joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422078
Capabilities:
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 8]
push dword [0x4294a0]
call sub.msvcrt.dll_strcpy
call fcn.00422230
mov dword [0x4294a8], eax
call fcn.00422210
mov dword [0x4294ac], eax
mov dword [esp], 0x422060
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov dword [0x4294b4], eax
jne 0x4220c2
mov dword [0x4294b4], 0x422065
sub esp, 0xc
push 0x422069
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov dword [0x4294b8], eax
je 0x42210c
mov edx, dword [0x4294b8]
test edx, edx
jne 0x4220ef
mov dword [0x4294b8], 0x4287a1
call fcn.00423d20
mov dword [0x4294b0], eax
mov dword [0x4294a4], 0x4287a0
mov eax, 0x4294a0
leave
ret
sub esp, 0xc
push 0x42206f
call sub.msvcrt.dll_getenv
mov dword [0x4294b8], eax
add esp, 0x10
jmp 0x4220db

Function at 0x422168
Capabilities:
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.00423d20
mov edx, dword [ebp + 8]
mov dword [0x4294c8], edx
mov dword [0x4294c0], eax
call fcn.00422210
sub esp, 0xc
push 0x422150
mov dword [0x4294cc], eax
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov dword [0x4294d4], eax
jne 0x4221ae
mov dword [0x4294d4], 0x422155
sub esp, 0xc
push 0x422159
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov dword [0x4294d8], eax
je 0x4221f8
mov edx, dword [0x4294d8]
test edx, edx
jne 0x4221db
mov dword [0x4294d8], 0x4287b1
call fcn.00423d20
mov dword [0x4294d0], eax
mov dword [0x4294c4], 0x4287b0
mov eax, 0x4294c0
leave
ret
sub esp, 0xc
push 0x42215f
call sub.msvcrt.dll_getenv
mov dword [0x4294d8], eax
add esp, 0x10
jmp 0x4221c7
Function at 0x422c40
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
mov dword [ebp - 0x14], eax
add esp, 0xc
inc eax
je 0x422dbc
sub esp, 0xc
push ebx
call fcn.004234a0
mov esi, eax
mov dword [esp], eax
call fcn.00422dd4
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test esi, esi
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
je 0x422ca0
xor eax, eax
mov edi, esi
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x422ca0
cmp byte [esi + 1], 0x3a
je 0x422d93
xor eax, eax
xor edx, edx
xor ebx, ebx
test dword [ebp - 0x14], 0x10
sete bl
dec ebx
and ebx, 0xffffc000
mov edi, dword [ebp + 0xc]
add ebx, 0x8000
test dword [ebp - 0x14], 1
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], edx
je 0x422d88
or ebx, 0x124
test esi, esi
je 0x422cf9
sub esp, 8
lea ecx, [ebp - 0x10]
push ecx
push esi
call sub.KERNEL32.dll_GetBinaryTypeA
pop edi
test eax, eax
pop edx
je 0x422cf9
or ebx, 0x49
xor edi, edi
test esi, esi
je 0x422d11
sub esp, 8
push 0x2e
push esi
call sub.msvcrt.dll_strrchr
add esp, 0x10
test eax, eax
jne 0x422d6c
test edi, edi
je 0x422d1b
or ebx, 0xa000
mov edx, dword [ebp + 0xc]
sub esp, 0xc
mov dword [edx], ebx
mov dword [edx + 0x1c], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x18], 1
mov dword [edx + 0x38], 0x12cea600
mov dword [edx + 0x40], 0x12cea600
mov dword [edx + 0x3c], 0x12cea600
push esi
call sub.msvcrt.dll_free
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
push ecx
push 5
push 0x4222d0
push eax
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
jne 0x422d11
mov edi, 1
jmp 0x422d11
or ebx, 0x1b6
jmp 0x422cdf
mov al, byte [esi + 2]
cmp al, 0x2f
je 0x422da2
cmp al, 0x5c
jne 0x422ca0
sub esp, 0xc
movsx edx, byte [esi]
push edx
call sub.msvcrt.dll_toupper
sub eax, 0x40
add esp, 0x10
cdq
jmp 0x422ca4
call fcn.00423110
mov esi, eax
call sub.msvcrt.dll__errno
mov dword [eax], esi
mov eax, 0xffffffff
jmp 0x422d63

Function at 0x4239a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp eax, 0x83
ja case.0x4239b4.50
jmp dword [eax*4 + 0x4239bc]
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov eax, 0xffffffff
leave
ret
call fcn.00423f20
cmp eax, 3
jg 0x423bef
mov eax, 3
jmp 0x423bdc
call fcn.00423f20
jmp 0x423bdc
mov eax, 1
jmp 0x423bdc
mov eax, 0x400
jmp 0x423bdc
leave
jmp fcn.00423e98
leave
jmp fcn.00423e70
leave
jmp fcn.00423ec0
leave
jmp fcn.00423ef0
mov eax, 0x200
jmp 0x423bdc
mov eax, 8
jmp 0x423bdc
mov eax, 0x7fffffff
jmp 0x423bdc
mov eax, 0x80000000
jmp 0x423bdc
mov eax, 0x20
jmp 0x423bdc
mov eax, 2
jmp 0x423bdc
mov eax, 0x14
jmp 0x423bdc
mov eax, 0x7f
jmp 0x423bdc
mov eax, 0xffffff80
jmp 0x423bdc
mov eax, 0x7fff
jmp 0x423bdc
mov eax, 0xffff8000
jmp 0x423bdc
mov eax, 0xff
jmp 0x423bdc
mov eax, 0xffff
jmp 0x423bdc
call sub.msvcrt.dll__errno
mov dword [eax], 0x28
jmp case.0x4239b4.40
Function at 0x423d50
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
push 0
push 0x2000080
push 3
push 0
push 3
mov ebx, dword [ebp + 8]
push 0x100
push ebx
mov edi, dword [ebp + 0xc]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x24], eax
inc eax
pop edx
je 0x423e42
test edi, edi
je 0x423e25
mov eax, dword [edi]
mov esi, 0x989680
imul esi
mov ebx, edx
mov edx, dword [edi + 4]
mov ecx, eax
lea eax, [edx + edx*4]
shl eax, 1
cdq
add ecx, eax
adc ebx, edx
add ecx, 0xd53e8000
adc ebx, 0x19db1de
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [edi + 8]
imul esi
mov ecx, edx
mov edx, dword [edi + 0xc]
mov esi, eax
lea eax, [edx + edx*4]
shl eax, 1
cdq
add esi, eax
adc ecx, edx
add esi, 0xd53e8000
adc ecx, 0x19db1de
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x20]
push eax
lea edi, [ebp - 0x18]
push edi
push 0
push dword [ebp - 0x24]
call sub.KERNEL32.dll_SetFileTime
test eax, eax
je 0x423e10
xor ebx, ebx
sub esp, 0xc
push dword [ebp - 0x24]
call sub.KERNEL32.dll_CloseHandle
mov edx, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
mov eax, edx
pop edi
leave
ret
call fcn.00423110
mov esi, eax
mov ebx, 0xffffffff
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x423df6
sub esp, 0xc
lea ebx, [ebp - 0x18]
push ebx
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
add esp, 0xc
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
jmp 0x423dde
sub esp, 8
push 0x10
push ebx
call fcn.004215a0
add esp, 0x10
xor edx, edx
test eax, eax
jne 0x423e03
call fcn.00423110
mov esi, eax
call sub.msvcrt.dll__errno
mov edx, 0xffffffff
mov dword [eax], esi
jmp 0x423e03
Function at 0x1001eb80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1001eb8f
pop dword [ebp - 0x14]
mov eax, 0xa42fb008
sub eax, 0x942dc479
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xd1a10bd0
sub dword [ebp - 0x24], 0x834ec685
mov dword [ebp - 0x20], 0x50c4f502
sub dword [ebp - 0x20], 0x1e91a8bd
mov dword [ebp - 0x1c], 0xcd4af970
sub dword [ebp - 0x1c], 0x80feb542
mov dword [ebp - 0x18], 0xea663c94
sub dword [ebp - 0x18], 0xea663c94
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa3ae1a50
add dword [ebp - 0x24], 0xd0c44f06
mov dword [ebp - 0x20], 0xd4c15d88
sub dword [ebp - 0x20], 0x9354fc13
mov dword [ebp - 0x1c], 0xa77c35b3
sub dword [ebp - 0x1c], 0x440cc947
mov dword [ebp - 0x18], 0x73f0b0c9
sub dword [ebp - 0x18], 0x73f0b0c9
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xae5d57c1
sub eax, 0x9e5727a1
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x55bd9
push 0
call eax
mov ecx, 0x94c44d8b
add ecx, 0x6b3c0121
xor edx, edx
add edx, eax
mov edi, 0xe043b00
add edi, 0x2054b00
add edi, dword [ebp - 0x14]
mov esi, 0xef8bbad3
sub esi, 0x642d336c
add dword [ebp - 4], 0x1e8e00a0
mov ebx, dword [edi]
xor dword [ebp - 8], ebx
xor ebx, esi
xor dword [ebp - 8], ecx
mov dword [edx], ebx
add dword [ebp - 0xc], edx
add edx, 0x68194b02
add edx, 0x97e6b502
add edi, 0x75ae4a3e
add edi, 0x8a51b5c6
loop 0x1001ecae
add eax, 0x28a1f2da
add eax, 0xd75f3aa9
mov ebx, eax
add eax, 0x5857d2ce
sub eax, 0x5857d2c9
mov ecx, 0xe8e3e034
sub ecx, 0xd8e3e034
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4121f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x412212
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412208
mov eax, 1
add ebx, ebx
jne 0x41222b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412220
jne 0x41223c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412220
xor ecx, ecx
sub eax, 3
jb 0x412250
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4122c2
mov ebp, eax
add ebx, ebx
jne 0x41225b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412268
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41228c
inc ecx
add ebx, ebx
jne 0x412278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41226d
jne 0x412289
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41226d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4122ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41229d
jmp 0x41220e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4122ac
add edi, ecx
jmp 0x41220e
pop esi
mov edi, esi
mov ecx, 0x5c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4122ca
cmp byte [edi], 4
jne 0x4122ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4122cf
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412347
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x131b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x131f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4122fc
mov ecx, edi
jns 0x41232b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x131f8]
or eax, eax
je 0x412341
mov dword [ebx], eax
add ebx, 4
jmp 0x412319
call dword [esi + 0x13208]
mov ebp, dword [esi + 0x131fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41237b
sub esp, 0xffffff80
jmp 0x4014ec
Function at 0x4012d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496639
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x403220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496c4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], vtable.NArchive::N7z::CFolderOutStream.0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov word [ecx + 0xc], 0x100
mov dword [ecx + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x403f60
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496eed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 1
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 4
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 5
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 6
mov dword [ecx + 0x30], 0
mov byte [ebp - 4], 7
mov dword [ecx + 0x34], 0
mov byte [ebp - 4], 8
mov dword [ecx + 0x38], 0
mov byte [ebp - 4], 9
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov byte [ebp - 4], 0xa
lea eax, [ecx + 0x44]
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [ebp - 4], 0xd
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov byte [ebp - 4], 0xe
lea eax, [ecx + 0x64]
mov dword [ebp - 0x1c], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0xf
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 0x11
lea eax, [ecx + 0x7c]
mov dword [ebp - 0x20], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0x12
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 0x14
lea eax, [ecx + 0x94]
mov dword [ebp - 0x24], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0x15
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 0x17
lea eax, [ecx + 0xac]
mov dword [ebp - 0x28], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0x18
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 0x1a
lea eax, [ecx + 0xc4]
mov dword [ebp - 0x2c], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0x1b
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 0x1d
mov dword [ecx + 0xdc], 0
mov dword [ecx + 0xe0], 0
mov dword [ecx + 0xe4], 0
mov byte [ebp - 4], 0x1e
mov dword [ecx + 0xe8], 0
mov dword [ecx + 0xec], 0
mov byte [ebp - 4], 0x1f
mov dword [ecx + 0xf0], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4046a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497161
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 8
lea eax, [edi + 0x44]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 8
push dword [eax + 8]
call fcn.0046cdc6
mov byte [ebp - 4], 7
push dword [edi + 0x3c]
call fcn.0046cdc6
mov byte [ebp - 4], 6
push dword [edi + 0x38]
call fcn.0046cdc6
mov byte [ebp - 4], 5
push dword [edi + 0x34]
call fcn.0046cdc6
mov byte [ebp - 4], 4
push dword [edi + 0x30]
call fcn.0046cdc6
mov byte [ebp - 4], 3
push dword [edi + 0x2c]
call fcn.0046cdc6
mov byte [ebp - 4], 2
push dword [edi + 0x28]
call fcn.0046cdc6
mov byte [ebp - 4], 1
push dword [edi + 0x24]
call fcn.0046cdc6
mov byte [ebp - 4], 0
lea esi, [edi + 0xc]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0xb
push dword [esi + 0xc]
call fcn.0046cdc6
mov byte [ebp - 4], 0
push dword [esi]
call fcn.0046cdc6
mov dword [ebp - 4], 0xffffffff
push dword [edi + 8]
call fcn.0046cdc6
mov ecx, dword [ebp - 0xc]
add esp, 0x2c
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4058f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
mov edi, ecx
call fcn.0040e3a0
mov esi, dword [edi + 0xf0]
add esp, 4
test esi, esi
je 0x405a73
cmp dword [edi + 0xe8], 0
je 0x405a73
mov eax, dword [ebp + 8]
mov ecx, dword [esi + eax*4]
mov esi, dword [esi + eax*4 + 4]
sub esi, ecx
mov dword [ebp + 0xc], ecx
cmp esi, 0x4000
jae 0x405a73
lea eax, [esi - 1]
push eax
push ebx
call fcn.0040e360
add esp, 8
test eax, eax
jne 0x405a75
mov eax, dword [edi + 0xe8]
xor edi, edi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx + 8]
lea ecx, [eax + ecx*2]
test esi, esi
je 0x405a73
cmp esi, 0x10
jb 0x405a41
lea eax, [ecx - 2]
lea eax, [eax + esi*2]
lea ebx, [edx - 2]
lea ebx, [ebx + esi*2]
cmp edx, eax
ja 0x405989
cmp ebx, ecx
jae 0x405a41
movaps xmm5, xmmword [str._________]
mov eax, esi
movaps xmm6, xmmword [0x4a1800]
and eax, 0xfffffff0
movaps xmm4, xmmword [0x4a17e0]
movaps xmm7, xmmword [0x4a17f0]
nop word [eax + eax]
movups xmm0, xmmword [ecx]
add edi, 0x10
movaps xmm3, xmm5
pcmpeqw xmm3, xmm0
movaps xmm2, xmm3
pandn xmm2, xmm0
movaps xmm0, xmm3
pand xmm0, xmm4
pxor xmm3, xmm6
por xmm2, xmm0
movaps xmm1, xmm2
pcmpeqw xmm1, xmm4
pand xmm1, xmm3
movaps xmm3, xmm5
movaps xmm0, xmm1
pand xmm1, xmm7
pandn xmm0, xmm2
por xmm0, xmm1
movups xmmword [edx], xmm0
movups xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pcmpeqw xmm3, xmm0
movaps xmm2, xmm3
pandn xmm2, xmm0
movaps xmm0, xmm3
pand xmm0, xmm4
pxor xmm3, xmm6
por xmm2, xmm0
movaps xmm1, xmm2
pcmpeqw xmm1, xmm4
pand xmm1, xmm3
movaps xmm0, xmm1
pand xmm1, xmm7
pandn xmm0, xmm2
por xmm0, xmm1
movups xmmword [edx + 0x10], xmm0
add edx, 0x20
cmp edi, eax
jb 0x4059b0
cmp edi, esi
jae 0x405a73
sub esi, edi
mov edi, 0xf05c
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
cmp eax, 0x2f
jne 0x405a62
mov eax, 0x5c
jmp 0x405a68
cmp eax, 0x5c
cmove eax, edi
mov word [edx], ax
add edx, 2
sub esi, 1
jne 0x405a50
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40b8c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497bcc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.ICompressCoder.0
mov dword [ecx + 4], vtable.ICompressSetOutStreamSize.0
mov dword [ecx + 8], vtable.ICompressInitEncoder.0
mov dword [ecx + 0xc], vtable.ICompressSetInStream.0
mov dword [ecx + 0x10], vtable.ISequentialInStream.0
mov dword [ecx + 0x14], vtable.ICompressSetOutStream.0
mov dword [ecx + 0x18], vtable.ISequentialOutStream.0
mov dword [ecx + 0x1c], vtable.IOutStreamFinish.0
mov dword [ecx + 0x20], vtable.ICompressSetBufSize.0
mov dword [ecx + 0x24], vtable.ICompressSetDecoderProperties2.0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ebp - 4], 0
mov al, byte [ebp + 8]
mov dword [ecx], vtable.CFilterCoder.0
mov dword [ecx + 4], vtable.CFilterCoder.1.0
mov dword [ecx + 8], vtable.CFilterCoder.2.0
mov dword [ecx + 0xc], vtable.CFilterCoder.3.0
mov dword [ecx + 0x10], vtable.CFilterCoder.4.0
mov dword [ecx + 0x14], vtable.CFilterCoder.5.0
mov dword [ecx + 0x18], vtable.CFilterCoder.6.0
mov dword [ecx + 0x1c], vtable.CFilterCoder.7.0
mov dword [ecx + 0x20], vtable.CFilterCoder.8.0
mov dword [ecx + 0x24], vtable.CFilterCoder.9.0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0x100000
mov dword [ecx + 0x38], 0x100000
mov byte [ecx + 0x3c], al
mov byte [ecx + 0x3d], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x54], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x64], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c840
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497c4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], vtable.CLocalProgress.0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov word [ecx + 0x30], 0x101
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40e5b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x4d2fc0], eax
inc edx
cmp edx, 0x100
jb 0x40e5b2
push esi
mov eax, 0x4d2fc4
mov esi, 0x1c0
mov edx, dword [eax - 4]
lea eax, [eax + 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x4d2fc0]
mov dword [eax + 0x3ec], edx
mov edx, dword [eax - 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x4d2fc0]
mov dword [eax + 0x3f0], edx
mov edx, dword [eax - 0xc]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x4d2fc0]
mov dword [eax + 0x3f4], edx
mov edx, dword [eax - 8]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x4d2fc0]
mov dword [eax + 0x3f8], edx
sub esi, 1
jne 0x40e657
mov dword [0x4d2fa0], 0x496520
mov dword [0x4d2f98], 0x496520
mov dword [0x4d2f9c], 0x496440
call fcn.0040e720
mov ecx, dword [0x4d2f98]
test eax, eax
mov edx, 0x496440
cmove ecx, edx
mov dword [0x4d2f98], ecx
pop esi
ret

Function at 0x40ed40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push esi
mov esi, ecx
cmp dword [esi + 0x28], 1
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edx
ja 0x40ed65
xor eax, eax
pop esi
pop ebp
ret 0xc
cmp dword [esi + 0x14], 0
jne 0x40ed98
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 4
push esi
push 0x40ef30
push 0
push 0
call fcn.00478440
add esp, 0x18
mov dword [esi + 0x14], eax
test eax, eax
je 0x40ed98
push eax
call dword [0x4a1084]
mov eax, 1
pop esi
pop ebp
ret 0xc