joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a6e0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x42e168
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x50]
lea eax, [esp + 0x24]
mov esi, dword [esp + 0x54]
push edi
push eax
call fcn.0041ad90
mov dword [esp + 0x48], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov byte [esp + 0x48], 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.00414d30
lea eax, [esp + 0x14]
xorps xmm0, xmm0
push eax
lea ecx, [esp + 0x20]
movq qword [esp + 0x20], xmm0
call fcn.0040ce40
mov byte [esp + 0x48], 2
lea eax, [esp + 0x13]
push eax
push esi
push edi
mov byte [esp + 0x1f], 0
call fcn.0041a820
test al, al
jne 0x41a79c
cmp byte [esp + 0x13], al
je 0x41a79c
cmp dword [edi + 0x14], 8
jb 0x41a795
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x48], 1
lea ecx, [esp + 0x1c]
call fcn.0040ce90
mov byte [esp + 0x48], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41a7c6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp + 0x48], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x41a7e9
push dword [esp + 0x24]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0042a8a3
add esp, 0x40
ret 8
Function at 0x41bde0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42e418
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and edi, 0xffffb1af
cmp dword [esi + 0x14], 8
jb 0x41be25
mov eax, dword [esi]
jmp 0x41be27
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push eax
call ebx
test eax, eax
je 0x41be3c
mov al, 1
jmp 0x41bec7
xor eax, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x38], eax
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.0041c5e0
test al, al
je 0x41be90
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
push edi
cmovae eax, dword [esp + 0x18]
push eax
call ebx
test eax, eax
je 0x41be90
mov bl, 1
jmp 0x41be92
xor bl, bl
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x41beae
push dword [esp + 0x14]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
mov al, bl
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0042a8a3
add esp, 0x2c
ret

Function at 0x41bef0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42e448
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x41bf2c
mov eax, dword [esi]
jmp 0x41bf2e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41bfc4
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.0041c5e0
test al, al
je 0x41bf91
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x41bfad
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0042a8a3
add esp, 0x28
ret
Function at 0x41bff0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x42e448
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x41c02c
mov eax, dword [esi]
jmp 0x41c02e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x41c040
mov al, 1
jmp 0x41c0ce
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.0041c5e0
test al, al
je 0x41c097
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x41c097
mov bl, 1
jmp 0x41c099
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x41c0b5
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0042a8a3
add esp, 0x28
ret

Function at 0x41c0f0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x42e448
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x41c12c
mov eax, dword [esi]
jmp 0x41c12e
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41c142
mov al, 1
jmp 0x41c1d2
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.0041c5e0
test al, al
je 0x41c19b
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
push 0
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41c19b
mov bl, 1
jmp 0x41c19d
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x41c1b9
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0042a8a3
add esp, 0x28
ret
Function at 0x41c1f0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x42e490
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x41c22e
mov eax, dword [esi]
jmp 0x41c230
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebx
test eax, eax
je 0x41c244
mov al, 1
jmp 0x41c401
cmp dword [esi + 0x14], 8
jb 0x41c24e
mov edx, dword [esi]
jmp 0x41c250
mov edx, esi
xor eax, eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
cmp word [edx], ax
jne 0x41c280
xor ecx, ecx
jmp 0x41c294
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c285
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x3c]
call fcn.00406a10
mov dword [esp + 0x58], 0
lea ecx, [esp + 0x34]
call fcn.0041bef0
mov ebp, eax
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x48], 8
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x41c2d0
push dword [esp + 0x34]
call edi
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
cmp ebp, 0xffffffff
jne 0x41c2f3
xor al, al
jmp 0x41c401
cmp dword [esi + 0x14], 8
jb 0x41c2fd
mov eax, dword [esi]
jmp 0x41c2ff
mov eax, esi
push eax
lea ecx, [esp + 0x38]
call fcn.004065c0
mov dword [esp + 0x58], 1
xor edx, edx
lea ecx, [esp + 0x34]
call fcn.0041bde0
test al, al
sete al
mov byte [esp + 0x1b], al
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x41c341
push dword [esp + 0x34]
call edi
mov al, byte [esp + 0x1f]
add esp, 4
xor ecx, ecx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], cx
test al, al
jne 0x41c2ec
cmp dword [esi + 0x14], 8
jb 0x41c366
mov eax, dword [esi]
jmp 0x41c368
mov eax, esi
push eax
call ebx
test eax, eax
jne 0x41c23d
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], ax
mov dword [esp + 0x58], 2
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.0041c5e0
test al, al
je 0x41c3bc
cmp dword [esp + 0x48], 8
lea eax, [esp + 0x34]
cmovae eax, dword [esp + 0x34]
push eax
call ebx
test eax, eax
je 0x41c3bc
mov bl, 1
jmp 0x41c3ee
cmp dword [esi + 0x14], 8
jb 0x41c3c4
mov esi, dword [esi]
push esi
lea ecx, [esp + 0x20]
call fcn.004065c0
mov byte [esp + 0x58], 3
mov edx, ebp
lea ecx, [esp + 0x1c]
call fcn.0041bde0
mov byte [esp + 0x58], 2
lea ecx, [esp + 0x1c]
call fcn.00406620
xor bl, bl
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.00406620
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0042a8a3
add esp, 0x48
ret
Function at 0x41cc30
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x41cc5d
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0042a8a3
add esp, 8
ret 4
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41cc49
push esi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41cc97
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41cc97
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0042a8a3
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, esi
mov dword [edi], eax
mov al, 1
adc ecx, 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
pop esi
pop edi
xor ecx, esp
call fcn.0042a8a3
add esp, 8
ret 4
Function at 0x41d1f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4385c0
push 0x42af59
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x41d259
xor eax, eax
jmp 0x41d3cf
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d39a
push 1
push dword [ebp - 0x38]
call eax
test eax, eax
je 0x41d39a
push str.AllocateAndInitializeSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d39a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x41d39a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d39a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x41d39a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d39a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x41d39a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d39a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x41d39a
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x41d39a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41d383
push 0
push ecx
push 1
push dword [ebp - 0x38]
call eax
test eax, eax
je 0x41d370
mov ebx, 1
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x2c], 0
je 0x41d380
jmp 0x41d39a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x38]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0041d3f6
test ebx, ebx
jne 0x41d3cd
test esi, esi
je 0x41d3bf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41d3cd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0042a8a3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41d930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e7a7
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.RC::RCFileHash.0
mov dword [edi + 4], 0
mov dword [esp + 0x14], edi
mov byte [edi + 8], 0
mov dword [esp + 0x38], 0
mov dword [edi], vtable.RC::RCFileHashCalc.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [esp + 0x38], 2
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x20], 0
mov dword [edi], vtable.RC::RCMD5.0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x38], 3
push 8
movq qword [esp + 0x28], xmm0
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x38], 4
test eax, eax
je 0x41da05
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
call fcn.0041ce00
jmp 0x41da07
xor eax, eax
mov byte [esp + 0x38], 3
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.00414910
mov byte [esp + 0x38], 5
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041dbd0
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0xc]
call fcn.0041eb70
mov byte [esp + 0x38], 3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x41da78
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x41da78
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x41da78
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [esp + 0x38], 2
mov esi, dword [esp + 0x18]
test esi, esi
je 0x41dab7
push dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0041bc10
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0042a8a3
add esp, 0x2c
ret
Function at 0x41eee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
lea esp, [esp]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x43cb40], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x43cc40], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x43cd40], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x43ca40], al
inc esi
cmp esi, 0x100
jl 0x41eff0
pop esi
add esp, 0x80
ret

Function at 0x422dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f1ac
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xc], 0
jne 0x422e44
push 0x10
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new___unsigned_int_]
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
test eax, eax
je 0x422e37
push 0x420f50
push fcn.00414a80
push 3
lea esi, [eax + 4]
mov dword [eax], 3
push 4
push esi
call fcn.0042b5d2
jmp 0x422e39
xor esi, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [edi + 0xc], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
test eax, eax
je 0x422e58
cmp byte [ecx + eax - 1], 0xa
jne 0x422e58
dec eax
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [edi + 0xc]
lea ecx, [ecx + eax*4]
call fcn.00420f60
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0xc
Function at 0x427180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f980
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esp + 0x4c]
xorps xmm0, xmm0
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
movdqu xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x28], 0
movq qword [esp + 0x2c], xmm0
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
mov dword [esp + 0x44], 1
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
movq qword [esp + 0xc], xmm0
cmp eax, edx
je 0x427225
push 0xffffffffffffffff
push 0
push edx
mov ecx, eax
call fcn.00406660
lea eax, [esp + 0xc]
mov dword [esp + 0x30], edi
push eax
lea ecx, [esi + 0x14]
call fcn.004273e0
mov dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.0040aee0
xor al, al
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042a8a3
add esp, 0x3c
ret 0xc

Function at 0x427b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42cfc9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
cmp byte [edx], 0
jne 0x427b6c
xor esi, esi
jmp 0x427b7a
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x427b71
sub esi, ecx
push esi
push edx
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00427d10
push eax
mov ecx, edi
call fcn.00411bb0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 1
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x25814460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x2581446f
pop dword [ebp - 0x1c]
mov eax, 0x4f8faca8
sub eax, 0x2a0e6839
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2d014e8e
add dword [ebp - 0x2c], 0x2150f6bd
mov dword [ebp - 0x28], 0x3de2cddb
sub dword [ebp - 0x28], 0xbaf8196
mov dword [ebp - 0x24], 0xb78171dd
sub dword [ebp - 0x24], 0x6b352daf
mov dword [ebp - 0x20], 0x4c49a75e
add dword [ebp - 0x20], 0xb3b658a2
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xa8d95af6
sub eax, 0x83578ab2
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x7f8a9988
add dword [ebp - 0x2c], 0xf4e7cfce
mov dword [ebp - 0x28], 0x26410e6c
add dword [ebp - 0x28], 0x1b2b5309
mov dword [ebp - 0x24], 0x20b8c95e
sub dword [ebp - 0x24], 0xbd495cf2
mov dword [ebp - 0x20], 0xa5feadbf
add dword [ebp - 0x20], 0x5a015241
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x589ee079
sub eax, 0x331d0ff9
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bc81
push 0
call eax
mov ecx, 0x71731e0b
sub ecx, 0x7172d91c
xor esi, esi
add esi, eax
mov edi, 0x8c4d832a
sub edi, 0x66caed2a
add edi, dword [ebp - 0x1c]
mov ebx, 0xcc7eb1af
sub ebx, 0x54be15c6
xor dword [ebp - 0x10], eax
mov edx, dword [edi]
add dword [ebp - 0xc], ecx
add edx, ebx
xor dword [ebp - 0x10], 0x386ec01
mov dword [esi], edx
add dword [ebp - 8], 0x71005da8
add esi, 0x919505ad
sub esi, 0x919505a9
add edi, 0x609417df
add edi, 0x9f6be825
loop 0x25814593
add eax, 0xabf0ccf2
add eax, 0x5410399d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4e24eff7
add ecx, 0xd75b1009
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret