joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4337fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
push 3
push 0x779e6c
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00430b90
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0x3c
cmova eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], str.cmd.exe
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4293fe
or esi, 0xffffffff
jmp 0x429422
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x429458
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42944e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42944e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00432224
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x429470
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4337fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov eax, Ordinal_2
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 3
jb 0x42956d
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
push ecx
cmova eax, dword [ebp + 8]
push eax
push 3
push 0x779e78
push ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
call fcn.00431de0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 5
cmova eax, dword [ebp - 0x28]
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x429517
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42950d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42954f
push ecx
push edx
call fcn.00432224
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x42955f
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x429555
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x429555
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00432224
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00428950
int3
Function at 0x429cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43389d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
mov dword [ebp - 0x10], ecx
cmp byte [esi + 0x17], 0
je 0x429d32
xor edx, edx
nop dword [eax]
lea ecx, [edx + esi]
lea eax, [edx + 0x5c]
inc edx
xor byte [ecx], al
cmp edx, 0x16
jb 0x429d20
mov byte [esi + 0x17], 0
push ecx
lea eax, [esi + 0x16]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00430e20
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x429d52
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00430b90
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x429dcb
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x429dc1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x429dc1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00432224
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x429de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x429e02
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x429df0
mov byte [esi + 0x17], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x16]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42ea90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x42eab2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0x42eaa0
mov byte [esi + 0x29], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x28]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ead0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x42eaf2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x2b
jb 0x42eae0
mov byte [esi + 0x2c], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2b]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42eb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x42eb32
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x42eb20
mov byte [esi + 0x1c], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1b]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42eb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x31], 0
je 0x42eb72
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x30
jb 0x42eb60
mov byte [esi + 0x31], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x30]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42eb90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
je 0x42ebb2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x2c
jb 0x42eba0
mov byte [esi + 0x2d], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2c]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ebd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x42ebf2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x42ebe0
mov byte [esi + 0x16], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x15]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ec10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x32], 0
je 0x42ec32
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x31
jb 0x42ec20
mov byte [esi + 0x32], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x31]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42ec50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x35], 0
je 0x42ec72
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x34
jb 0x42ec60
mov byte [esi + 0x35], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x34]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ec90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x42ecb2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x33
jb 0x42eca0
mov byte [esi + 0x34], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x33]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ecd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x42ecf2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x42ece0
mov byte [esi + 0x14], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x13]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ed10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x42ed32
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x42ed20
mov byte [esi + 0x15], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x14]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ed50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x42ed72
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x42ed60
mov byte [esi + 0x11], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ed90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x42edb2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x42eda0
mov byte [esi + 0x13], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x12]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42edd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x42edf2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x42ede0
mov byte [esi + 0xf], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xe]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42f1c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x42f1ec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x42f214
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x42f21a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x42f282
jg 0x42f231
test esi, esi
je 0x42f282
test ecx, ecx
jl 0x42f27d
jg 0x42f23b
test eax, eax
je 0x42f27d
cmp edi, ecx
jg 0x42f24f
jl 0x42f245
cmp esi, eax
jae 0x42f24f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x42f285
mov ecx, dword [ebp + 8]
jmp 0x42f28f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x42f2a9
jg 0x42f28f
test esi, esi
je 0x42f2a9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x42f2a9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42f2c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x42f2e4
jl 0x42f2d9
test ecx, ecx
jne 0x42f2e4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x42f2fe
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x42f344
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x42f34a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp + 8], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x42f34a
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x42f3b9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x42f376
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x42f3a7
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x42f3b9
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x42f383
test edi, edi
je 0x42f3b9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42f740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x42f75c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x42f78e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x42f78e
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x42f851
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x42f7b6
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42f7c2
movsx eax, bl
jmp 0x42f7fa
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x42f81a
sub eax, 1
je 0x42f81a
sub eax, 2
jne 0x42f851
movsx eax, byte [ebp - 1]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x42f838
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x42f851
lea ecx, [ebp - 1]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 8], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42fc00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x42fc22
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x42fc10
mov byte [esi + 0x12], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x11]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42fc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x42fc62
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x42fc50
mov byte [esi + 0x10], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xf]
push eax
push esi
call fcn.00430e20
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x430920
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
je 0x430942
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x2c
jb 0x430930
mov byte [esi + 0x2d], 0
pop esi
ret

Function at 0x430950
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x430972
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x5c]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x430960
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x430980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x430a0c
cmp byte [esi + 0x3d], 0
je 0x430a0c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x430a04
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4309d5
sub eax, 1
je 0x4309d9
sub eax, 2
jne 0x430a04
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4309f7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x430a04
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x432b15
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x432b54
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x432b54
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x432b54
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x432b54
cmp dword [ecx + 0x74], 0xe
jbe 0x432b54
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40b9f1
Capabilities:
Encode data using xor

Disassembly:
fidiv dword [ebx + 0x44]
mov esp, 0xda11244d
xchg ecx, eax
or dword [edi + ebp*2 - 0x4ca801b4], ebp
mov ah, 0xb3
pop esi
and ebx, dword [ebx + 0x3cfe8cf5]
push ds
inc ebp
mov ebp, 0x5bc8bec
push esp
jnp 0x40ba57
push ebx
pop esi
movsd dword es:[edi], dword [esi]
lcall 0x4444, 0x3fd465da
in al, 0x36
sal dword [ecx], cl
lds ebp, [bp + 0x4415]
shr ah, 0xba
adc eax, 0xbaecc044
pop edx
sal byte [esi - 0x398bd462], 1
lodsb al, byte [esi]
mov dword [0x56fc0aa4], eax
push esi
arpl word [eax], bx
cmp eax, 0xd4557f51
or dl, byte [edi + 0xb7c6272]
jbe 0x40ba6d
salc
aam 0x7c
invalid
jg 0x40ba89
push ss
adc ch, 0xd5
jg 0x40ba38
xor eax, 0x5c713a0f
xor eax, 0xa17416a6
cmpsb byte [esi], byte es:[edi]
invalid
sbb eax, 0xedbe0f8c
dec ebx
mov esi, 0xf7e08644
xrelease xchg byte [eax - 0x64], dh
sbb al, 0x92
pop esp
jbe 0x40ba26
jmp 0x85b7d978
inc esp
sbb dword [edi - 0x7e69294e], eax
je 0x40bae0
xlatb
xchg ebx, eax
xor eax, 0xcf440384
xchg ebp, eax
int3
test al, 0x1a
popal
daa
jmp 0x3d685127
Function at 0x43cb11
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x5fe60497
jo 0x43cb85
jo 0x43cb91
salc
and dword [eax - 0x6d], ebx
mov ebx, 0xf8379646
aaa
clc
mov ch, 0x8e
adc dword [edx + edx*2 - 0x7f], esi
or eax, 0x9abac398
xlatb
sbb edi, dword [edx - 0x243349fa]
lahf
pop ebx
or byte [edi - 0x17d2e0f6], dh
insd dword es:[edi], dx
out 0x98, al
mov ch, 0x1d
div dword [ecx - 0x6a]
cmc
lodsd eax, dword [esi]
cmp dword [edx - 0x2079cf80], esi
or eax, 0xed3184a
in eax, 0x4d
arpl word [ecx - 0xa], si
mov word [eax + ebx], gs
invalid
mov bl, cl
wait
dec esp
imul eax, dword [eax], 0xfffffff1
xchg dword [ebx + 0x1aab95a5], ebp
jbe 0x43cbd0
xor edi, edi
jecxz 0x43cb68
jmp 0xfb717192
js 0x43cb21
mov edi, edi
mov dl, 0x14
sub eax, 0xcb59c707
stc
pop edx
inc esp
mov al, byte [esi + 0x793ec6c4]
mov dword gs:[0x9f4df6d2], eax
lahf
in eax, dx
pop ebx
jp 0x43cbb1
xor dl, byte [ecx - 0x6d91c40a]
pushfd
cmp dword [ecx - 0x1251d47e], ecx
jge 0x43cb9e
in al, dx
test byte [edx], ah
cmc
in al, dx
je 0x43cb92
push esp
int 0x49
jo 0x43cbdc
cmpsb byte [esi], byte es:[edi]
je 0x43cc01
mov bl, byte [esi - 0x4a]
jb 0x43cb78
out 0x2d, eax
mov eax, dword [0x1af0e1d5]
retf
pushal
out 0x80, al
sbb byte [eax + 0x7f], dh
sub dword es:[esi + 0xd], esp
sub dword [ebp + 0x17], edi
pop ss
cld
jb 0x43cc45
dec esp
outsd dx, dword [esi]
xchg edi, eax
and byte [eax + 0x76], ch
mov edi, 0x69f92c87
cmp dword [ecx + 0x72], esp
mov eax, 0x9ed0b12a
add dword [edx + 0x5e], esi
pop ecx
mov eax, ds
or dl, byte [eax]
jge 0x43cc02
dec ebp
out 0xcf, eax
je 0x43cbdc
fidivr dword [edx + 0x45]
jp 0x43cc49
jmp 0x43cbee
add byte [edi], 0x96
invalid
popfd
pop eax
popal
push edi
adc eax, dword [ebx]
pop es
adc byte [edi + 0x29], bl
imul ebp, dword [ecx - 0x14814cc3], 0x7f
add byte [edi], cl
add byte [eax - 0xf32299], bh
push edi
mov ch, 0xed
or dword [ecx + 0x58], ecx
inc ebx
add al, cl
or byte [ebx - 0x6af315f6], ch
pop ebx
mov ah, 0x3a
je 0x43cc18
inc dword [ecx]
lea esi, [ecx]
pop ecx
pop ebp
xor dword [ecx + 0x5d], ebx
mov dh, 0x86
inc ebp
jl 0x43cc75
dec ebp
adc dh, dh
aaa
dec ecx
into
push ecx
ret 0x4318