edx
mov byte [eax + 0x6f], 1
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [esp], ecx
call fcn.00448b50
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [eax + 0x2c], 0
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x18]
test byte [edx], al
add edx, 0x5c
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00448b60
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
mov ecx, dword [esp + 0xc]
add ecx, 4
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.00402fa0
mov eax, dword [0x6f23b0]
test eax, eax
je 0x441f3a
lea eax, [0x5e5c1c]
mov dword [esp], eax
call fcn.00463960
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00441ce0
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x1c
ret
Function at 0x45c800
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45c89f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00464f37
lea ecx, [0x45bcb0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00463960
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00463a70
jmp fcn.0045c800

Function at 0x462b20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x20
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00443800
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
test byte [eax], al
movzx ecx, byte [0x7178db]
test cl, cl
je 0x462bc1
call fcn.00434270
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18c], eax
mov dword [ecx + 0x190], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x800
lea edx, [esp + 0x14]
mov dword [esp], edx
call fcn.00452730
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x194], eax
jmp 0x462bf7
call fcn.00434260
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18c], eax
mov dword [ecx + 0x190], 1
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00452730
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x194], eax
mov eax, dword [0x6eeff0]
mov dword [esp], eax
lea eax, [ecx + 0x18c]
mov dword [esp + 4], eax
call fcn.00404cb0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x198]
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x462c33
mov eax, dword [eax + 0x1a0]
mov dword [esp + 0x30], eax
call fcn.00443890
add esp, 0x20
ret
Function at 0x464d40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x717d20]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4634fb
je 0x46354e
cmp ebx, 0x20
jbe 0x463554
cmp ebx, 0x40
jbe 0x46359a
jmp 0x46363b
test ebx, ebx
je 0x463544
add eax, 0x10
test ax, 0xff0
je 0x463530
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x5f15c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x5f16c0]
jmp 0x463518
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x463518
pxor xmm1, xmmword [0x717d30]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x717d30]
pxor xmm2, xmmword [0x717d40]
pxor xmm3, xmmword [0x717d50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x717d30]
pxor xmm2, xmmword [0x717d40]
pxor xmm3, xmmword [0x717d50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46369a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x7178d9], 0
je 0x464d5a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4634c0
jmp fcn.00409810
Function at 0x497050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4971f2
sub esp, 0xc
mov eax, dword [esp + 0x14]
cmp eax, 2
jl 0x497127
mov ecx, dword [esp + 0x10]
movzx edx, byte [ecx]
cmp byte [ecx + 1], 0x3a
jne 0x4970ab
lea ebx, [edx - 0x30]
cmp bl, 9
jbe 0x49709b
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x49709b
lea ebx, [edx - 0x41]
cmp bl, 0x19
ja 0x4970ab
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 2
add esp, 0xc
ret
cmp eax, 5
jge 0x4970b4
xor edx, edx
jmp 0x4970cb
mov byte [esp], dl
call fcn.00496ee0
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
jne 0x4970d3
xor edx, edx
jmp 0x497116
movzx eax, byte [ecx + 1]
mov byte [esp], al
call fcn.00496ee0
movzx eax, byte [esp + 4]
test al, al
jne 0x4970f4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
jmp 0x497116
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 2]
mov byte [esp], cl
call fcn.00496ee0
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
je 0x49713b
cmp byte [ecx + 2], 0x2e
je 0x49713b
mov edx, 3
jmp 0x49715e
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0xc
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0xc
ret
mov ebx, dword [esp + 8]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea ebx, [eax - 1]
cmp edx, ebx
jge 0x49713b
mov dword [esp + 8], edx
movzx eax, byte [ecx + edx]
mov byte [esp], al
call fcn.00496ee0
movzx eax, byte [esp + 4]
test al, al
je 0x49714f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
movzx edx, byte [ecx + eax + 1]
mov byte [esp], dl
call fcn.00496ee0
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
lea ebx, [edx + ecx + 1]
test al, al
jne 0x49713b
cmp byte [ebx], 0x2e
je 0x49713b
lea eax, [edx + 1]
jmp 0x4971bd
mov edx, dword [esp + 8]
lea eax, [edx + 1]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp edx, eax
jle 0x4971e6
mov dword [esp + 8], eax
movzx edx, byte [eax + ecx]
mov byte [esp], dl
call fcn.00496ee0
movzx eax, byte [esp + 4]
test al, al
je 0x4971b2
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
call fcn.00463a70
jmp fcn.00497050
Function at 0x4c3b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c3c1c
sub esp, 0x1c
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4c3b48
lea eax, [0x5ce9ab]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 1
add esp, 0x1c
ret
dec eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4c3b54
xor ecx, ecx
jmp 0x4c3b70
mov ecx, dword [esp + 0x20]
movzx edx, byte [eax + ecx - 1]
mov byte [esp], dl
call fcn.00496ee0
movzx eax, byte [esp + 4]
mov ecx, eax
mov eax, dword [esp + 0x14]
test cl, cl
jne 0x4c3b47
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004c3c30
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0x14], ecx
mov edx, ecx
neg ecx
sar ecx, 0x1f
and ecx, eax
mov eax, dword [esp + 0x20]
add eax, ecx
mov dword [esp + 0x18], eax
lea ecx, [edx - 1]
jmp 0x4c3bab
dec ecx
test ecx, ecx
jge 0x4c3bb3
xor ebx, ebx
jmp 0x4c3bd9
mov dword [esp + 0x10], ecx
movzx edx, byte [eax + ecx]
mov byte [esp], dl
call fcn.00496ee0
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x18]
test bl, bl
jne 0x4c3baa
test ecx, ecx
jl 0x4c3bf4
sub edx, ecx
dec edx
mov ebx, edx
neg edx
sar edx, 0x1f
lea ebp, [ecx + 1]
and edx, ebp
add eax, edx
jmp 0x4c3bf6
mov ebx, edx
test ebx, ebx
jne 0x4c3c10
lea eax, [0x5ce9bb]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 1
add esp, 0x1c
ret
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
add esp, 0x1c
ret
call fcn.00463a70
jmp fcn.004c3b10
Function at 0x4c3cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c3e3e
sub esp, 0xc
mov eax, dword [esp + 0x14]
cmp eax, 2
jl 0x4c3d8b
mov ecx, dword [esp + 0x10]
movzx edx, byte [ecx]
cmp byte [ecx + 1], 0x3a
jne 0x4c3d0f
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x4c3d03
lea ebx, [edx - 0x41]
cmp bl, 0x19
ja 0x4c3d0f
mov dword [esp + 0x18], 2
add esp, 0xc
ret
cmp eax, 5
jge 0x4c3d18
xor edx, edx
jmp 0x4c3d2f
mov byte [esp], dl
call fcn.004c3c80
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
jne 0x4c3d37
xor edx, edx
jmp 0x4c3d7a
movzx eax, byte [ecx + 1]
mov byte [esp], al
call fcn.004c3c80
movzx eax, byte [esp + 4]
test al, al
jne 0x4c3d58
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
jmp 0x4c3d7a
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 2]
mov byte [esp], cl
call fcn.004c3c80
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
je 0x4c3d97
cmp byte [ecx + 2], 0x2e
je 0x4c3d97
mov edx, 3
jmp 0x4c3db2
mov dword [esp + 0x18], 0
add esp, 0xc
ret
mov dword [esp + 0x18], 0
add esp, 0xc
ret
mov ebx, dword [esp + 8]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea ebx, [eax - 1]
cmp edx, ebx
jge 0x4c3d97
mov dword [esp + 8], edx
movzx eax, byte [ecx + edx]
mov byte [esp], al
call fcn.004c3c80
movzx eax, byte [esp + 4]
test al, al
je 0x4c3da3
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
movzx edx, byte [ecx + eax + 1]
mov byte [esp], dl
call fcn.004c3c80
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
lea ebx, [edx + ecx + 1]
test al, al
jne 0x4c3d97
cmp byte [ebx], 0x2e
je 0x4c3d97
lea eax, [edx + 1]
jmp 0x4c3e11
mov edx, dword [esp + 8]
lea eax, [edx + 1]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp edx, eax
jle 0x4c3e36
mov dword [esp + 8], eax
movzx edx, byte [eax + ecx]
mov byte [esp], dl
call fcn.004c3c80
movzx eax, byte [esp + 4]
test al, al
je 0x4c3e06
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
add esp, 0xc
ret
call fcn.00463a70
jmp fcn.004c3cc0
Function at 0x4d8350
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d842b
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4d840d
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4d840d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.0048c390
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
sub ecx, dword [esp + 8]
movzx edx, byte [eax + 6]
test dl, dl
je 0x4d83df
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.004d9c00
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.004d8120
jmp 0x4d8409
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004d8120
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004d9c00
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004d9c00
add esp, 0x10
ret
call fcn.00463a70
jmp fcn.004d8350
Function at 0x2581571f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x2581572e
pop dword [ebp - 0x38]
mov eax, 0x2581572e
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa7714e68
sub dword [ebp - 0x48], 0x591f091d
mov dword [ebp - 0x44], 0xa2f685a3
sub dword [ebp - 0x44], 0x70c3395e
mov dword [ebp - 0x40], 0x97ce98c7
sub dword [ebp - 0x40], 0x4b825499
mov dword [ebp - 0x3c], 0xc7efd88c
sub dword [ebp - 0x3c], 0xc7efd88c
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xac44eaf2
add dword [ebp - 0x48], 0xc82d7e64
mov dword [ebp - 0x44], 0x2e89abc9
sub dword [ebp - 0x44], 0xed1d4a54
mov dword [ebp - 0x40], 0xffa62d37
sub dword [ebp - 0x40], 0x9c36c0cb
mov dword [ebp - 0x3c], 0xb7b5d32e
add dword [ebp - 0x3c], 0x484a2cd2
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xe45fe1bb
sub eax, 0xbede113b
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3e8d7
push 0
call eax
mov ecx, 0xa112f032
sub ecx, 0xa112a061
mov esi, eax
mov edx, 0x25829600
add edx, dword [ebp - 0x38]
mov edi, 0x7a47aabf
add edi, 0x3f69bedc
xor dword [ebp - 0x1c], esi
mov ebx, dword [edx]
sub ebx, edi
xor dword [ebp - 0x28], 0xf376d244
mov dword [esi], ebx
mov dword [ebp - 4], 0xb8a0d7b0
add esi, 4
add edx, 0x1f5a3050
sub edx, 0x1f5a304c
loop 0x25815840
add eax, 0xc3303431
sub eax, 0xc32f021a
xor ebx, ebx
add ebx, eax
add eax, 0x4a43ed1b
sub eax, 0x4a43ed16
mov ecx, 0x8bfd584e
add ecx, 0x9982a7b2
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x100033a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push esi
push edi
mov ecx, 0xf
mov esi, str.YSLAIFCZKqfqSubUQbQhamXwxshjZ
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], 0x10003090
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], ecx
lea edx, [ebp - 0x84]
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0x1e0
push 0x280
push 0x80000000
push 0x80000000
push 0x10cf0000
push str.PrtXxYfgGlnyxCRROMvIzjYus
lea edx, [ebp - 0x84]
push edx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003455
push 0x30
push str.GlBZFtYeUMlRDVPEXhREvrAMLahrJ
push str.dmUoDPxtzVZMTuVvojQdjCJgFi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x100034ad
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push 0
push 0
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x100034a2
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10003478
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10011a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x10011a20
jl 0x10011a17
cmp dword [ebp + 0xc], 0
ja 0x10011a20
xor eax, eax
xor edx, edx
jmp 0x10011b57
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10011a42
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.100123c0
jmp 0x10011b57
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.10013630
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x10011ab1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10011b60
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10013790
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10013fd0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.10013710
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10011b48
mov ecx, dword [ebp - 8]
call fcn.10013240
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x10011b21
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1004c0da
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x10011b1f
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x10011b57
jmp 0x10011acd
cmp dword [ebp - 4], 0
jbe 0x10011b48
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1004c0da
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc