joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1006e680], 0
jne 0x1000b21f
push 0x1006e68c
call fcn.1000a0e0
add esp, 4
mov edx, 0x100
mov ecx, 0x1006e580
call fcn.1000a6f0
mov dword [0x1006e680], 1
jmp fcn.1000a750

Function at 0x1000bbb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push 0x104
lea eax, [ebp - 0x130]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.1000ec20
add esp, 0xc
mov dword [ebp - 5], 0x73255c45
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa], 0x41575446
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x52
call fcn.1000c1d0
cmp dword [eax + 0x14], 0x10
jb 0x1000bc01
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x104
push eax
call fcn.1000c0d0
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 0x10
jb 0x1000bc4c
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000bc42
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bc61
push edx
push ecx
call fcn.1000ca7d
add esp, 8
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.1000c270
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001fd67
int3

Function at 0x1002b903
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002b1af

Function at 0x1002b90e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002b3ea

Function at 0x1003626e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100360ac
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3d2a5760
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x3f6d54ee
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x408ecc
mov ecx, 0xeb811da
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x5fe4570
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407e40
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x407eb0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00403160
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x4a2520
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x77000]
push edi
jmp 0x4a253a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a2541
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2530
mov eax, 1
add ebx, ebx
jne 0x4a2553
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a2564
jne 0x4a2583
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2583
dec eax
add ebx, ebx
jne 0x4a2570
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a2548
add ebx, ebx
jne 0x4a257f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a25d5
xor ecx, ecx
sub eax, 3
jb 0x4a259b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a260a
sar eax, 1
mov ebp, eax
jmp 0x4a25a6
add ebx, ebx
jne 0x4a25a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2574
inc ecx
add ebx, ebx
jne 0x4a25b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2574
add ebx, ebx
jne 0x4a25c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a25b6
jne 0x4a25d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a25b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a25f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a25e6
jmp 0x4a2536
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a25f4
add edi, ecx
jmp 0x4a2536
pop esi
mov edi, esi
mov ecx, 0xea4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a2612
cmp byte [edi], 0x11
jne 0x4a2612
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a2617
lea edi, [esi + 0x9f000]
mov eax, dword [edi]
or eax, eax
je 0x4a268f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa4a14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa4afc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a2644
mov ecx, edi
jns 0x4a2673
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa4b04]
or eax, eax
je 0x4a2689
mov dword [ebx], eax
add ebx, 4
jmp 0x4a2661
call dword [esi + 0xa4b00]
mov ebp, dword [esi + 0xa4b08]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a26c3
sub esp, 0xffffff80
jmp 0x41688d
Function at 0x4aca6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.004c7adc
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x4eca32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.004c7adc
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x4eca32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 4]
xor eax, 0x12476359
mov dword [ebp + 4], eax
push eax
mov eax, dword [ebp]
xor eax, 0x97815643
mov dword [ebp], eax
push eax
mov ebx, dword [ebp - 4]
call fcn.004aca4d
mov eax, 0
cmp eax, ecx
jl 0x4acb05
push 0x20b
push 0x4011022
push 1
call fcn.004c7af4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.004aca4d
mov eax, 0
cmp eax, ecx
jl 0x4acb38
push 0x234
push 0x4011022
push 1
call fcn.004c7af4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x4acb4e
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x4acb76
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x4acb70
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x4acb8f
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.004c89d0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4acbeb
push ebx
call fcn.004c7ad6
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x4acc00
push eax
pushfd
mov eax, dword [esp + 8]
xor eax, 0x97815643
mov dword [ebp], eax
mov eax, dword [esp + 0xc]
xor eax, 0x12476359
mov dword [ebp + 4], eax
xchg dword [esp + 4], eax
popfd
pop eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.004c7ad6
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.004c7ad6
add esp, 4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c9450
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4c946e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4c9463
pop esi
ret

Function at 0x4ccb0a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004ccb89
jae 0x4ccb16
xor ecx, ecx
call fcn.004ccb89
jae 0x4ccb40
xor eax, eax
call fcn.004ccb89
jae 0x4ccb51
mov al, 0x10
call fcn.004ccb89
adc al, al
jae 0x4ccb32
jne 0x4ccb7e
stosb byte es:[edi], al
jmp 0x4ccb17
call fcn.004ccb95
dec ecx
loop 0x4ccb5d
mov eax, ebp
call fcn.004ccb93
jmp 0x4ccb7f
lodsb al, byte [esi]
shr eax, 1
je 0x4ccba5
adc ecx, 2
mov ebp, eax
jmp 0x4ccb7f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004ccb93
cmp eax, 0x7d00
jae 0x4ccb7d
cmp eax, 0x500
jae 0x4ccb7e
cmp eax, 0x7f
ja 0x4ccb7f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4ccb17
pop ebp
ret 8

Function at 0x50af49
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.0064b7ba

Function at 0x53320f
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov eax, dword [eax + 4]
test edi, 0x66113c46
cmp eax, 0x42792bda
add eax, 8
push eax
call fcn.004c7adc
pop ecx
pop esi
mov bx, dx
xchg bx, di
mov edi, eax
movsx ebx, cx
bswap bx
mov bx, 0x331a
rep movsb byte es:[edi], byte [esi]
not bl
sete bl
bswap esi
pop edi
pop esi
movzx cx, ah
stosd dword es:[edi], eax
bswap cx
movsx ebx, bp
cbw
mov ecx, 3
movsx ebx, cx
rep movsd dword es:[edi], dword [esi]
pop eax
sbb edi, edi
pop edi
mov dword [edi], eax
rcl bh, cl
shr ebx, cl
cmp ebp, eax
mov ebx, dword [ebp - 0x70]
clc
push ebx
cmp edi, 0x29803894
jmp 0x531f80
add ebx, 4
stc
clc
push ebx
test sp, 0x440e
mov ebx, dword [ebx]
test ebx, ebx
je 0x531fa0
push ebx
call fcn.004c7ad6
add esp, 4
xchg bl, bl
pop ebx
call fcn.004c7ad6
add esp, 4
cwde
not ax
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x40]
call fcn.0050e963
stosd dword es:[edi], eax
movzx ax, cl
lodsd eax, dword [esi]
push esi
clc
cmc
push edi
clc
test sp, bx
test eax, 0x3e303414
test eax, eax
je 0x528482
push eax
jmp 0x52844e

Function at 0x583aac
Capabilities:
Authenticate hmac

Disassembly:
mov dword [ebp - 4], 0
jmp 0x60a11b
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0x5e35fa
push ebp
mov ebp, esp
sub esp, 0x98
jmp 0x551af7
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x55024d
stosd dword es:[edi], eax
jmp 0x5e578d
mov dword [ebp - 0xc], 0
jmp 0x5992fb
push 8
call fcn.004c7adc
add esp, 4
xchg di, si
movsx edi, cx
mov dword [ebp - 8], eax
movsx esi, bp
mov edi, eax
cbw
mov esi, 0x4cc23e
movsx ax, dh
lodsd eax, dword [esi]
jmp 0x581869
Function at 0x64c9aa
Capabilities:
Authenticate hmac

Disassembly:
push esi
pushfd
mov esi, 0x149741e
call fcn.005e33ea
Function at 0x6751b2
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
xor dword [esp + 0xc], 0x1b9e1148
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.005e3a05
push esi
jne 0x587e59
cmc

Function at 0x67f693
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
call fcn.0054fb0b

Function at 0x681071
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + 4], 0xfd091814
pushfd
call fcn.004adbf7
Function at 0x405e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x41da8c], 0
jne 0x40611a
push esi
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj51.8_.4202:zb0.1:bb
mov byte [0x41da8c], 1
call fcn.0040773f
push 0x12a0
push 0
push 0x41c7d8
call fcn.0040c840
push 0
push 0x41c7f6
push 0x4175ec
call fcn.00405d70
push 0
push 0x41c9f4
push 0x4175f4
call fcn.00405d70
push 0x41ca30
push 0
push 0x4175fc
call fcn.00405d70
push 0
push 0x41ca34
push 0x417604
call fcn.00405d70
add esp, 0x40
push 0
push 0x41cc32
push 0x41760c
call fcn.00405d70
push 0x41cc70
push 0
push 0x417614
call fcn.00405d70
push 0
push 0x41cc74
push 0x41761c
call fcn.00405d70
push 0
push 0x41ce72
push 0x417624
call fcn.00405d70
push 0x41ceb0
push 0
push 0x41762c
call fcn.00405d70
push 0
push 0x41ceb4
push 0x417634
call fcn.00405d70
add esp, 0x48
push 0
push 0x41cef0
push 0x41763c
call fcn.00405d70
push 0
push 0x41cf2c
push 0x417644
call fcn.00405d70
push 0
push 0x41cf90
push 0x41764c
call fcn.00405d70
push 0
push 0x41cff4
push 0x417654
call fcn.00405d70
push 0x41d058
push 0
push 0x41765c
call fcn.00405d70
push 0x41d05c
push 0
push 0x417664
call fcn.00405d70
add esp, 0x48
push 0x41d060
push 0
push 0x41766c
call fcn.00405d70
push 0x41d064
push 0
push 0x417674
call fcn.00405d70
push 0x41d068
push 0
push 0x41767c
call fcn.00405d70
push 0x41d06c
push 0
push 0x417684
call fcn.00405d70
push 0x41d070
push 0
push 0x41768c
call fcn.00405d70
push 0x41d074
push 0
push 0x417694
call fcn.00405d70
add esp, 0x48
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.Console
push connect
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406042
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
push str.IpDate
push eax
call esi
cmp dword [ebp - 4], 0xa
jbe 0x406119
push 0x7d0
push 0
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj51.8_.4202:zb0.1:bb
call fcn.0040c840
mov eax, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj51.8_.4202:zb0.1:bb
lea edx, [ebp - 8]
push edx
push 0
push str.IpDate
push eax
call esi
push 0
push 0x41c7f6
push 0x4175ec
call fcn.00405d70
push 0
push 0x41c9f4
push 0x4175f4
call fcn.00405d70
push 0x41ca30
push 0
push 0x4175fc
call fcn.00405d70
push 0
push 0x41ca34
push 0x417604
call fcn.00405d70
push 0
push 0x41cc32
push 0x41760c
call fcn.00405d70
push 0x41cc70
push 0
push 0x417614
call fcn.00405d70
add esp, 0x48
push 0
push 0x41cc74
push 0x41761c
call fcn.00405d70
push 0
push 0x41ce72
push 0x417624
call fcn.00405d70
push 0x41ceb0
push 0
push 0x41762c
call fcn.00405d70
add esp, 0x24
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427600
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [0x508824]
push esi
push edi
mov dword [ebp - 0x18], ebx
lea ecx, [ebx + 0x18]
call fcn.004270b0
test edx, edx
ja 0x4277bb
jb 0x42762c
test eax, eax
jne 0x4277bb
mov al, byte [ebx + 0x10]
test al, al
je 0x4277bb
mov edx, dword [0x509160]
test edx, edx
jne 0x4277a3
mov eax, dword fs:[0x30]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0xc989b8da
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x30]
add ecx, 0xfffffff8
test esi, esi
je 0x42769f
movzx ebx, cx
xor esi, esi
shr ebx, 1
mov edi, 0x71573c81
lea ecx, [edx + ebx*2]
cmp edx, ecx
cmova ebx, esi
test ebx, ebx
je 0x427698
movsx ecx, byte [edx]
lea edx, [edx + 2]
xor ecx, edi
inc esi
imul edi, ecx, 0x1000193
cmp esi, ebx
jne 0x427685
mov esi, dword [ebp - 4]
cmp edi, esi
jne 0x42770b
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x14], ecx
lea ecx, [edx + esi]
mov dword [ebp - 0xc], ecx
cmp ecx, esi
je 0x427708
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x427708
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x71573c81
mov cl, byte [edx]
inc edx
test cl, cl
je 0x4276fa
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x4276e5
mov ecx, dword [ebp - 8]
cmp esi, ecx
je 0x427712
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x4276d0
mov esi, dword [ebp - 4]
mov eax, dword [eax]
jmp 0x427660
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea edx, [eax + ecx*4]
mov edx, dword [edx + esi]
add edx, esi
cmp edx, ebx
jbe 0x42779a
mov eax, dword [ebp - 0x14]
add eax, ebx
cmp edx, eax
jae 0x42779a
mov al, byte [edx]
mov esi, 0x71573c81
mov dword [ebp - 4], esi
mov ecx, esi
mov dword [ebp - 8], ecx
cmp al, 0x2e
je 0x427765
nop dword [eax]
movsx eax, al
inc edx
xor eax, esi
imul esi, eax, 0x1000193
mov al, byte [edx]
cmp al, 0x2e
jne 0x427750
mov dword [ebp - 4], esi
mov al, byte [edx + 1]
inc edx
test al, al
je 0x427787
nop dword [eax]
movsx eax, al
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
mov al, byte [edx]
test al, al
jne 0x427770
mov dword [ebp - 8], ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
jmp 0x427660
mov ebx, dword [ebp - 0x18]
mov dword [0x509160], edx
push 0
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.00446850
push eax
call edx
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4277d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dl, 1
push esi
push edi
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x10]
xchg byte [eax], dl
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x509144]
test eax, eax
jne 0x427952
mov eax, dword fs:[0x30]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x323157f1
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x30]
add ecx, 0xfffffff8
test esi, esi
je 0x42784f
movzx ebx, cx
xor esi, esi
shr ebx, 1
mov edi, 0x52d21a3a
lea ecx, [edx + ebx*2]
cmp edx, ecx
cmova ebx, esi
test ebx, ebx
je 0x427848
movsx ecx, byte [edx]
lea edx, [edx + 2]
xor ecx, edi
inc esi
imul edi, ecx, 0x1000193
cmp esi, ebx
jne 0x427835
mov esi, dword [ebp - 4]
cmp edi, esi
jne 0x4278b9
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi + 0x78]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 0x14], ecx
lea ecx, [edx + esi]
mov dword [ebp - 0xc], ecx
cmp ecx, esi
je 0x4278b6
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4278b6
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x52d21a3a
mov cl, byte [edx]
inc edx
test cl, cl
je 0x4278aa
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x427895
cmp esi, dword [ebp - 8]
je 0x4278c0
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x427880
mov esi, dword [ebp - 4]
mov eax, dword [eax]
jmp 0x427810
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
cmp eax, esi
jbe 0x42794a
mov ecx, dword [ebp - 0x14]
add ecx, esi
cmp eax, ecx
jae 0x42794a
mov cl, byte [eax]
mov esi, 0x52d21a3a
mov dword [ebp - 4], esi
mov edx, esi
mov dword [ebp - 8], edx
cmp cl, 0x2e
je 0x427916
nop dword [eax]
movsx ecx, cl
inc eax
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [eax]
cmp cl, 0x2e
jne 0x427900
mov dword [ebp - 4], esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x427937
nop
movsx ecx, cl
lea eax, [eax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [eax]
test cl, cl
jne 0x427920
mov dword [ebp - 8], edx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
jmp 0x427810
mov ebx, dword [ebp - 0x18]
mov dword [0x509144], eax
push 0
push 0xffffffffffffffff
push 0
push dword [ebp - 0x1c]
call eax
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 4]
cmp esi, edi
je 0x427975
mov ecx, esi
call fcn.00426f90
add esi, 8
cmp esi, edi
jne 0x427967
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret