joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007f713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100d7204
call fcn.100cece0
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.1007f8eb
xor edi, edi
cmp eax, edi
jne 0x1007f8da
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x1007f76b
push 1
pop eax
jmp 0x1007f76d
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.100786d5
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x1007f8bf
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x1007f892
cmp word [eax + 0x20], 1
jne 0x1007f892
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.10080f40
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.10092a20
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.1007e9a8
test eax, eax
jne 0x1007f8aa
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1007f826
cmp byte [ebx + 0x2c], 0
je 0x1007f8c5
xor eax, eax
cmp byte [edi + eax], 0
jne 0x1007f8c5
inc eax
cmp eax, 0x14
jb 0x1007f816
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x1007f83e
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.10080ecb
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.10092a20
test eax, eax
jne 0x1007f8aa
cmp byte [ebp + 0x17], al
je 0x1007f892
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x1007f8a6
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x1007f8a6
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x1007f892
cmp dword [eax + 0x24], 1
jne 0x1007f892
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x1007f88a
test al, al
je 0x1007f8c5
test al, al
je 0x1007f892
test cl, cl
je 0x1007f8ae
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x1007f8bf
jmp 0x1007f792
xor cl, cl
jmp 0x1007f86a
mov esi, eax
jmp 0x1007f8cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
push 1
pop eax
jmp 0x1007f8da
cmp byte [ebp + 0x17], 0
je 0x1007f8ca
push 1
pop esi
jmp 0x1007f8cc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1008095a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100d729c
call fcn.100cece0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10080ade
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10080ade
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
call fcn.10092a20
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.10092a20
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [esi + 2], al
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.10092a20
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10092a20
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.10092a20
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.10092a20
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.10092a20
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.10092a20
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.100034b3
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10080f88
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d731b
call fcn.100cece0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100851fe
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100d78af
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001da4
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10085281
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10092a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10092a2f
pop dword [ebp - 0x34]
mov eax, 0xde25c8c2
sub eax, 0xce1c9e93
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x43e09
push 0
mov eax, 0x4f947ef7
add eax, 0xc0791131
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x7e38866d
sub ecx, 0x7e383e41
mov esi, eax
mov edi, 0x10121e00
add edi, dword [ebp - 0x34]
mov edx, 0xb9fb077b
add edx, 0x8849e91d
sub dword [ebp - 0x14], 0xcd901c7c
mov ebx, dword [edi]
add dword [ebp - 0x14], 0x93d969e9
add ebx, edx
sub dword [ebp - 0x20], esi
mov dword [esi], ebx
xor dword [ebp - 0x10], esi
add esi, 4
add edi, 0x388bff66
add edi, 0xc774009e
loop 0x10092a88
add eax, 0x751d0f69
sub eax, 0x751bfbe6
mov ebx, eax
add eax, 0xa278a1c4
sub eax, 0xa278a1bf
mov ecx, 0xd7d219e
sub ecx, 0xfd7d219e
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x10094570
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.10093c20
push 0x41
mov ecx, esi
call fcn.10093c20
push 0x59
mov ecx, esi
call fcn.10093c20
push 0x26
mov ecx, esi
call fcn.10093c20
push 0x53
mov ecx, esi
call fcn.10093c20
push 0x59
mov ecx, esi
call fcn.10093c20
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x10094600
test cl, cl
jbe 0x100945fc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x100f7c04]
xor eax, edi
dec ecx
jne 0x100945e6
xor edi, edi
jmp 0x1009462f
cmp bl, cl
jne 0x10094607
inc edi
jmp 0x10094612
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x100f7c04]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x100945be
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.10093c60
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.10093d80
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x100c1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x100c1fcb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x100c200c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x100c1ff1
mov ecx, ebx
call fcn.100c1c50
add ebx, 0x28
dec ebp
jne 0x100c1fe5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x100c2007
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100c1b20
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.100c20b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x20]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x1c]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
push ebp
call fcn.10092a20
mov ebx, eax
cmp ebx, edi
je 0x100c2084
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.100c20e0
cmp ebx, edi
jle 0x100c207f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x100c2084
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x100c2096
cmp dword [esi + 0x40], edi
jne 0x100c2096
cmp dword [esi + 0x3c], edi
jne 0x100c2096
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x6045cd
Capabilities:
Encode data using xor

Disassembly:
dec esi
jmp 0x6045da
mov dword [0xd5cdf27a], eax
cld
lds ebx, [ebx]
add bh, byte [edx - 0x38]
or al, 0x50
and edx, dword [ebp + 0x6e11dbf8]
mov al, byte [0x27ecb6a0]
mov dh, 0xbc
cwde
clc
jbe 0x6045cc
aam 0xa9
loopne 0x60461e
test eax, 0x855b23e0
mov byte [0xabc0e769], al
pop ebx
test dword [edx - 0x543f1897], esp
xor edx, esi
push ss
mov eax, 0xbae0bbcc
ja 0x6045f7
wait
mov ebx, 0x93d43706
mov dh, 0x84
mov ebx, 0x43ce768f
invalid
xchg ebx, eax
wait
or byte [edi - 0xa], 0x3a
int3
Function at 0x8582c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18d000]
push edi
or ebp, 0xffffffff
jmp 0x8582e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8582e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8582d8
mov eax, 1
add ebx, ebx
jne 0x8582fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x85830c
jne 0x85832b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85832b
dec eax
add ebx, ebx
jne 0x858318
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8582f0
add ebx, ebx
jne 0x858327
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x85837d
xor ecx, ecx
sub eax, 3
jb 0x858343
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8583b2
sar eax, 1
mov ebp, eax
jmp 0x85834e
add ebx, ebx
jne 0x85834e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85831c
inc ecx
add ebx, ebx
jne 0x85835c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85831c
add ebx, ebx
jne 0x858369
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x85835e
jne 0x85837a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x85835e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x85839c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x85838e
jmp 0x8582de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x85839c
add edi, ecx
jmp 0x8582de
pop esi
mov edi, esi
mov ecx, 0x6b2c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8583ba
cmp byte [edi], 0x19
jne 0x8583ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8583bf
lea edi, [esi + 0x44f000]
mov eax, dword [edi]
or eax, eax
je 0x858437
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x45cb94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x45ccd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8583ec
mov ecx, edi
jns 0x85841b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x45ccd8]
or eax, eax
je 0x858431
mov dword [ebx], eax
add ebx, 4
jmp 0x858409
call dword [esi + 0x45cce8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x858468
cmp al, 0xef
ja 0x85845b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x85843d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x85844a
mov ebp, dword [esi + 0x45ccdc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x85849c
sub esp, 0xffffff80
jmp 0x4af3c9
Function at 0x404ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cf6b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x18], ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x24c], 1
rep stosd dword es:[edi], eax
mov eax, dword [0x87a768]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24c], 2
push ecx
lea ecx, [esi + 0x104]
call fcn.005b15c8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
mov eax, dword [edx - 8]
push eax
call fcn.005b4ba6
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00530071
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x260]
add esp, 8
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x3c]
push ecx
mov dword [esp + 0x30], 5
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
cmp esi, ebx
je 0x404bba
lea edx, [esp + 0x3c]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x404b92
mov word [esp + 0x3c], bx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x404bba
mov eax, dword [esp + 0x14]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x87a768]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x10]
push ecx
push 0x62353c
push edx
mov byte [esp + 0x258], 3
call fcn.005ad17a
mov esi, dword [esp + 0x260]
add esp, 0xc
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.005b44ce
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x24c], 2
call fcn.005b4761
lea ecx, [esp + 0xc]
mov byte [esp + 0x24c], 1
call fcn.005b4761
lea ecx, [esp + 0x258]
mov byte [esp + 0x24c], bl
call fcn.005b4761
mov ecx, dword [esp + 0x244]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x244
ret 8
Function at 0x405e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cf887
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
push eax
push 0x137
call fcn.005b020d
lea edi, [esi + 0x5c]
mov byte [esp + 0x14], 1
mov ecx, edi
call fcn.005b07dd
mov dword [edi], vtable.CProgressCtrl.0
mov ecx, dword [0x87a768]
lea edi, [esi + 0x98]
mov dword [edi], ecx
lea ecx, [esi + 0x9c]
mov byte [esp + 0x14], 3
call fcn.0042cff0
push 0x87f498
mov ecx, edi
mov byte [esp + 0x18], 4
mov dword [esi], method.CDialog.virtual_0
call fcn.005b48f8
lea edx, [esp + 0x20]
mov ecx, edi
push edx
call fcn.005b48a8
fld qword [esp + 0x24]
fmul qword [0x5e7fd0]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x114], ecx
lea ecx, [esp + 0x20]
mov dword [esi + 0x110], eax
mov dword [esi + 0x10c], 0
fstp qword [esi + 0x100]
mov dword [esp + 0x14], 0xffffffff
call fcn.005b4761
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x41d460
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push ebx
push ebp
xor eax, eax
push esi
cmp edx, 0x80000000
push edi
jb 0x41d477
xor ebx, ebx
jmp 0x41d494
test edx, edx
jbe 0x41d492
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov cl, byte [eax + esi]
test byte [ecx + 0x638374], 0x40
je 0x41d492
inc eax
cmp eax, edx
jb 0x41d47b
mov ebx, eax
mov esi, dword [esp + 0x20]
cmp ebx, edx
mov dword [esp + 0x10], ebx
mov eax, dword [esi]
mov dword [esi + 8], 0
mov byte [eax], 0
jae 0x41d5d0
mov ecx, dword [esp + 0x18]
mov cl, byte [ebx + ecx]
mov byte [esp + 0x20], cl
mov eax, dword [esp + 0x20]
and eax, 0xff
test byte [eax + 0x638374], 0x40
jne 0x41d5d0
cmp cl, 0x3d
je 0x41d5d0
cmp cl, 0x3f
je 0x41d5d0
cmp cl, 0x2f
je 0x41d5d0
cmp cl, 0x3e
je 0x41d5d0
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
add edi, 2
cmp eax, edi
jae 0x41d5ac
mov ebp, eax
shr ebp, 5
inc ebp
shl ebp, 5
add ebp, eax
cmp ebp, 0x20
ja 0x41d51b
mov ebp, 0x20
mov edi, dword [esi]
push ebp
test edi, edi
jne 0x41d551
call fcn.005b449a
mov ecx, ebp
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
mov dword [esi + 4], ebp
mov dword [esi + 8], 0
mov byte [eax], 0
jmp 0x41d5a4
call fcn.005b449a
add esp, 4
mov dword [esi], eax
cmp byte [edi], 0
mov ecx, edi
lea edx, [ebp - 1]
je 0x41d57d
mov ebx, edx
dec edx
test ebx, ebx
jbe 0x41d579
mov bl, byte [ecx]
mov byte [eax], bl
mov bl, byte [ecx + 1]
inc eax
inc ecx
test bl, bl
jne 0x41d565
mov ebx, dword [esp + 0x10]
mov byte [eax], 0
mov ecx, dword [esi]
mov eax, ecx
mov dword [esi + 4], ebp
mov dl, byte [eax]
inc eax
test dl, dl
je 0x41d595
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41d58e
sub eax, ecx
push edi
dec eax
mov dword [esi + 8], eax
call fcn.005b44c3
add esp, 4
mov edx, dword [esp + 0x1c]
mov cl, byte [esp + 0x20]
mov eax, dword [esi + 8]
mov edi, dword [esi]
mov byte [eax + edi], cl
mov edi, dword [esi + 8]
mov ecx, dword [esi]
inc edi
mov eax, edi
inc ebx
mov dword [esi + 8], edi
cmp ebx, edx
mov byte [eax + ecx], 0
mov dword [esp + 0x10], ebx
jb 0x41d4b0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x424c10
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
lea esi, [ebx + 0x9cc]
push 8
push edi
mov ecx, ebx
call fcn.00424c70
shl eax, 0x18
mov dword [esi], eax
mov edx, 8
mov ebp, eax
mov ecx, ebp
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebp, eax
jne 0x424c34
push 0x20
push eax
mov ecx, ebx
mov dword [esi], ebp
call fcn.00424c70
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0xff
jle 0x424c1e
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x424cb0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d1fa0
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
mov ebx, dword [esp + 0x50]
push ebp
push esi
test ebx, ebx
push edi
mov ebp, ecx
je 0x424e91
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x424e91
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x56
jbe 0x424e91
sub esi, 0x56
lea ecx, [esp + 0x5c]
push esi
push 0x20
call fcn.005acc00
lea eax, [esp + 0x10]
push 0
push eax
push esi
push esi
lea ecx, [esp + 0x6c]
mov dword [esp + 0x64], 0
call fcn.005b4ba6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
lea ecx, [esp + 0x60]
call fcn.005b4bf6
cmp esi, dword [esp + 0x10]
jne 0x424e80
lea ecx, [esp + 0x5c]
push esi
push ecx
mov ecx, ebp
call fcn.00424eb0
mov ebp, dword [esp + 0x60]
lea ecx, [esp + 0x14]
mov dword [ebp], eax
call fcn.005b57f3
push 0
push 0
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0x60], 1
call fcn.005b59a5
test eax, eax
je 0x424e72
add esi, 0x56
push esi
call fcn.005b449a
mov edi, eax
add esp, 4
test edi, edi
je 0x424e72
push esi
push edi
lea ecx, [esp + 0x1c]
call fcn.005b5ac2
xor eax, eax
xor edx, edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x40], eax
sub esi, 0x15
mov dword [esp + 0x44], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x48], eax
mov ecx, dword [edi + esi]
mov dword [esp + 0x30], edx
lea eax, [edi + esi]
mov dword [esp + 0x34], edx
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp]
push eax
lea ecx, [esp + 0x3c]
push str._08x
push ecx
mov dword [esp + 0x34], edx
call fcn.00530115
push edi
call fcn.005b44c3
add esp, 0x10
lea esi, [esp + 0x24]
lea eax, [esp + 0x38]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x424e44
test cl, cl
je 0x424e40
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x424e44
add eax, 2
add esi, 2
test cl, cl
jne 0x424e1c
xor eax, eax
jmp 0x424e49
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x424e72
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], al
call fcn.005b58e8
lea ecx, [esp + 0x5c]
mov dword [esp + 0x54], 0xffffffff
call fcn.005b4761
mov eax, 1
jmp 0x424e93
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], 0
call fcn.005b58e8
lea ecx, [esp + 0x5c]
mov dword [esp + 0x54], 0xffffffff
call fcn.005b4761
xor eax, eax
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 8

Function at 0x424eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov edx, dword [ecx]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x424ee8
push ebx
push edi
lea edi, [ecx]
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [esi + ecx*4 + 0x9cc]
xor eax, ecx
inc edx
dec edi
jne 0x424ec8
pop edi
pop ebx
not eax
pop esi
ret 8