joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405dd6
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x41e6ec], esi
jle 0x405e28
mov eax, dword [0x41e6e8]
mov eax, dword [eax + esi*4]
add eax, 0xc
push eax
lea ecx, [ebp - 0xc]
call fcn.00411a4a
lea ecx, [ebp - 0xc]
call fcn.0040558a
mov eax, dword [0x41e6e8]
push dword [ebp - 0xc]
mov eax, dword [eax + esi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
inc esi
pop ecx
cmp esi, dword [0x41e6ec]
jl 0x405de7
pop esi
leave
ret
Function at 0x406fee
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
mov esi, ecx
push edx
push eax
push eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.00406fa9
pop esi
pop ebp
ret 4

Function at 0x408be2
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.004074e6
test eax, eax
jne 0x408c00
push eax
push eax
push esi
push 0x408225
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
push dword [0x41e698]
mov ecx, esi
push dword [esi + 4]
call fcn.0040785a
push 0x2d
pop ecx
call fcn.00403d24
push eax
push 0x4b2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov ecx, esi
call fcn.0040785a
pop esi
ret
Function at 0x4090df
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, 0x4b6
push edi
mov esi, ecx
call fcn.00407874
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
add eax, 2
push edi
mov ecx, esi
mov dword [esi + 0x58], eax
call fcn.00407906
push 1
inc edi
push edi
mov ecx, esi
call fcn.00407906
and dword [ebp - 0x2c4], 0
push 0x2b0
lea eax, [ebp - 0x2c0]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push 0
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2c4]
push edi
push dword [esi + 4]
mov dword [esi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x407fdb
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
mov dword [esi + 0x54], eax
call fcn.00408da6
mov ecx, esi
mov edi, eax
call fcn.004084f0
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40a340
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
lea ebp, [ebx + 0x1c]
shr ebx, 2
mov eax, ebx
shr eax, 1
push esi
add eax, 3
xor esi, esi
mov dword [esp + 0xc], ebp
mov dword [ecx], eax
test ebx, ebx
je 0x40a36f
mov eax, dword [edx]
mov dword [ecx + esi*4 + 0x10], eax
inc esi
add edx, 4
cmp esi, ebx
jb 0x40a361
cmp esi, ebp
jae 0x40a460
mov edx, esi
sub edx, ebx
lea eax, [ecx + edx*4 + 0x10]
mov dword [esp + 0x14], eax
push edi
xor edx, edx
mov eax, esi
div ebx
mov edi, dword [ecx + esi*4 + 0xc]
test edx, edx
jne 0x40a3ed
movzx eax, byte [eax + 0x41c1a8]
mov edx, edi
and edx, 0xff
movzx edx, byte [edx + str.cw]
mov ebp, edi
shr ebp, 0x18
movzx ebp, byte [ebp + str.cw]
shl edx, 8
or edx, ebp
mov ebp, edi
shr ebp, 0x10
shr edi, 8
and ebp, 0xff
movzx ebp, byte [ebp + str.cw]
and edi, 0xff
movzx edi, byte [edi + str.cw]
shl edx, 8
or edx, ebp
mov ebp, dword [esp + 0x10]
shl edx, 8
xor edi, eax
or edi, edx
jmp 0x40a443
cmp ebx, 6
jbe 0x40a443
cmp edx, 4
jne 0x40a443
mov edx, edi
shr edx, 0x10
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov edx, edi
shr edx, 0x18
movzx edx, byte [edx + str.cw]
shl edx, 8
or eax, edx
mov edx, edi
shr edx, 8
and edx, 0xff
movzx edx, byte [edx + str.cw]
shl eax, 8
and edi, 0xff
movzx edi, byte [edi + str.cw]
or eax, edx
shl eax, 8
or edi, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, edi
mov dword [ecx + esi*4 + 0x10], edx
inc esi
add eax, 4
mov dword [esp + 0x18], eax
cmp esi, ebp
jb 0x40a384
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x40b510
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
xor ebx, ebx
mov ebp, edx
cmp edi, 0x38
je 0x40b545
jmp 0x40b530
and edi, 0x3f
jne 0x40b53b
push esi
call fcn.0040b050
mov byte [esi + edi + 0x28], bl
inc edi
cmp edi, 0x38
jne 0x40b530
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.0040b050
xor eax, eax
mov ecx, dword [esi + eax*4 + 4]
mov edx, dword [esi + eax*4]
bswap edx
bswap ecx
mov dword [ebp], edx
mov dword [ebp + 4], ecx
add eax, 2
add ebp, 8
cmp eax, 8
jb 0x40b567
pop edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret
Function at 0x40b750
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
push esi
mov esi, ecx
cmp dword [esi], 0x3f
jne 0x40b7b6
xor eax, eax
cmp dword [esi + 4], eax
jbe 0x40b770
mov cl, byte [esi + eax + 8]
mov byte [esi + eax + 0x20], cl
inc eax
cmp eax, dword [esi + 4]
jb 0x40b762
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jbe 0x40b791
cmp eax, 0x20
jae 0x40b8b9
mov edx, dword [esi + 0x18]
mov dl, byte [ecx + edx]
mov byte [eax + esi + 0x20], dl
inc ecx
inc eax
cmp ecx, dword [esi + 0x1c]
jb 0x40b777
cmp eax, 0x20
jae 0x40b8b9
mov edx, 0x20
sub edx, eax
push edx
lea ecx, [eax + esi + 0x20]
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
pop esi
add esp, 0x74
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
push ebx
push ebp
lea eax, [eax + ecx + 8]
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
cmp eax, ebp
je 0x40b7da
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, eax
mov edx, dword [esi + 4]
push edx
lea eax, [esi + 8]
push eax
push ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 4]
push ecx
push edx
add eax, ebx
push eax
call sub.msvcrt.dll_memcpy
mov edi, dword [esi + 4]
add edi, ebx
add edi, dword [esi + 0x1c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov ecx, dword [esi]
add esp, 0x18
mov eax, 1
xor edx, edx
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call fcn.004192a0
mov ebp, eax
mov dword [esp + 0x18], edx
lea esp, [esp]
mov ecx, dword [esp + 0x10]
push ecx
mov edx, ebx
lea ecx, [esp + 0x20]
call fcn.0040b260
xor eax, eax
inc byte [eax + edi]
jne 0x40b88d
inc eax
cmp eax, 8
jb 0x40b882
mov eax, dword [esp + 0x18]
add ebp, 0xffffffff
adc eax, 0xffffffff
mov edx, ebp
or edx, eax
mov dword [esp + 0x18], eax
jne 0x40b870
lea edx, [esi + 0x20]
lea ecx, [esp + 0x1c]
call fcn.0040b510
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x74
ret
Function at 0x40c480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [eax]
push edi
mov ebp, ecx
xor edi, edi
and esi, 7
mov dword [esp + 0xc], ebp
cmp edx, 5
jae 0x40c4a7
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 0xc
add dword [esp + 0x18], 5
push ebx
lea ebx, [edx - 4]
add ebx, ebp
mov dword [esp + 0x14], ebx
lea edx, [edi + ebp]
cmp edx, ebx
jae 0x40c4cf
lea ecx, [ecx]
mov cl, byte [edx]
and cl, 0xfe
cmp cl, 0xe8
je 0x40c4cf
inc edx
cmp edx, ebx
jb 0x40c4c0
mov ecx, edx
sub ecx, edi
mov edi, edx
sub ecx, ebp
sub edi, ebp
cmp edx, ebx
jae 0x40c5bb
cmp ecx, 2
jbe 0x40c527
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x40c5ac
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
mov ecx, dword [esp + 0x1c]
lea ebp, [edi + ecx]
add edi, 5
cmp dword [esp + 0x24], 0
je 0x40c550
add eax, ebp
jmp 0x40c552
shr esi, cl
test esi, esi
je 0x40c4e8
cmp esi, 4
ja 0x40c545
cmp esi, 3
je 0x40c545
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0x40c4e8
or esi, 8
shr esi, 1
inc edi
jmp 0x40c4b6
sub eax, ebp
test esi, esi
je 0x40c586
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x40c580
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [esp + 0x24], 0
je 0x40c57e
add eax, ebp
jmp 0x40c580
sub eax, ebp
mov ebx, dword [esp + 0x14]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x40c4b6
mov ebp, dword [esp + 0x10]
or esi, 8
shr esi, 1
inc edi
jmp 0x40c4b6
pop ebx
cmp ecx, 2
jbe 0x40c5d4
mov edx, dword [esp + 0x1c]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebp
add esp, 8
ret 0xc
mov edx, dword [esp + 0x1c]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebp
add esp, 8
ret 0xc
Function at 0x41100b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411031
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x411031
xor al, al
jmp 0x411046
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x418c70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420ae0], ecx
inc edx
cmp edx, 0x100
jb 0x418c72
cmp edx, 0x800
jae 0x418d49
lea esp, [esp]
mov eax, dword [edx*4 + 0x4206e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420ae0]
inc edx
mov dword [edx*4 + 0x420adc], eax
cmp edx, 0x800
jb 0x418d20
mov eax, 0x419760
mov dword [0x420ad4], eax
mov dword [0x422ae0], eax
mov dword [0x420ad0], 0x419680
call fcn.00418f80
test eax, eax
jne 0x418d75
mov dword [0x422ae0], 0x419680
ret

Function at 0x419080
Capabilities:
Check os version

Disassembly:
sub esp, 0x134
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4190a7
cmp dword [esp + 0x24], 5
sbb eax, eax
inc eax
jne 0x4190b0
xor eax, eax
add esp, 0x134
ret
lea ecx, [esp]
call fcn.00418ee0
test eax, eax
je 0x4190a7
mov eax, dword [esp + 0x18]
shr eax, 0x19
and eax, 1
add esp, 0x134
ret
Function at 0x41933f
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x41c8c8
call fcn.00419618
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x419393
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x419393
movzx ecx, word [eax + 0x400018]
cmp ecx, 0x10b
je 0x4193ab
cmp ecx, 0x20b
je 0x419398
mov dword [ebp - 0x1c], ebx
jmp 0x4193c2
cmp dword [eax + 0x400084], 0xe
jbe 0x419393
xor ecx, ecx
cmp dword [eax + 0x4000f8], ebx
jmp 0x4193bc
cmp dword [eax + 0x400074], 0xe
jbe 0x419393
xor ecx, ecx
cmp dword [eax + 0x4000e8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x422ae8], edi
mov dword [0x422aec], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x420acc]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x420ac8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x422ae4], eax
call fcn.00419614
cmp dword [0x41e640], ebx
jne 0x41941f
push fcn.00419614
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00419602
push 0x41a408
push 0x41a404
call sub.msvcrt.dll__initterm
mov eax, dword [0x420ac4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x420ac0]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x41a400
push 0x41a394
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x4194aa
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x41948a
cmp cl, 0x22
jne 0x41947b
cmp byte [eax], 0x22
jne 0x419493
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x41949e
cmp cl, 0x20
jbe 0x41948f
test byte [ebp - 0x54], 1
je 0x4194b5
movzx ecx, word [ebp - 0x50]
jmp 0x4194b8
cmp byte [eax], 0x20
jbe 0x419493
inc eax
mov dword [ebp - 0x20], eax
jmp 0x4194aa
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00406f63
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x4194d6
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x419512
mov eax, esi
jmp 0x419526
call fcn.00419653
ret
Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
sar byte [eax + 0x1505], cl
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4

Function at 0x409e90
Capabilities:
Encode data using xor

Disassembly:
daa
je 0x409ed3
invalid
push edi
mov edi, ecx
call fcn.00424d1b
xor byte [ebx + 0x56], dl
or eax, 0xffffffff
lea ecx, [ebp - 0x2c]
add byte [esi - 0x77], ah
inc ebp
in al, dx
xor eax, dword [ebp - 0x20]
test eax, eax
jge 0x409eb2
push 0x64
mov word [ebp - 0x12], ax
call 0x1196280
cmovge edx, dword [eax]
call 0x8b414150
inc esi
or byte [esi], cl
cmp dword [ebx], edi
inc edx
jmp 0x409e9d

Function at 0x40b577
Capabilities:
Encode data using xor

Disassembly:
add eax, dword [eax]
push dword [ebp + 0x51]
mov dword [ecx + 0xc], eax
cmp eax, 7
jg 0x44ffd0
je 0x40b58f
call 0x4429218
mov eax, dword [ecx]
leave
enter 0x57e8, 0x59
leave
ret
pushfd
shr eax, 0xad
add byte [eax], al
jne 0x40b5e9
test esi, esi
je 0x40b646
xor ecx, dword [ecx - 0x1d08f7ba]
inc eax
dec ebp
invalid
mov ecx, eax
sub eax, dword [ebx - 0x4914ef3c]
call 0x4542f9d0
clc
jne 0x40b5d1
call dword [ecx + 8]
mov ecx, esi
fstp qword [ebp - 8]
call 0x5703cfb0
fld qword [ebp - 8]
xor eax, eax
fstp qword [esi]
mov dword [esi - 0x75], 0x7d8b03
pop esi
or al, 0
or byte [ecx], bl
dec ebp
add byte [ebp + 0x60], dh
xor ecx, dword [ecx - 0x1d08f7ba]
inc eax
dec ebp
invalid
fld qword [ebp - 8]
xor eax, eax
fstp qword [esi]
mov dword [esi - 0x75], 0x7d8b03
pop esi
or al, 0
or byte [ecx], bl
sub eax, 9
je 0x450008
sub eax, 1
je 0x450001
sub eax, 1
jne 0x40b5d5
mov ecx, dword [ecx]
cmp dword [ecx], 8
jg 0x40b5d5
mov edx, dword [ecx]
lea eax, [ebp - 8]
mov ecx, dword [ecx + 4]
push eax
call fcn.0046ecbf
jmp 0x40b5c6
mov eax, dword [ecx]
mov eax, dword [eax + 4]
leave
ret
cmp byte [ecx], 0
je 0x40b5d5
xor eax, eax
inc eax
leave
ret

Function at 0x41fe4b
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x41fe86
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x41fe7f
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x41fe8b
add edx, 0x28
cmp edx, esi
jne 0x41fe70
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x41fe88
Function at 0x4237b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
push esi
push edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebp
push edx
push eax
push ecx
push ecx
push 0x423830
push dword fs:[0x20000]
mov eax, dword [0x4cc014]
xor eax, esp
mov dword [esp + 8], eax
mov dword fs:[0x20000], esp
invalid
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 8]
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx]
mov esi, dword [eax + 0xc]
cmp esi, 0xfffffffe
je 0x423832
mov edx, dword [esp + 0x34]
cmp edx, 0xfffffffe
je 0x423804
cmp esi, edx
jbe 0x423832
lea esi, [esi + esi*2]
lea ebx, [ebx + esi*4 + 0x10]
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
cmp dword [ebx + 4], 0
jne 0x4237e2
push 0x1c20b901
mov eax, dword [ebx + 8]
call fcn.004247cc
mov ecx, 0x1c200001
mov eax, dword [ebx + 8]
call fcn.004247eb
jmp 0x4237e2
pop dword fs:[0xf1f18b56]
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x42d786
Capabilities:
Encode data using base64

Disassembly:
push 0x18
push 0x4c89a0
call fcn.00420a40
mov edi, dword [ebp + 0xc]
cmp edi, 0xf18b4000
je 0x42d7cd
cmp edi, 0x3008000
je 0x42d7cd
cmp edi, 0x56ecb800
je 0x42d7cd
cmp edi, 0x4b800
je 0x42d7cd
cmp edi, 0x2b800
je 0x42d7cd
call fcn.0042f2e9
mov dword [eax], 0xf18b16
jmp 0x44d886
mov esi, dword [ebp + 8]
cmp esi, 0xfffffffe
jne 0x42d7e5
call fcn.0042f2e9
mov dword [eax], 0xe8530009
jmp 0x242d88b
test esi, esi
js 0x5ef87b
cmp esi, dword [0x4d11e8]
jae 0x2042d87b
mov ecx, esi
sar ecx, 6
mov dword [ebp - 0x20], ecx
mov eax, esi
and eax, 0x3f
imul edx, eax, 0x30
mov dword [ebp - 0x24], edx
mov eax, dword [ecx*4 + 0x4d0fe8]
movzx eax, byte [eax + edx + 0x28]
and eax, 1
je 0x42d87b
push esi
call fcn.00435157
pop ecx
or ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax*4 + 0x4d0fe8]
mov ecx, dword [ebp - 0x24]
test byte [eax + ecx + 0x28], 1
jne 0x42d84f
call fcn.0042f2e9
mov dword [eax], 0xe8530009
jmp 0x42d85d
push edi
push esi
call 0xf6b594
pop ecx
pop ecx
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
call 0x242d873
mov eax, ebx
jmp 0x42d88e
call fcn.0042f2e9
mov dword [eax], 0xe8530009
call 0xff8f27fc
or eax, 0xffffffff
call fcn.00420a86
ret
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc], eax
jge 0x408fc9
cmp edi, dword [esi + 0x7c]
jae 0x44a9e7
movzx ecx, word [edi]
add edi, 2
cmp dword [ebp - 0x28], 0
mov edx, ecx
je 0x44d868
mov eax, ecx
and eax, 0xf1fc00
cmp eax, 0xd800
jne 0x44d868
movzx eax, word [edi]
and edx, 0x8b5603ff
shl edx, 0xa
and eax, 0x8b5603ff
or edx, eax
add edi, 2
add edx, 0x4c010000
mov eax, edx
shr eax, 7
movzx ecx, byte [eax - 0x74b400c0]
mov eax, edx
and eax, 0x7f
shl ecx, 7
add ecx, eax
movzx eax, word [ecx*2 + 0x4b1c40]
movzx eax, byte [eax*8 + 0x4af3f1]
mov eax, dword [eax*4 + 0x4c5350]
cmp eax, 1
je 0x44d8a8
cmp eax, 3
je 0x44d8a8
cmp edx, 0x5f
je 0x44d8a8
xor eax, eax
jmp 0x44d8ad
mov eax, 1
cmp eax, dword [ebp - 0x3c]
je 0x408fc9
mov eax, dword [ebp + 0x18]
mov edx, ebx
inc dword [ebp - 0xc]
inc eax
push eax
push dword [ebp + 0x14]
mov ecx, edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408820
add esp, 0x14
test eax, eax
je 0x44d81b
jmp 0x4089eb
Function at 0x46968e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fe1b
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00420e30
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x4696e9
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x4696e0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x472016
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4d2630], ecx
inc esi
mov edx, esi
mov eax, dword [edx*4 + 0x4d262c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x4d2630], eax
inc edx
cmp edx, 0xf10270
jl 0x472022
mov dword [0x4d06e0], esi
mov dword [0x4d2ff0], esi
pop esi
ret

Function at 0x472056
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x472079
push 0
call fcn.0042e4f8
pop ecx
mov ecx, eax
call fcn.00472016
mov dword [0x4d06e0], 0xf10270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0xf10634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x47208e
mov eax, dword [esi]
mov dword [ebp - 4], 0xf1018c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x4720c8
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
mov ebx, 0x40915c
nop
mov ecx, 0x5dd1771d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..7LWLf
mov ebx, 0x42f3f8
nop
mov ecx, 0x5923663a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219