joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495af0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
pop ebp
ret

Function at 0x495b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
Function at 0x4974d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.00412c70
add esp, 8
cmp dword [ebp - 0xc], 0
je 0x497513
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x497513
test al, 0x10
je 0x497513
mov bl, 1
jmp 0x497515
xor bl, bl
lea ecx, [ebp - 0x1c]
call fcn.00401bf0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0049920c
mov esp, ebp
pop ebp
ret
Function at 0x497740
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x497912
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3f0
jne 0x497912
push edi
mov ecx, esi
call fcn.00498350
mov edi, eax
cmp edi, 0xffffffff
je 0x497909
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xffffffff
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4978f5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x4978eb
test eax, eax
je 0x4978eb
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4977f6
call ebx
cmp eax, 0x7a
jne 0x4978eb
push dword [ebp - 4]
call fcn.0049923d
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp - 4]
push ebx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4978e2
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4978e2
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x4978e2
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x497868
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4978eb
push dword [ebp - 4]
call fcn.0049923d
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4978cf
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4978cf
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x4978cf
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x18]
cmp eax, 1
sete bl
call fcn.00499246
push dword [ebp - 8]
call fcn.00499246
add esp, 8
test bl, bl
jne 0x4978f5
jmp 0x4978eb
push ebx
call fcn.00499246
push dword [ebp - 8]
call fcn.00499246
add esp, 8
jmp 0x4978eb
push ebx
call fcn.00499246
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [esi], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x497909
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497d40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b797
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x497e07
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x497e15
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x497e15
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00498240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
Function at 0x497e40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7432
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x232]
xor ebx, ebx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], ebx
call fcn.00497740
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x4d6d48], bl
jne 0x497f01
xor eax, eax
mov dword [ebp - 0x230], ebx
push str.Support_GetWinSpecialFoldersFromReg
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
call fcn.00498240
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 1
mov ebx, 1
push eax
mov dword [ebp - 0x238], ebx
call fcn.0048acf0
add esp, 4
mov byte [ebp - 0x231], 0
test al, al
je 0x497f08
mov byte [ebp - 0x231], 1
mov dword [ebp - 4], 0
test bl, 1
je 0x497f56
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x497f56
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x497f4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x497f4c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004991fe
add esp, 8
cmp byte [ebp - 0x231], 0
lea eax, [ebp - 0x218]
je 0x497f7e
push 0xa
push 0xffffffffffffffff
push 0
push 0x104
push eax
push dword [ebp + 0xc]
call fcn.00497940
add esp, 0x18
jmp 0x497f8c
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x218]
push eax
call fcn.00498240
cmp byte [ebp - 0x232], 0
je 0x497fc2
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
Function at 0x498350
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7470
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x244], 0xffffffff
push eax
mov dword [ebp - 0x248], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x498566
cmp dword [ebp - 0x248], 0xffffffff
je 0x498566
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp eax, 0xffffffff
je 0x498529
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x49849d
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov edi, edi
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call esi
add esp, 8
test eax, eax
jne 0x49847b
cmp edi, ebx
je 0x49845c
mov eax, dword [ebp - 0x234]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x258], edi
jmp 0x49847b
lea eax, [ebp - 0x234]
push eax
push edi
lea ecx, [ebp - 0x25c]
call fcn.00401e60
mov ebx, dword [ebp - 0x254]
mov edi, dword [ebp - 0x258]
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x498430
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 0x24c], esi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x498529
lea ecx, [ecx]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0xffffffff
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x498514
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x248]
jne 0x498514
push dword [esi]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x498514
lea ecx, [ebp - 0x244]
push ecx
push 0xf
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x250]
test eax, eax
jne 0x49851d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, edi
jne 0x4984b0
jmp 0x498523
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24c]
mov edi, dword [ebp - 0x244]
test esi, esi
je 0x498562
sub ebx, esi
mov eax, esi
and ebx, 0xfffffffc
cmp ebx, 0x1000
jb 0x498558
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x498558
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebx
push esi
call fcn.004991fe
add esp, 8
mov eax, edi
jmp 0x49856c
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
Function at 0x4988b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.LdpLookupEx__r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop ebp
jmp fcn.004988d0
Function at 0x40ec7a
Capabilities:
Hash data with md5

Disassembly:
xor dword [0x451678], 0xa7ae62f1
mov dword [ecx], 0
and dword [0x450d44], 0x888020
mov dword [ecx + 4], 0
imul eax, dword [0x451544], 0x8ff3654a
mov dword [0x451544], eax
mov dword [ecx + 8], 0x67452301
add dword [0x457c64], 0xbf1efdbc
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x44c81c]
lea edx, [eax - 1]
mov dword [0x44c81c], edx
cmp eax, 0x58b97e25
jl 0x40ecf6
mov eax, dword [0x4530f8]
shl eax, 9
add eax, 0xda670d4e
cmp eax, 0xbb59afb9
jg 0x40ed01
mov word [0x448b86], 0xa02
jmp 0x40ed0b
and word [0x445d90], 0xfa7a
jmp 0x40ed0b
xor dword [0x4533a0], 0xadfad9bc
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [0x45568c]
lea edx, [eax + 1]
mov dword [0x45568c], edx
add eax, 0x46fc0acb
or eax, 0x62f761f1
imul eax, dword [0x455bd4]
mov dword [0x455bd4], eax
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x44e078]
lea ecx, [eax + 1]
mov dword [0x44e078], ecx
add eax, 0xa4ba3d4c
mov ecx, dword [0x450b98]
lea edx, [ecx + 1]
mov dword [0x450b98], edx
and ecx, 0x3bd5da52
cmp eax, ecx
jne 0x40ed74
mov dword [0x458e5c], 0xa444d03
ret
movsx eax, word [0x444a2e]
imul eax, eax, 0x105218d6
xor eax, 0x90c47f17
mov dword [0x44dd44], eax
ret

Function at 0x40f014
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [0x44bcf0]
sar edx, 2
and edx, 0xd5520dee
add dword [0x458b80], edx
add word [0x44738a], 0xf790
movzx edx, word [0x447ee0]
lea esi, [edx - 1]
mov word [0x447ee0], si
add edx, 0xdc6
imul dx, word [0x447f90]
mov word [0x447f90], dx
mov edx, dword [0x458ca0]
dec edx
mov dword [0x458ca0], edx
mov dword [0x4596d8], edx
mov edx, dword [0x44e4dc]
sar edx, 4
add edx, 0x5ddc9673
imul edx, dword [0x450a80]
mov dword [0x450a80], edx
mov ebx, eax
shr ebx, 8
mov edx, dword [0x459188]
or edx, 0xe8c7
movzx esi, word [0x44804e]
add esi, edx
mov word [0x44804e], si
mov esi, eax
shr esi, 0x10
test ecx, 0x3fffffff
je 0x40f182
mov edx, dword [esp + 0x14]
shl ecx, 2
mov edi, dword [0x44ed24]
lea ebp, [edi + 1]
mov dword [0x44ed24], ebp
imul edi, edi, 0x8e7b47f9
and edi, 0xfa5c7f82
cmp edi, 0x47b77b6c
jg 0x40f0f6
mov di, word [0x447862]
shl esi, 0x10
shl ebx, 8
movzx edi, bx
or edi, esi
movzx esi, al
lea ebx, [esi + edi]
xor dword [edx], ebx
or dword [0x455088], 0x450050
shr ebx, 7
shl eax, 0x19
shr edi, 0xf
or word [0x444c68], 0x85f4
mov esi, dword [0x457c34]
lea ebp, [esi - 1]
mov dword [0x457c34], ebp
mov ebp, dword [0x44bf78]
sub esi, ebp
movzx ebp, word [0x4460ee]
add ebp, esi
mov word [0x4460ee], bp
movzx ebp, bl
lea esi, [eax + ebx]
lea ebx, [edi + ebx]
mov eax, dword [0x450cf4]
or dword [0x450898], 0xbfbeffe7
movzx eax, bl
add eax, ebp
add dword [0x44ccec], 0xfa6bd58d
add edx, 4
shr esi, 0x10
add ecx, 0xfffffffc
jne 0x40f0cc
or dword [0x44c7e8], 0x9b1157d0
shl esi, 0x10
shl ebx, 8
movzx ecx, bx
or ecx, esi
movzx eax, al
or eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4121a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
mov eax, dword [0x4502d0]
lea ecx, [eax - 1]
mov dword [0x4502d0], ecx
imul eax, eax, 0xbb0b3358
movsx ecx, word [0x448808]
lea edx, [ecx + 1]
mov word [0x448808], dx
or ecx, eax
cmp ecx, 0xc30c0180
jl 0x4121e5
or word [0x44a6ac], 0xbbeb
mov esi, dword [esp + 0x20]
mov eax, dword [0x450a54]
lea ecx, [eax + 1]
mov dword [0x450a54], ecx
and eax, 0x435d
movzx ecx, word [0x446b4c]
xor ecx, eax
mov word [0x446b4c], cx
mov dword [0x452a9c], 0x2323f19a
xor edi, edi
test ebx, ebx
jle 0x4123ad
mov ebp, dword [esp + 0x1c]
inc ebx
xor edi, edi
mov dword [esp], ebx
imul eax, dword [0x44e458], 0x8f23bcb0
mov dword [0x44e458], eax
mov eax, dword [0x453990]
sar eax, 1
cmp eax, 0xfa75edcd
jg 0x412263
movsx eax, word [0x4474c6]
lea edx, [eax + 1]
mov word [0x4474c6], dx
or eax, 0x68b1d3b1
add dword [0x457e10], eax
mov ax, word [0x4464e8]
add dword [0x4568b4], 0x138eb48c
mov eax, dword [esp + 0x24]
mul dword [ebp]
mov ecx, dword [0x451df8]
and ecx, 0x72db
movzx ebx, word [0x448dfa]
add ebx, ecx
mov word [0x448dfa], bx
and word [0x44648a], 0xe941
and word [0x44763a], 0x3bbe
add word [0x44568a], 0x6ebd
add eax, edi
mov edi, edx
adc edi, 0
mov ecx, dword [0x456720]
sar ecx, 0xa
add ecx, 0x927c2c8c
cmp ecx, 0x813e81
jl 0x4122ee
mov ecx, dword [0x454a80]
inc ecx
mov dword [0x454a80], ecx
imul ecx, ecx, 0x15039b46
or ecx, 0xa3740f4b
and dword [0x458db8], ecx
add eax, dword [esi]
mov ecx, dword [0x44dd08]
movsx edx, word [0x445c14]
lea ebx, [edx + 1]
mov word [0x445c14], bx
or ecx, edx
imul ecx, dword [0x451f40]
mov dword [0x451f40], ecx
cmp eax, dword [esi]
adc edi, 0
add word [0x446f1e], 0x57b2
mov ecx, dword [0x450558]
dec ecx
mov dword [0x450558], ecx
mov edx, dword [0x45624c]
sar edx, 5
imul edx, ecx
movzx ecx, word [0x44af02]
inc ecx
mov word [0x44af02], cx
movsx ecx, cx
and ecx, edx
cmp ecx, 0x29061593
jl 0x412369
imul ecx, dword [0x44e1e4], 0x5dcbd639
mov dword [0x44e1e4], ecx
mov dword [esi], eax
mov eax, dword [0x44bf08]
mov ecx, 0xa314729c
xor eax, ecx
cmp eax, 0x5198e389
mov ebx, dword [esp]
jg 0x412393
movsx eax, word [0x448130]
xor eax, 0x27c4dd74
and dword [0x4554f4], eax
add ebp, 4
add esi, 4
add dword [0x457c98], 0xafab2b41
dec ebx
cmp ebx, 1
jg 0x412227
xor dword [0x44c924], 0x14b1210f
movsx eax, word [0x44966c]
shr eax, 2
or eax, 0x9f62
xor eax, 0x2011
movzx ecx, word [0x44551c]
sub ecx, eax
mov word [0x44551c], cx
mov eax, 0x9a93adec
mov ecx, dword [0x454ac0]
xor ecx, eax
sub dword [0x4549f4], ecx
add dword [esi], edi
xor dword [0x44c388], 0x60672460
mov ecx, dword [esi]
cmp ecx, edi
sbb edx, edx
and edx, 1
mov ebx, dword [0x451cf8]
movzx ebp, word [0x446a10]
xor ebp, ebx
mov word [0x446a10], bp
add esi, 4
mov ebx, dword [0x44cc8c]
lea ebp, [ebx + 1]
or ebx, 0x811741
cmp ecx, edi
mov dword [0x44cc8c], ebp
mov dword [0x44bbdc], ebx
mov edi, edx
jb 0x4123e0
movsx eax, word [0x446578]
mov ecx, dword [0x453b58]
lea edx, [ecx - 1]
mov dword [0x453b58], edx
xor eax, ecx
cmp eax, 0x21a0b75b
jl 0x412462
mov ax, word [0x446902]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420234
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
mov eax, dword [0x453d40]
lea ecx, [eax - 1]
mov dword [0x453d40], ecx
and eax, 0x8d69d820
sub dword [0x456c38], eax
mov eax, dword [0x457738]
sar eax, 7
mov ecx, dword [0x45752c]
sub ecx, eax
add dword [0x44cff0], ecx
cmp dword [0x45a510], 0
jne 0x420310
mov eax, dword [0x450c84]
lea ecx, [eax + 1]
mov dword [0x450c84], ecx
movsx ecx, word [0x44a980]
add ecx, 0xd01f5241
cmp eax, ecx
jge 0x4202ac
mov eax, 0x213171b0
add eax, dword [0x4577a8]
cmp eax, 0x770a270e
jg 0x4202be
dec dword [0x459a9c]
jmp 0x4202c7
imul eax, dword [0x455f30], 0xdb98ae2c
add dword [0x456244], eax
jmp 0x4202c7
or word [0x44521c], 0xb16
call fcn.00403614
mov dword [0x45a510], eax
mov eax, dword [0x454f18]
lea ecx, [eax + 1]
mov dword [0x454f18], ecx
add eax, 0xc09be67a
movsx ecx, word [0x448bf4]
and ecx, eax
cmp ecx, 0xded7d8f6
jg 0x420310
mov eax, dword [0x44f8c8]
cmp eax, 0xffd6a886
je 0x420310
imul eax, dword [0x44f320], 0x8c2fc7a5
mov dword [0x44f320], eax
mov ebx, dword [esp + 0x10]
add word [0x444bf4], 0x6374
push 3
push 0x1e95
call fcn.0040a2b7
add esp, 8
mov edi, eax
movsx eax, word [0x44a444]
movzx ecx, word [0x446880]
dec ecx
mov word [0x446880], cx
movsx ecx, cx
add ecx, 0xdbb10a2a
or ecx, eax
cmp ecx, 0xbe4e8067
je 0x420360
add word [0x446af2], 0xe53e
push edi
push ebx
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, eax
xor word [0x4464f2], 0xffdb
push edi
push 3
call fcn.0040342e
add esp, 8
movsx eax, word [0x4472e0]
and eax, 0xa8de02dc
xor dword [0x457b7c], eax
test esi, esi
je 0x4203a5
mov eax, dword [0x458ed0]
and dword [0x44e7f0], eax
jmp 0x420458
imul eax, dword [0x452f4c], 0x53c3464c
mov dword [0x452f4c], eax
push 0x3e8
call dword [0x444198]
mov eax, 0x15f67a3a
add eax, dword [0x4503a8]
or eax, dword [0x4550e4]
xor dword [0x44f608], eax
push 3
push 0x1e95
call fcn.0040a2b7
add esp, 8
mov edi, eax
imul eax, dword [0x4555f4], 0x99c7426a
mov dword [0x4555f4], eax
push edi
push ebx
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, eax
mov eax, 0x557d3405
xor eax, dword [0x44ee38]
add dword [0x452f68], eax
push edi
push 3
call fcn.0040342e
add esp, 8
imul eax, dword [0x4511c4], 0x6cc15b00
add eax, 0xda379521
cmp eax, 0xf4b0bfbf
jg 0x420440
add dword [0x44f78c], 0xcc1695a3
jmp 0x420449
mov word [0x4492ce], 0x6820
mov eax, dword [0x458ed0]
and dword [0x44e7f0], eax
test esi, esi
je 0x42049f
mov dword [0x454e6c], 0xa5589d70
push esi
push 1
push 4
push 0x45a510
call sub.msvcrt.dll_fwrite
add esp, 0x10
movsx eax, word [0x449956]
xor eax, 0x788f1efb
or dword [0x4576ec], eax
push esi
call sub.msvcrt.dll_fclose
add esp, 4
movsx eax, word [0x4490ca]
sar eax, 0xa
and dword [0x453700], eax
add dword [0x454e5c], 0xdeffe4ff
pop esi
pop edi
pop ebx
ret
Function at 0x421190
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [0x453404]
mov esi, dword [0x459098]
shl esi, 4
mov edi, dword [0x457078]
sar edi, 8
add esi, edx
add esi, edi
sub dword [0x44fd1c], esi
mov edx, 0x648297b4
add edx, dword [0x44ee18]
imul edx, dword [0x44e2f0]
mov dword [0x44e2f0], edx
cmp dword [eax], ecx
jae 0x42120e
imul ecx, dword [0x451dec], 0x9ac7687d
mov dword [0x451dec], ecx
mov ecx, dword [eax]
movsx edx, word [0x447a34]
sar edx, 5
imul edx, edx, 0x23413bc0
mov esi, dword [0x44bf5c]
lea edx, [esi + edx + 0x4b312f76]
mov dword [0x44bf5c], edx
or dword [0x44ed8c], 0xc0513912
mov esi, dword [eax]
or dword [0x457d6c], 0xc4976f66
mov edx, esi
sub edx, ecx
je 0x42125b
lea edi, [eax + 8]
mov ebx, dword [0x451114]
dec ebx
mov dword [0x451114], ebx
imul ebx, ebx, 0x3346a536
or dword [0x4550a0], ebx
mov bl, byte [ecx + edi]
mov byte [edi], bl
xor dword [0x450a4c], 0xe0532ef5
dec esi
inc edi
cmp ecx, esi
jne 0x42122d
mov ecx, dword [0x453248]
not ecx
mov esi, dword [0x44b930]
sar esi, 1
add esi, ecx
movsx ecx, word [0x4496ea]
and ecx, 0xc0e14cc3
cmp esi, ecx
jge 0x421299
mov ecx, dword [0x455e14]
lea esi, [ecx + 1]
mov dword [0x455e14], esi
xor ecx, 0x2da7851e
sub dword [0x44eb80], ecx
mov dword [eax], edx
or word [0x4451c2], 0x7b6d
pop esi
pop edi
pop ebx
ret 8
Function at 0x423adc
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], ecx
add word [0x4471e8], 0x2a
movsx eax, word [0x4448ac]
lea ecx, [eax + 1]
mov word [0x4448ac], cx
add eax, 0x466bee57
mov ecx, dword [0x4589b0]
mov edx, dword [0x44c05c]
lea esi, [edx + 1]
mov dword [0x44c05c], esi
sub ecx, edx
cmp eax, ecx
jge 0x423b2a
add dword [0x450cac], 0xb0ed92d3
mov ebp, dword [esp + 0x24]
mov eax, 0xad17fd6c
xor eax, dword [0x44d82c]
cmp eax, 0x913893e7
jl 0x423b4a
mov dword [0x4544c8], 0x47f36c97
mov eax, dword [0x451294]
dec eax
mov dword [0x451294], eax
movzx ecx, word [0x4449fc]
xor ecx, eax
xor ecx, 0x7516
mov word [0x4449fc], cx
test ebp, ebp
je 0x423cd4
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
lea eax, [ebx + 8]
mov dword [esp], eax
or word [0x446784], 0xd1c6
mov ecx, dword [esp + 4]
push ebp
push ebx
call fcn.0040f326
mov edi, eax
add dword [0x4588a8], 0xa406e28a
cmp edi, ebp
jle 0x423bc8
movzx eax, word [0x44b520]
dec eax
mov word [0x44b520], ax
cwde
sub dword [0x44e404], eax
add dword [0x44e12c], 0x5264a3c2
mov edi, ebp
jmp 0x423bee
mov eax, dword [0x451fc8]
mov ecx, 0xef53f465
xor eax, ecx
cmp eax, 0x98f8fdd1
jl 0x423be4
add word [0x4481e0], 0x2846
add dword [0x44de0c], 0xda6c22ca
mov eax, dword [0x455ca0]
cmp eax, 0x6d8d3cb
je 0x423c44
mov eax, dword [0x44dd90]
lea ecx, [eax - 1]
mov dword [0x44dd90], ecx
mov ecx, dword [0x458d88]
lea edx, [ecx - 1]
mov dword [0x458d88], edx
movsx edx, word [0x4496e8]
mov ebx, esi
lea esi, [edx + 1]
mov word [0x4496e8], si
mov esi, ebx
imul edx, ecx
mov ecx, 1
sub ecx, eax
add ecx, dword [0x4529c8]
add ecx, edx
mov dword [0x4529c8], ecx
test edi, edi
mov eax, dword [esp]
mov ecx, edi
mov edx, esi
je 0x423c6b
mov dword [0x450d0c], 0x1852f6fe
mov bl, byte [eax]
xor byte [edx], bl
or word [0x44841c], 0xf58e
inc edx
inc eax
dec ecx
jne 0x423c4f
mov eax, dword [0x455f98]
cmp eax, 0x24602f26
jne 0x423ca2
mov eax, dword [0x44e224]
inc eax
mov dword [0x44e224], eax
movzx ecx, word [0x449262]
inc ecx
mov word [0x449262], cx
movsx ecx, cx
and ecx, eax
xor ecx, dword [0x44d374]
sub dword [0x454f48], ecx
push edi
mov ebx, dword [esp + 0x20]
push ebx
call fcn.00421190
add dword [0x44e9ec], 0x83f0d6f3
add esi, edi
or word [0x445abe], 0xe322
add dword [0x45510c], 0x98e4bb83
sub ebp, edi
jne 0x423b81
movsx eax, word [0x4443ce]
lea ecx, [eax - 1]
mov word [0x4443ce], cx
sub dword [0x44f32c], eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc