joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ced0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov dword [esp + 0x30], 0x4fda49da
mov dword [esp + 0x34], 0x43de4de8
mov dword [esp + 0x38], 0x471441dc
mov dword [esp + 0x3c], 0xbb2645e0
mov dword [esp + 0x40], 0xbfbeb924
mov byte [esp + 0x44], 0
mov eax, 0x72
mov ecx, 0x8d
nop
nop
movzx esi, byte [esp + eax - 0x42]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xc6
mov byte [esp + eax - 0x42], dl
inc eax
dec ecx
cmp eax, 0x87
jne 0x43cf10
lea eax, [esp + 0x30]
push eax
call fcn.0043fb70
add esp, 4
mov dword [0x454d38], eax
mov dword [esp + 0x2c], 0xbd053124
test eax, eax
je 0x43cf53
mov dword [esp + 0x2c], 0x1a12a222
mov ebp, 0xf4e52faf
xor eax, eax
cmp ebp, 0xfac491a9
setl al
mov eax, dword [eax*4 + 0x449678]
mov ecx, dword [0x449680]
mov edx, ecx
xor edx, 0x906779f1
lea esi, [edx + edx]
not esi
add esi, edx
and esi, 0x106779f1
add esi, esi
sub esi, ecx
add eax, esi
add eax, 0x6f98860f
jmp eax

Function at 0x43fb70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], 0x13121160
mov word [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3c
xor cl, byte [esp + eax + 4]
add cl, 0xd4
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 6
jne case.default.0x43fbb7
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x44a450]
mov edx, dword [eax + 0xc]
mov esi, dword [edx + 0xc]
add edx, 0xc
mov edi, dword [0x44a47c]
mov dword [esp], 0
mov ebx, dword [0x44a490]
xor eax, eax
cmp esi, edx
setne al
mov dword [esp + 0xc], edx
jmp dword [eax*4 + 0x44a458]
mov ecx, dword [esi + 0x30]
xor eax, eax
test ecx, ecx
setne al
mov ebp, 1
jmp dword [eax*4 + 0x44a460]
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x28]
nop
nop
movzx eax, word [edx]
lea ebp, [eax - 0x41]
cmp bp, 0x1a
jae 0x43fc1f
or eax, 0x20
movzx ebp, word [ecx]
lea esi, [ebp - 0x41]
cmp si, 0x1a
jae 0x43fc2e
or ebp, 0x20
test ax, ax
je 0x43fc3e
add edx, 2
add ecx, 2
cmp ax, bp
je 0x43fc10
xor ecx, ecx
cmp ax, bp
sete cl
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ebp, 1
jmp dword [ecx*4 + 0x44a468]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edi
mov eax, dword [0x44a4a0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [eax + 8]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43ffd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0xd9dadb34
mov byte [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx]
mov esi, edx
xor esi, 0x989e4caf
lea ebx, [eax + esi]
and ebx, edi
add ebx, ebx
add esi, edi
sub esi, ebx
add esi, eax
mov ebx, esi
and ebx, 0x14
add ebx, ebx
xor esi, 0x6b
sub ebx, esi
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 5
jne case.default.0x44002e
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a510]
Function at 0x4400a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
movzx eax, word [edi]
mov dword [esp], 0xf10eb5c3
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xa
mov ebx, edx
xor ebx, 0xfd
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0xf
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 7
jne case.default.0x4400f9
xor ecx, ecx
cmp dword [esp], eax
setne cl
jmp dword [ecx*4 + 0x44a530]

Function at 0x440820
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440840
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44085b
mov eax, 0xffffffff
jmp 0x44085e
add eax, 0xa
push eax
call fcn.004086e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x4408a1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x440890
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov ecx, 0x3d
mov edx, 0x5b2fb6c2
nop
nop
nop
movzx esi, byte [esp + ecx - 0x3d]
mov edi, edx
or edi, esi
not esi
or esi, ecx
and esi, edi
mov edi, 0xc7ee91cd
sub edi, esi
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
mov byte [esp + ecx - 0x3d], bl
inc ecx
dec edx
cmp ecx, 0x43
jne 0x440920
mov esi, dword [esp]
mov ecx, dword [0x44cd1c]
test ecx, ecx
je 0x4409c2
xor edx, edx
mov edi, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x440980
inc edx
cmp ecx, edx
jne 0x440970
jmp 0x4409c2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4409c2
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44cd24]
mov edi, eax
call fcn.0043e470
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004086f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4409e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x440a00
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x440a1b
mov eax, 0xffffffff
jmp 0x440a1e
add eax, 0xa
push eax
call fcn.004086e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x440a61
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x440a50
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov ecx, 0x3d
mov edx, 0x5b2fb6c2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x3d]
mov ebx, edx
or ebx, esi
not esi
or esi, ecx
and esi, ebx
mov ebx, 0xc7ee91cd
sub ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
mov byte [esp + ecx - 0x3d], bl
inc ecx
dec edx
cmp ecx, 0x43
jne 0x440af0
mov esi, dword [esp]
mov ecx, dword [0x44cd1c]
test ecx, ecx
je 0x440b84
xor edx, edx
mov ebx, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x440b50
inc edx
cmp ecx, edx
jne 0x440b40
jmp 0x440b84
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x440b84
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44cd24]
mov edi, eax
call fcn.0043e470
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004086f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x440bc0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x440bdb
mov eax, 0xffffffff
jmp 0x440bde
add eax, 0xa
push eax
call fcn.004086e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x440c21
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x440c10
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp], si
add ecx, edx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x700f0e0d
mov word [esp + 0x24], 0
mov ecx, 0x3d
mov edx, 0x5b2fb6c2
movzx esi, byte [esp + ecx - 0x1d]
mov edi, edx
or edi, esi
not esi
or esi, ecx
and esi, edi
mov edi, 0xc7ee91cd
sub edi, esi
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
mov byte [esp + ecx - 0x1d], bl
inc ecx
dec edx
cmp ecx, 0x43
jne 0x440ca0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44cd1c]
test ecx, ecx
je 0x440d29
xor edx, edx
mov edi, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x1ce638e1
je 0x440d00
inc edx
cmp ecx, edx
jne 0x440cf0
jmp 0x440d29
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x440d29
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44cd24]
mov edi, eax
call fcn.0043e470
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.004086f0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x440d3f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov eax, 0x3d
mov edx, 0x5b2fb6c2
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3d]
mov ebx, edx
or ebx, ecx
not ecx
or ecx, eax
and ecx, ebx
mov ebx, 0xc7ee91cd
sub ebx, ecx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
mov byte [esp + eax - 0x3d], cl
inc eax
dec edx
cmp eax, 0x43
jne 0x440d80
mov eax, dword [esp]
mov edx, dword [0x44cd1c]
test edx, edx
je 0x440e08
xor ebx, ebx
mov ecx, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x440de0
inc ebx
cmp edx, ebx
jne 0x440dd0
jmp 0x440e08
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x440e08
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x20
test edi, edi
je 0x440e12
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x440e1e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov eax, 0x3d
mov ebx, 0x5b2fb6c2
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x3d]
mov ebp, ebx
or ebp, edi
not edi
or edi, eax
and edi, ebp
mov ebp, 0xc7ee91cd
sub ebp, edi
mov edi, ebp
and edi, 1
xor ebp, 1
lea ecx, [edi*2]
add ecx, ebp
mov byte [esp + eax - 0x3d], cl
inc eax
dec ebx
cmp eax, 0x43
jne 0x440e60
mov eax, dword [esp]
mov ebx, dword [0x44cd1c]
test ebx, ebx
je 0x440eee
xor ebp, ebp
mov edi, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x440ec0
inc ebp
cmp ebx, ebp
jne 0x440eb0
jmp 0x440eee
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x440eee
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x30
cmp eax, 0x103
jne 0x440fa9
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov eax, 0x3d
mov ecx, 0x5b2fb6c2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3d]
mov esi, ecx
or esi, edx
not edx
or edx, eax
and edx, esi
mov esi, 0xc7ee91cd
sub esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax - 0x3d], dl
inc eax
dec ecx
cmp eax, 0x43
jne 0x440f20
mov eax, dword [esp]
mov ecx, dword [0x44cd1c]
test ecx, ecx
je 0x440fa1
xor edx, edx
mov edi, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x440f80
inc edx
cmp ecx, edx
jne 0x440f70
jmp 0x440fa1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x440fa1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x18
test eax, eax
js 0x440fa9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x440fc0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x440fbe
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov eax, 0x3d
mov ebx, 0x5b2fb6c2
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x3d]
mov ebp, ebx
or ebp, edi
not edi
or edi, eax
and edi, ebp
mov ebp, 0xc7ee91cd
sub ebp, edi
mov edi, ebp
and edi, 1
xor ebp, 1
lea ecx, [edi*2]
add ecx, ebp
mov byte [esp + eax - 0x3d], cl
inc eax
dec ebx
cmp eax, 0x43
jne 0x441000
mov eax, dword [esp]
mov ebx, dword [0x44cd1c]
test ebx, ebx
je 0x441098
xor ebp, ebp
mov edi, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x44106a
mov ecx, ebp
xor ecx, 1
and ebp, 1
lea ebp, [ecx + ebp*2]
cmp ebp, ebx
jb 0x441050
jmp 0x441098
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x441098
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x30
cmp eax, 0x103
jne 0x441149
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov eax, 0x3d
mov ecx, 0x5b2fb6c2
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3d]
mov esi, ecx
or esi, edx
not edx
or edx, eax
and edx, esi
mov esi, 0xc7ee91cd
sub esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax - 0x3d], dl
inc eax
dec ecx
cmp eax, 0x43
jne 0x4410c0
mov eax, dword [esp]
mov ecx, dword [0x44cd1c]
test ecx, ecx
je 0x441141
xor edx, edx
mov edi, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x441120
inc edx
cmp ecx, edx
jne 0x441110
jmp 0x441141
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x441141
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x18
test eax, eax
js 0x441149
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x441157
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441160
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x441180
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 8], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x700f0e0d
mov word [esp + 4], 0
mov eax, 0x3d
mov edi, 0x5b2fb6c2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3d]
mov ebx, edi
or ebx, ecx
not ecx
or ecx, eax
and ecx, ebx
mov ebx, 0xc7ee91cd
sub ebx, ecx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
mov byte [esp + eax - 0x3d], cl
inc eax
dec edi
cmp eax, 0x43
jne 0x441210
mov eax, dword [esp]
mov edi, dword [0x44cd1c]
test edi, edi
je 0x441295
xor ebx, ebx
mov ebp, dword [0x44cd20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x40915fe0
je 0x441271
inc ebx
cmp edi, ebx
jne 0x441260
jmp 0x441295
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x441295
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 0x10
push edi
push dword [0x44cd24]
call fcn.0043e470
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4050d2
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4050db
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4050f9
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x405157
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40513e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x405147
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x405151
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x405133
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4050bd
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4051a4
dec eax
je 0x40519b
sub eax, 3
je 0x405192
mov dword [ebp - 4], 0x40
jmp 0x4051c1
mov dword [ebp - 4], 4
jmp 0x4051a7
mov dword [ebp - 4], 0x20
jmp 0x4051a7
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4051f3
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x405173
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00404a04
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8a1370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x8a138e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x8ca074
push ecx
mov edi, eax
call fcn.008b5198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8a13cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.008b502e
push esi
call fcn.008b4fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x8a4850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x8a48ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x8cf720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x8a48ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.008b51e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x8a48ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x8cf720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x8a492a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.008b6082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x8a4957
mov word [eax], si
add eax, 2
push eax
call fcn.008b6030
add esp, 4
jmp 0x8a4959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x8a48ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x8a48b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x8a4ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret