joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3d30
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x30]
mov dword [esi], vtable.CFilterCoder.10.0
mov dword [esi + 4], vtable.CFilterCoder.9.0
mov dword [esi + 8], vtable.CFilterCoder.8.0
mov dword [esi + 0xc], vtable.CFilterCoder.7.0
mov dword [esi + 0x10], vtable.CFilterCoder.6.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.4.0
mov dword [esi + 0x1c], vtable.CFilterCoder.3.0
mov dword [esi + 0x20], vtable.CFilterCoder.2.0
mov dword [esi + 0x24], vtable.CFilterCoder.1.0
mov dword [esi + 0x28], vtable.CFilterCoder.0
test eax, eax
je 0x423006
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x74]
test ecx, ecx
je 0x42301a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x42302e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x423042
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x423056
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 4
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x42306a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 5
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x42307e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 6
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x423092
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 7
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x4230a6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4239f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push dword [ebp + 0xc]
push 0x424dd0
push 0
push 0
call fcn.004af800
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x423a20
xor eax, eax
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x423a70
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x14]
call fcn.004a5802
push dword [esi + 0x1c]
call fcn.004a5802
mov eax, dword [esi + 0x10]
add esp, 8
cmp eax, 0xffffffff
je 0x423aa0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x423aa0
mov dword [esi + 0x10], 0xffffffff
cmp byte [esi], 0
je 0x423adb
push edi
mov edi, dword [esi + 4]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x423aca
xor al, al
pop edi
push dword [esi + 4]
xor al, 1
mov byte [esi], al
call fcn.004a5802
add esp, 4
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop edi
setne al
xor al, 1
mov byte [esi], al
push dword [esi + 4]
call fcn.004a5802
add esp, 4
pop esi
ret
Function at 0x423ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3db8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x10]
cmp eax, 0xffffffff
je 0x423ce8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x423e6d
mov dword [edi + 0x10], 0xffffffff
mov eax, dword [edi + 0x18]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 0x18], 0xffffffff
test eax, eax
je 0x423d38
mov edx, dword [edi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00424d80
add esp, 4
test eax, eax
jne 0x423e72
mov edx, dword [edi + 0x14]
or ecx, 0xffffffff
push 0x515de0
push dword [edi + 0x18]
call dword [0x5154dc]
mov ebx, dword [edi + 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
jmp 0x423d41
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp byte [edi + 0x28], 0
mov dword [ebp - 0x10], ebx
je 0x423e15
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov dword [ebp - 4], 0
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x20], esi
setne al
test al, al
je 0x423e45
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x34]
ja 0x423e08
jb 0x423d92
cmp ebx, dword [edi + 0x30]
jae 0x423e08
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0x100000
push dword [edi + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423e45
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x423e05
mov edx, dword [edi + 0x14]
mov ecx, dword [ebp + 8]
push ebx
call fcn.00424d80
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x423e40
mov edx, dword [edi + 0x14]
mov ecx, dword [ebp - 0x18]
push 0x515de0
push ebx
call dword [0x5154dc]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
add eax, ebx
mov dword [ebp - 0x10], eax
adc ecx, 0
mov dword [ebp - 0x14], ecx
cmp ecx, dword [edi + 0x34]
jb 0x423d92
ja 0x423e05
cmp eax, dword [edi + 0x30]
jb 0x423d92
mov ebx, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x423e15
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov eax, dword [ebp - 0x18]
cmp dword [edi + 0x38], eax
jne 0x423e6d
cmp ebx, dword [edi + 0x30]
jne 0x423e6d
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x34]
jne 0x423e6d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x1c]
jmp 0x423e4a
mov edi, 0x80004005
cmp esi, 0xffffffff
je 0x423e57
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x426140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3fdc
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], vtable.ICompressSetBufSize.0
lea eax, [ecx + 0x10]
mov dword [ecx + 8], 0
mov dword [ecx], vtable.NCompress::NBcj2::CDecoder.1.0
mov dword [ecx + 4], vtable.NCompress::NBcj2::CDecoder.0
mov dword [ebp - 0x10], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x18], 0
lea eax, [ecx + 0x30]
mov dword [ebp - 0x10], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x18], 0
lea eax, [ecx + 0x50]
mov dword [ebp - 0x10], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x18], 0
lea eax, [ecx + 0x70]
mov dword [ebp - 0x10], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x18], 0
lea eax, [ecx + 0x4a0]
mov dword [ebp - 0x10], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x20], 0
mov eax, ecx
mov dword [ecx + 0x4d8], 0x10000
mov dword [ecx + 0x4c8], 0x100000
mov dword [ecx + 0x4cc], 0x100000
mov dword [ecx + 0x4d0], 0x100000
mov dword [ecx + 0x4d4], 0x100000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x427f80
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0x105
jg 0x427f97
push 0x105
call fcn.004037f0
push dword [esi]
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [esi]
xor edx, edx
cmp word [edi], dx
je 0x427fba
mov ecx, edi
nop
lea ecx, [ecx + 2]
inc edx
cmp word [ecx], 0
jne 0x427fb0
xor ecx, ecx
dec eax
mov word [edi + edx*2], cx
mov ecx, 0x103
cmp ecx, eax
mov dword [esi + 4], edx
pop edi
sbb eax, eax
inc eax
pop esi
ret

Function at 0x427fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [esi + 8], 0x105
jg 0x427fff
push 0x105
mov ecx, esi
call fcn.004037f0
push dword [esi]
push 0
push 0x4edae8
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor edx, edx
cmp word [edi], dx
je 0x42802a
mov ecx, edi
nop word [eax + eax]
lea ecx, [ecx + 2]
inc edx
cmp word [ecx], 0
jne 0x428020
xor ecx, ecx
mov word [edi + edx*2], cx
pop edi
mov dword [esi + 4], edx
pop esi
pop ebp
ret
Function at 0x428040
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x428070
mov edi, dword [esi + 4]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x428060
xor al, al
jmp 0x42806c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
xor al, 1
mov byte [esi], al
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.00427fe0
mov edi, eax
add esp, 4
test edi, edi
je 0x428092
push dword [ebp + 0x10]
lea ecx, [esi + 4]
call fcn.004064f0
mov byte [esi], 1
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4280f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, 0x400000
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebx], 0
nop
cmp esi, 0x400000
mov dword [ebp + 0x10], 0
push 0
mov eax, esi
cmova eax, edx
lea edx, [ebp + 0x10]
push edx
push eax
push edi
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [ebx], ecx
test eax, eax
je 0x428158
test ecx, ecx
je 0x42814d
add edi, ecx
mov edx, 0x400000
sub esi, ecx
mov ecx, dword [ebp - 4]
jne 0x428110
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x428640
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx + 0x30], 0
lea esi, [ecx + 0x70]
mov dword [ecx + 0x4c], 0
xor edx, edx
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], 0
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
dec ecx
shr eax, 1
not ecx
inc edx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x428677
pop esi
ret

Function at 0x42c780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x42c796
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ca70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], edi
movzx esi, word [edi]
movzx ecx, word [edi + 2]
mov eax, esi
shr eax, 4
xor esi, 0x7f0
shr esi, 4
mov eax, dword [ebx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [ebx + eax*4]
add eax, dword [ebx + esi*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + ecx*4]
add eax, dword [ebx + esi*4]
xor esi, esi
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x10], esi
cmp esi, dword [ebp + 8]
jae 0x42cbe4
mov edx, esi
mov dword [ebp - 8], 0
mov esi, dword [ebp - 8]
or edx, 8
nop dword [eax]
mov eax, dword [ebp - 4]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 4]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x42cae0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
add eax, esi
mov esi, dword [ebp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov dword [ebp + 0x10], esi
cmp esi, 8
jb 0x42cac4
cmp esi, 0x10
jae 0x42cb8a
lea eax, [esi - 8]
mov dword [ebp - 8], eax
nop dword [eax + eax]
cmp esi, dword [ebp + 8]
jae 0x42cbe4
mov edx, eax
xor esi, esi
or edx, 8
mov eax, dword [ebp - 4]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 0x104]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x42cb40
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add eax, esi
mov esi, dword [ebp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
cmp esi, 0x10
jb 0x42cb30
cmp esi, dword [ebp + 8]
jae 0x42cbe4
lea eax, [esi - 0x10]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 0x14]
xor edi, edi
or eax, 0x100
nop
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [esi + edx*2 + 0x204]
shr ecx, 4
xor ecx, eax
mov eax, edx
add edi, dword [ebx + ecx*4]
cmp eax, 1
jne 0x42cba0
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
cmp esi, dword [ebp + 8]
jb 0x42cb95
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
mov dword [ebp - 0x10], ecx
lea edx, [ecx + 0x32550]
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0xc], edx
push edi
nop word [eax + eax]
xor ebx, ebx
mov dword [ebp - 4], 4
mov edi, eax
lea eax, [ebx + 1]
nop
movzx edx, word [ecx + eax*2 + 0x32bf4]
mov esi, edi
and esi, 1
shr edx, 4
mov ecx, esi
shr edi, 1
neg ecx
add eax, eax
sar ecx, 4
or eax, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [ebp - 0x10]
add ebx, dword [ecx + edx*4 + 0x30ea0]
sub dword [ebp - 4], 1
jne 0x42e770
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov dword [edx], ebx
add edx, 4
mov dword [ebp - 0xc], edx
cmp eax, 0x10
jb 0x42e760
pop edi
pop esi
mov dword [ecx + 0x32590], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 4
push edi
mov edi, ecx
mov dword [ebp - 0x208], ebx
nop dword [eax]
nop word [eax + eax]
movzx ecx, byte [edi + ebx + 0x306a0]
mov esi, 1
mov eax, ecx
mov dword [ebp - 0x218], ecx
mov edx, ecx
shr eax, 1
dec eax
mov dword [ebp - 0x20c], 0
and edx, 1
mov dword [ebp - 0x210], eax
or edx, 2
mov ecx, eax
shl edx, cl
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x214], edx
test eax, eax
je 0x42e8a0
mov ebx, eax
mov eax, esi
mov edx, ecx
sub eax, dword [ebp - 0x218]
and edx, 1
add eax, dword [ebp - 0x214]
add esi, esi
shr ecx, 1
or esi, edx
mov dword [ebp - 0x210], ecx
movzx ecx, word [edi + eax*2 + 0x32b0e]
mov eax, edx
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp - 0x20c]
add eax, dword [edi + ecx*4 + 0x30ea0]
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x20c], eax
sub ebx, 1
jne 0x42e844
mov ebx, dword [ebp - 0x208]
jmp 0x42e8a2
xor eax, eax
mov dword [ebp + ebx*4 - 0x204], eax
inc ebx
mov dword [ebp - 0x208], ebx
cmp ebx, 0x80
jb 0x42e800
lea eax, [ebp - 0x204]
mov dword [ebp - 0x21c], edi
sub eax, edi
mov dword [ebp - 0x210], 4
lea esi, [edi + 0x31950]
sub eax, 0x31d50
lea edx, [edi + 0x31d58]
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], eax
nop word [eax + eax]
xor ebx, ebx
mov dword [ebp - 0x214], ebx
cmp dword [edi + 0x32594], ebx
jbe 0x42e970
mov eax, ebx
xor esi, esi
mov ebx, dword [ebp - 0x21c]
or eax, 0x40
nop dword [eax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebx + edx*2 + 0x32910]
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [edi + ecx*4 + 0x30ea0]
cmp eax, 1
jne 0x42e920
mov ebx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x208]
mov dword [eax + ebx*4], esi
inc ebx
mov dword [ebp - 0x214], ebx
cmp ebx, dword [edi + 0x32594]
jb 0x42e910
mov edx, dword [ebp - 0x20c]
mov esi, eax
mov ecx, 0xe
cmp dword [edi + 0x32594], ecx
jbe 0x42e996
nop dword [eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x32594]
jb 0x42e980
mov eax, dword [esi]
mov ecx, 4
mov ebx, dword [ebp - 0x218]
mov dword [edx - 8], eax
mov eax, dword [esi + 4]
mov dword [edx - 4], eax
mov eax, dword [esi + 8]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 4], eax
add edx, 8
nop word [eax + eax]
movzx eax, byte [edi + ecx + 0x306a0]
lea edx, [edx + 4]
inc ecx
mov eax, dword [esi + eax*4]
add eax, dword [edx + ebx - 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x42e9c0
mov edx, dword [ebp - 0x20c]
add esi, 0x100
sub dword [ebp - 0x21c], 0xffffff80
add edx, 0x200
sub ebx, 0x200
mov dword [ebp - 0x208], esi
sub dword [ebp - 0x210], 1
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], ebx
jne 0x42e900
mov ecx, dword [ebp - 4]
mov dword [edi + 0x3bcf8], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004a578d
mov esp, ebp
pop ebp
ret
Function at 0x42f990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push dword [ebp + 8]
push edx
push 0
push 0
call fcn.004af800
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x42f9ba
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x42fad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x42faec
mov eax, dword [ebp - 4]
jmp 0x42fbc7
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x42fba2
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e8c10]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e8c10]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e8c10]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e8c10]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e8c10]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e8c10]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e8c10]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4e8c10]
dec ebp
jne 0x42fb0c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x42fbbe
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4e8c10]
dec ecx
jne 0x42fbac
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fe90
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d419b
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [esi + 0x50]
mov ecx, eax
mov dword [esi + 0x4c], 7
mov dword [ebp - 0xe8], eax
call fcn.0041ca30
lea eax, [esi + 0x54]
mov ecx, eax
mov dword [ebp - 0xe4], eax
call fcn.0041ca30
lea ecx, [esi + 0x58]
call fcn.0041ca30
lea eax, [esi + 0x5c]
mov ecx, eax
mov dword [ebp - 0xec], eax
call fcn.0041ca30
mov byte [esi + 0x48], 0
test ebx, ebx
je 0x430074
mov dword [ebp - 0xd8], 0
push 0x100
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0
call fcn.004330d0
mov edi, dword [ebp - 0xd8]
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xdc], 0x44
push eax
push edi
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xe0], 0x80
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x42ffd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x430030
cmp dword [ebp - 0xdc], 0x44
jbe 0x42ff8f
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ebp - 0xe0]
cmp eax, 0x80
jbe 0x42ffae
push eax
lea ecx, [ebp - 0xd8]
call fcn.004321b0
mov edi, dword [ebp - 0xd8]
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0xe0]
push eax
push edi
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x430030
lea eax, [ebp - 0x54]
mov byte [esi + 0x48], 1
push eax
lea eax, [esi + 4]
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x430030
mov ecx, dword [ebp - 0xe4]
push edi
call fcn.0041cd80
mov ecx, dword [ebp - 0xe8]
push ebx
call fcn.0041cd80
mov ecx, dword [ebp - 0xec]
push 0
call fcn.0041cd80
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x43002c
lea ecx, [ebp - 0xd8]
call fcn.00433100
mov al, 1
jmp 0x430076
lea ecx, [esi + 0x50]
mov dword [esi + 0x4c], 7
call fcn.0041ca30
lea ecx, [esi + 0x54]
call fcn.0041ca30
lea ecx, [esi + 0x58]
call fcn.0041ca30
lea ecx, [esi + 0x5c]
call fcn.0041ca30
lea eax, [ebp - 0xd4]
mov byte [esi + 0x48], 0
cmp dword [ebp - 0xd8], eax
je 0x430074
lea ecx, [ebp - 0xd8]
call fcn.00433100
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret 8