joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bd34
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x467a0c]
cmp byte [eax + 0xc], 0
je 0x43bea1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43be9a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x468af8], 0
jne 0x43bd88
push 0x43bea8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x43beb0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468af8], eax
cmp dword [0x466ae8], 0
jne 0x43be83
push 0x43bec0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x466ae8], eax
cmp dword [0x466ae8], 0
je 0x43be83
push 0x43becc
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468afc], eax
push 0x43bedc
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b00], eax
push 0x43bef0
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b04], eax
push 0x43bf08
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b08], eax
push 0x43bf20
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b0c], eax
push 0x43bf34
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b10], eax
push 0x43bf4c
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b14], eax
push 0x43bf64
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b18], eax
push 0x43bf80
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b1c], eax
push 0x43bf8c
mov eax, dword [0x466ae8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x468b20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43bea1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43fd54
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403e4c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43fda3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x447574
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4475c4]
test si, 4
je 0x447588
or bl, 1
test si, 8
je 0x447592
or bl, 4
test si, 1
je 0x44759c
or bl, 8
test si, 2
je 0x4475a6
or bl, 0x10
test si, 0x10
je 0x4475b0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4475bf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4475c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x447600]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4475e1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4475f0
or bl, 4
test esi, 0x20000000
je 0x4475fb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44dcdc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44dcee
add esp, 0xfffffff0
call fcn.00403420
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419148
mov eax, dword [0x4676f0]
mov dword [eax + 4], ebx
mov dword [eax], 0x44e080
mov eax, dword [0x4676fc]
mov dword [eax + 4], ebx
mov dword [eax], 0x44e08c
mov eax, ebx
call fcn.0044e098
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411440]
call fcn.004030cc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411440]
call fcn.004030cc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411440]
call fcn.004030cc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411440]
call fcn.004030cc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411440]
call fcn.004030cc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44a4b0
push eax
push 0
push 0
mov eax, dword [0x467830]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41ab54]
call fcn.0041c2ec
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41ab54]
call fcn.0041c2ec
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41ab54]
call fcn.0041c2ec
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044e50c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e3d4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e3d4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e3d4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44de2b
call fcn.00403478
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44e194
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e364
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44e345
mov dl, 1
mov eax, dword [0x41185c]
call fcn.004030cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e4c
lea eax, [ebp - 0x118]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
mov dword [ebp - 0x10], eax
dec ebx
test ebx, ebx
jl 0x44e334
inc ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.0043c094
test al, al
jne 0x44e231
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44e327
xor edx, edx
push ebp
push 0x44e320
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44e251
mov ebx, dword [ebp - 0x10]
jmp 0x44e253
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov dword [ebp - 0x260], ebx
mov byte [ebp - 0x25c], 0
lea ecx, [ebp - 0x260]
mov edx, 0x44e374
lea eax, [ebp - 0x258]
call fcn.0040892c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44e309
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x44e3ac
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44e309
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x218]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44e309
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x218]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e327
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x18], 4
dec dword [ebp - 0x14]
jne 0x44e212
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415338
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e36b
lea eax, [ebp - 0x264]
call fcn.00403e4c
ret
Function at 0x44ecac
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x468b44]
cmp byte [eax + 0xa5], 0
jne 0x44ed1d
cmp dword [0x468b5c], 0
jne 0x44ecde
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44ec68
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x468b5c], eax
cmp dword [0x468b58], 0
jne 0x44ecf9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x468b58], eax
cmp dword [0x468b60], 0
jne 0x44ed1d
push esp
push 0
push 0
push 0x44ec0c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x468b60], eax
pop edx
ret

Function at 0x44f3b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x468b44]
cmp dword [eax + 0x30], 0
je 0x44f45a
cmp dword [ebx + 0x94], 0
jne 0x44f454
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44f340
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44f454
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44f41a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44f454
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004137a8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44f429
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44ffb8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44ffed
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f3c
jmp 0x44fffa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ea0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45110c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45114d
mov eax, esi
call fcn.004376c0
test al, al
je 0x45114d
mov eax, dword [ebx + 0x84]
call fcn.004373bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45114d
push 0
mov eax, dword [ebx + 0x84]
call fcn.004373bc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x454838
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x454866
mov eax, ebx
call fcn.004552ec
cmp dword [ebx + 0x40], 0
je 0x45485f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4548d7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4548c9
cmp dword [ebx + 8], 0
je 0x454888
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45489a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4548c9
cmp dword [ebx + 8], 0
je 0x45487b
cmp eax, 3
je 0x4548ad
dec eax
jne 0x45487b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45487b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45487b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4548f5
cmp dword [ebx + 0x14], 0xcc
je 0x4548f5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00454900
pop ebx
ret
Function at 0x3415a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x34180d
jne 0x34180d
je 0x3411e6
jne 0x3412ed
add byte [eax], al
add byte [eax], al
Function at 0x343620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x23c
mov edi, dword [ebp + 0xc]
je 0x3437a8
jne 0x3437a8
Function at 0x344860
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x3448b6
jne 0x3448b6
jmp 0x3ea083b2
inc ebp
cmp ebp, dword [esi + edi + 0x18]
jb 0x3448d7
xor eax, eax
jmp 0x344890
mov eax, dword [esp]
je 0x34487c
jne 0x34487c
jmp 0x6840ff8f
movzx ecx, word [eax + ebp*2]
xor eax, eax
cmp dword [esi + edi + 0x14], ecx
jb 0x344890
mov eax, dword [esi + edi + 0x1c]
je 0x3448f9
jne 0x3448f9
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + edi + 0x24]
mov ebx, dword [esi + edi + 0x20]
xor ebp, ebp
je 0x34491b
jne 0x34491b
je 0x3424da
jne 0x34140a
push eax
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, dword [edx]
cmp dword [ecx + 0x7c], 0
je 0x344890
je 0x344938
jne 0x344938
je 0x34369f
jne 0x342cb7
je 0x1df4d66
mov eax, dword [ebx + ebp*4]
add eax, esi
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x20]
call dword [eax + 0x24]
je 0x344907
invalid
jne 0x344907
je 0x34268a
jne 0x342922
jmp 0x3c2558a
lea ecx, [esi + ecx*4]
add esi, dword [eax + ecx]
mov eax, esi
je 0x344890
jne 0x344890
je 0x84440990
test eax, eax
je 0x344874
invalid
je 0x344869
jne 0x344869
add eax, esi
add ebx, esi
mov dword [esp], eax
nop word cs:[eax + eax]
nop dword [eax]
je 0x3448d7
jne 0x3448d7
add byte [eax], al
add byte [eax], al
mov esi, dword [edx + 4]
mov edi, dword [ecx + 0x78]
cmp dword [edi + esi + 0x18], 0
je 0x344890
cmp dword [esi + edi + 0x14], 0
je 0x344890
je 0x34489c
jne 0x34489c
push ebp
push ebx
je 0x344a05
jne 0x344a05
je 0x3c8a3b
mov dword [eax + 8], 0
mov dword [eax + 0x10], 0
mov ebx, ecx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
je 0x3449d8
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ecx + 0x2474ffcb], cl
and bh, bh
je 0x3449ab
and byte [eax + 0x74], dl
dec ebp
jne 0x3449d8
je 0x3413d2
jne 0x34363b
add byte [eax], al
add byte [eax], al
test edi, edi
je 0x3449fb
push 0x8000
push 0
push edi
call dword [ebx + 0xc]
je 0x3449fb
or al, 0x74
dec ebp
jne 0x3449fb
jmp 0x8170a740
mov ebx, dword [ebp + 0x3c]
cmp dword [ebp + ebx], 0x4550
jne 0x3449fb
mov edi, dword [esp + 0x14]
add ebx, ebp
push 4
je 0x3449ca
jne 0x3449ca
push 0x3000
push 0x14
push 0
je 0x344a1c
jne 0x344a1c
jmp 0xec77322d
push ecx
call fcn.00343620
add esp, 0x10
test eax, eax
je 0x3449f0
mov esi, edi
mov dword [edi + 0x10], 1
jmp 0x3449fb
je 0x34499d
jne 0x34499d
pop ebx
pop ebp
ret
mov eax, esi
pop esi
pop edi
je 0x3449f4
jne 0x3449f4
je 0x6cbfa060
push edi
push esi
mov ebp, dword [esp + 0x18]
and al, 0x18
xor esi, esi
movzx eax, word [ebp]
cmp eax, 0x5a4d
jne 0x3449fb
je 0x3449b1
jne 0x3449b1
call dword [edi]
mov ecx, edi
mov dword [eax + 4], ebp
mov dword [eax], ebx
mov edi, eax
mov dword [eax + 0xc], 0
je 0x344970
jne 0x344970
nop word [eax + eax]
ret
Function at 0x347f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1400
call fcn.00384b40
mov eax, dword [esp + 0x1418]
movdqa xmm4, xmmword [0x38a290]
movdqa xmm6, xmmword [0x38a2a0]
mov esi, 0xfffffc00
pxor xmm2, xmm2
nop
movdqa xmm3, xmm4
movdqa xmm7, xmmword [0x38a2c0]
movdqa xmm0, xmm4
movdqa xmm1, xmm4
movdqa xmm5, xmm4
pand xmm3, xmm6
psrld xmm0, 6
pand xmm1, xmmword [0x38a320]
pcmpeqd xmm3, xmm2
pand xmm3, xmmword [0x38a2b0]
pcmpeqd xmm1, xmm2
pand xmm1, xmmword [0x38a330]
pxor xmm0, xmm3
movdqa xmm3, xmm4
pand xmm3, xmm7
movdqa xmm7, xmmword [0x38a2e0]
pcmpeqd xmm3, xmm2
pand xmm3, xmmword [0x38a2d0]
pand xmm5, xmm7
movdqa xmm7, xmmword [0x38a350]
pcmpeqd xmm5, xmm2
pand xmm5, xmmword [0x38a2f0]
pxor xmm3, xmm0
pand xmm0, xmm6
pcmpeqd xmm0, xmm2
pxor xmm1, xmm5
movdqa xmm5, xmm4
pand xmm5, xmmword [0x38a340]
pcmpeqd xmm5, xmm2
pand xmm5, xmm7
pxor xmm5, xmm1
movdqa xmm1, xmm4
paddd xmm4, xmmword [0x38a2e0]
pand xmm1, xmmword [str._b_b_b_b]
pxor xmm5, xmm3
pand xmm3, xmmword [0x38a2c0]
pcmpeqd xmm1, xmm2
pcmpeqd xmm3, xmm2
pand xmm1, xmmword [0x38a310]
pand xmm3, xmm7
pxor xmm5, xmm1
movdqa xmm1, xmm0
pand xmm0, xmmword [0x38a370]
pandn xmm1, xmmword [0x38a360]
psrld xmm5, 2
por xmm0, xmm1
pxor xmm0, xmm5
pxor xmm0, xmm3
movdqu xmmword [esp + esi + 0x400], xmm0
add esi, 0x10
jne 0x347fb0
mov esi, eax
mov eax, 0xfffffc00
shr esi, 2
nop word [eax + eax]
mov ebx, dword [esp + eax + 0x400]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
mov dword [esp + eax + 0x800], ebx
add eax, 4
jne 0x3480d0
mov eax, dword [esp]
mov edi, dword [esp + 0x400]
xor ebp, ebp
mov ebx, eax
shr ebx, 8
nop
mov ecx, eax
xor ecx, ebp
movzx ecx, cl
mov ecx, dword [esp + ecx*4]
xor ecx, ebx
movzx edx, cl
shr ecx, 8
xor ecx, dword [esp + edx*4]
movzx edx, cl
shr ecx, 8
mov edx, dword [esp + edx*4]
xor edx, edi
xor edx, ecx
mov dword [esp + ebp*4 + 0x800], edx
inc ebp
cmp ebp, 0x100
jne 0x348110
movzx eax, al
Function at 0x349d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
je 0x349fb2
jne 0x349fb2
jmp 0x4c1869b

Function at 0x34adf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
je 0x34b0ab
jne 0x34b0ab
je 0x3493c2
jne 0x34a2d9
add byte [eax], al
add byte [eax], al
push ebx
push edi
push esi
je 0x34b126
jne 0x34b126
add byte [eax], al
add byte [eax], al
Function at 0x350d80
Capabilities:
Check os version
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
je 0x350e62
jne 0x350e62
add byte [eax], al
add byte [eax], al
jmp 0x350e82
je 0x350e7d
jne 0x350e7d
je 0x350acf
jne 0x350cec
je 0xeb455141
fmul qword [edi]
test byte [edi + 0x5b], bl
ret 4
lea ecx, [ebx + 0x14]
push eax
je 0x350e55
jne 0x350e55
jmp 0x2e9c0781
je 0x350deb
jne 0x350deb
add byte [eax], al
add byte [eax], al
test eax, eax
je 0x350e43
je 0x350e88
jne 0x350e88
jmp 0x893954aa
mov dword [esi + 4], eax
mov eax, esi
pop esi
push 0x350db9
ret
call fcn.00384b2a
add esp, 4
mov edi, eax
jmp 0x350e14
mov dword [esi], edi
mov eax, dword [ebx + 0x10]
je 0x350e1d
jne 0x350e1d
jmp 0x3543c8b9
push ecx
push edi
call fcn.00345df0
push 0x350eac
ret
je 0x350e6a
je 0x350ea4
jne 0x350ea4
je 0x10596af9
mov ebx, dword [esp + 0x10]
mov esi, ecx
mov eax, dword [ebx + 0x10]
add eax, 3
push eax
jmp 0x350e37
mov eax, 0xfffffffe
je 0x350e0c
jne 0x350e0c
je 0x83455217
mov eax, dword [ebx + 0x10]
add eax, 2
push 0x350e96
ret
rol byte [edx], 0x68
xchg esi, eax
push cs
xor eax, 0x840fc300
je 0x350d98
push 0x350df4
ret
jne 0x350e6a
jmp 0x350e68
Function at 0x3674a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x1d], ch
test byte [eax + eax], dh
ret
jmp fcn.003663fd
pop edi
pop ebx
pop ebp
jmp 0x366730
setne cl
mov eax, ecx
test eax, eax
je 0x366c9f
jne 0x366c9f
mov eax, dword [esi + 4]
mov dword [eax + 0x418], 0
je 0x366ffc
jmp 0x36702a
push dword [esi + 4]
call dword [sym.imp.HDWOMH_6aod_OddwmGzmpl_ieUfephml]
mov eax, 1
pop esi
pop edi
je 0x366ff8
jne 0x366ff8
add esp, 8
push 0x36723e
ret
ret 8
jmp 0x366fda
jne 0x366ffc
je 0x36658a
jmp 0x3670de
jne 0x366964
invalid
jmp 0x36751a
push ebp
push ebx
je 0x367545
jne 0x367545
jmp 0x36ad0d8d
push 0x367698
ret
push ecx
call fcn.00344860
add esp, 0xc
jmp 0x367790
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
mov esi, ecx
lea ecx, [esp + 8]
je 0x3676a5
jne 0x3676a5
jmp 0xbefa74
push eax
push ebx
jmp 0x367529
mov edi, esp
mov ecx, edi
push 0x39fb6d
call fcn.00350d80
je 0x3677e6
jne 0x3677e6
je 0x366fc7
jne 0x36605b
je 0x34827f
invalid
push 0x39fb57
call fcn.00350d80
je 0x36766a
jne 0x36766a
add byte [eax], al
add byte [eax], al
push 0x367634
ret
lea ecx, [esi + 0x10]
je 0x3675bf
jne 0x3675bf
je 0x366d05
jne 0x36694e
jmp 0x36ac505d
je 0x367521
jne 0x367521
jmp 0x5e473c24
mov ecx, edi
call fcn.00350f90
je 0x3676d5
jne 0x3676d5
add byte [eax], al
add byte [eax], al
push 0x3676c1
ret
Function at 0x372fc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push esi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov esi, dword [edx]
mov dword [eax + 0x10], esi
mov esi, dword [edx + 4]
mov dword [eax + 0x14], esi
mov esi, dword [edx + 8]
mov dword [eax + 0x18], esi
mov esi, dword [edx + 0xc]
mov dword [eax + 0x1c], esi
lea esi, [edx + 0x10]
cmp ecx, 0x100
cmovne esi, edx
mov ecx, str.expand_32_byte_kexpand_16_byte_k
mov edx, 0x38a690
cmove edx, ecx
mov ecx, dword [esi]
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 0x24], ecx
mov ecx, dword [esi + 8]
mov dword [eax + 0x28], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx]
mov esi, dword [edx + 4]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
pop esi
ret

Function at 0x3730f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov dword [esp + 0x78], ecx
mov eax, dword [edx]
mov dword [esp + 0x38], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0x44], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x4c], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0x50], eax
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x54], eax
mov eax, dword [edx + 0x20]
mov dword [esp + 0x58], eax
mov eax, dword [edx + 0x24]
mov dword [esp + 0x5c], eax
mov ebp, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
mov edi, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x74], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x68], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov ebp, dword [esp + 0x54]