joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90f000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x90f131
push esi
call fcn.00912145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00901080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x90f131
push 0
push ebp
call fcn.009013a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00901260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x90f08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009012f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x90f121
push 0x927918
push edi
call fcn.009103f0
push eax
push ebx
push esi
call fcn.0090ef60
push 0x9278f8
push edi
call fcn.009103f0
push eax
push ebx
push esi
call fcn.0090ef60
push 0x9278d8
push edi
call fcn.009103f0
push eax
push ebx
push esi
call fcn.0090ef60
push 0x9278c0
push edi
call fcn.009103f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0090ef60
push 0x9278a0
push edi
call fcn.009103f0
push eax
push ebx
push esi
call fcn.0090ef60
push 0x927888
push edi
call fcn.009103f0
push eax
push ebx
push esi
call fcn.0090ef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x9101b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00910140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00910140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00910140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00910140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x910bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x910c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x92287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x910c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x910c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403e59
pop dword [ebp - 0x30]
mov eax, 0xeacb4a4c
sub eax, 0xea8b0bf3
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xb3fcc8b4
add dword [ebp - 0x40], 0x9a557c97
mov dword [ebp - 0x3c], 0xc10022b5
sub dword [ebp - 0x3c], 0x8eccd670
mov dword [ebp - 0x38], 0x81149981
add dword [ebp - 0x38], 0xcb37aaad
mov dword [ebp - 0x34], 0x83743fe9
sub dword [ebp - 0x34], 0x83743fe9
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x9e0486a3
add dword [ebp - 0x40], 0xd66de2b3
mov dword [ebp - 0x3c], 0x4badc425
sub dword [ebp - 0x3c], 0xa4162b0
mov dword [ebp - 0x38], 0x68b99d4c
add dword [ebp - 0x38], 0xfab5cf20
mov dword [ebp - 0x34], 0x297e9ce
sub dword [ebp - 0x34], 0x297e9ce
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xee124d03
add eax, 0x122e23a5
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3567d
push 0
call eax
mov ecx, 0x48834c51
add ecx, 0xb77cf651
xor edi, edi
add edi, eax
mov ebx, 0x86fffe6d
sub ebx, 0x86befe6d
add ebx, dword [ebp - 0x30]
mov esi, 0x5ba3d31e
sub dword [ebp - 0x28], esi
mov edx, dword [ebx]
xor dword [ebp - 0x2c], eax
sub edx, esi
sub dword [ebp - 0x18], 0x6d2be076
mov dword [edi], edx
add dword [ebp - 0x24], ecx
add edi, 0x17e32934
add edi, 0xe81cd6d0
add ebx, 0xbcc00b7a
sub ebx, 0xbcc00b76
loop 0x403f72
add eax, 0x12395f2a
add eax, 0xedc79e31
mov ebx, eax
add eax, 0x22825796
sub eax, 0x22825791
mov ecx, 0x53723084
add ecx, 0xaccdcf7c
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40cf9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40cfaa
pop dword [ebp - 0x50]
mov eax, 0x40cfaa
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3e452
push 0
mov eax, 0x394d953e
add eax, 0xc6f4bcda
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x2f36a254
sub ecx, 0x2f365846
xor esi, esi
add esi, eax
mov edx, 0x23f37702
sub edx, 0x23b02302
add edx, dword [ebp - 0x50]
mov edi, 0x685e766
xor dword [ebp - 0x4c], 0x3e7b860a
mov ebx, dword [edx]
xor dword [ebp - 0x3c], 0xa4eb971d
sub ebx, edi
xor dword [ebp - 0x3c], 0x55cd3003
mov dword [esi], ebx
add dword [ebp - 0x14], 0xe7feca5c
add esi, 4
add edx, 0x2a5aa105
add edx, 0xd5a55eff
loop 0x40d000
add eax, 0x11b0b
mov ebx, eax
add eax, 5
mov ecx, 0xff6d726d
add ecx, 0xd28d93
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x4082ae
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4082e9
push 6
call fcn.00415ba7
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00417230
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40834c
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004173e0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x408370
push 6
call fcn.00415ba7
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00417230
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4083d3
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004173e0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4083f7
push 6
call fcn.00415ba7
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00417230
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40845a
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004173e0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x408462
mov esp, ebp
pop ebp
ret
Function at 0x40cb97
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40cbdd
push 6
call fcn.00415ba7
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x4435a3]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.004032d0
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00416f90
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40cc30
push ebx
call fcn.00415ba1
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40cc69
push 6
call fcn.00415ba7
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x40cc85
push eax
mov ebx, eax
call fcn.00401c95
inc eax
push eax
call fcn.00415b9b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40cc8a
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40cc9b
push ebx
call fcn.00415ba1
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x416cb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x416d42
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x416d34
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x416d2c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x416cf5
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x416fd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
test eax, eax
je 0x417013
push edi
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.00417d60
add esp, 8
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret
Function at 0x417120
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x417189
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00415e00
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x4172f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x417331.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x417331.2
jmp dword [eax*4 + 0x4173bc]
mov word [esp + 0x48], di
jmp 0x41736a
mov word [esp + 0x48], 2
jmp 0x41736a
mov word [esp + 0x48], 3
jmp 0x41736a
mov word [esp + 0x48], 4
jmp 0x41736a
mov word [esp + 0x48], 7
jmp 0x41736a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x4173b4
cmp dword [esp + 0x70], edi
je 0x4173a0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x418e50
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x439a78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x1c], 0
call fcn.00419860
mov eax, dword [esp + 0x24]
push 0x456cec
push eax
xor edi, edi
xor ebx, ebx
call fcn.004233b0
add esp, 8
test eax, eax
je 0x418e9d
mov ebx, dword [esp + 0x24]
mov edi, 3
push 0
push 0
push ebx
push edi
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi], eax
je 0x418ee7
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea ecx, [esp + 0xc]
push 4
push ecx
push 2
push eax
mov dword [esp + 0x1c], 0x15f90
call edi
mov eax, dword [esi]
lea edx, [esp + 0xc]
push 4
push edx
push 5
push eax
call edi
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push 4
push ecx
push 6
push edx
call edi
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
lea ecx, [esp + 0x24]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00432f18
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x419400
Capabilities:
Get http response content encoding
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439b00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
lea eax, [esi + 0x28]
mov dword [ebp - 4], ebx
push eax
push 0x13
call fcn.00419620
lea ecx, [esi + 0x30]
push ecx
push 5
mov ecx, esi
call fcn.004196b0
lea edx, [esi + 0x20]
mov ecx, esi
push edx
push 0x21
call fcn.00419570
lea eax, [esi + 0x14]
mov ecx, esi
push eax
push 0x16
call fcn.00419570
lea ecx, [esi + 0x18]
push ecx
push 1
mov ecx, esi
call fcn.00419570
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
lea edx, [ebp - 0x14]
push ebx
push edx
push ebx
push 0x1d
push eax
mov dword [esi + 0x24], ebx
mov dword [ebp - 0x14], ebx
call edi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x4194dd
push eax
call fcn.00432c59
mov edx, dword [esi + 8]
add esp, 4
lea ecx, [ebp - 0x14]
mov ebx, eax
push 0
push ecx
push ebx
push 0x1d
push edx
call edi
push str.gzip
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
jne 0x4194bb
mov dword [esi + 0x24], 1
jmp 0x4194d2
push str.deflate
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
jne 0x4194d2
mov dword [esi + 0x24], 2
push ebx
call fcn.00432c82
add esp, 4
xor ebx, ebx
lea ecx, [esi + 0x1c]
push 0x456cec
call fcn.00433055
mov dword [ebp - 0x18], ebx
mov edx, dword [esi + 8]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push ecx
push ebx
push 0x2b
push edx
mov dword [ebp - 0x14], ebx
call edi
mov eax, dword [ebp - 0x14]
cmp eax, 1
jb 0x419554
push eax
call fcn.00432c59
mov edx, dword [esi + 8]
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push ecx
push ebx
push 0x2b
push edx
call edi
cmp dword [ebp - 0x18], 1
jbe 0x419538
push 0x445738
lea ecx, [esi + 0x1c]
call fcn.00433201
push ebx
lea ecx, [esi + 0x1c]
call fcn.00433201
push ebx
call fcn.00432c82
add esp, 4
xor ebx, ebx
jmp 0x4194ed
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419750
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439b68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x18], esi
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x10], esp
cmp eax, ebx
je 0x41978e
push eax
call fcn.00422cd6
add esp, 4
mov dword [esi + 0xc], ebx
push 0x400
lea ecx, [ebp - 0x40]
mov dword [esi + 0x10], ebx
call fcn.00437702
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x43f]
mov byte [ebp - 0x440], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, 1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x14], ebx
je 0x41980d
mov edx, dword [esi + 8]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x440]
push 0x400
push ecx
push edx
call edi
cmp eax, ebx
je 0x4197ca
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x4197ca
push eax
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x40]
call fcn.004378be
jmp 0x4197ca
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.004336e7
mov edi, eax
cmp edi, ebx
jbe 0x41982c
lea ecx, [ebp - 0x40]
call fcn.0043774e
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
cmp ecx, edi
lea ecx, [ebp - 0x40]
sbb esi, esi
neg esi
call fcn.00437760
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x439c4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x34]
mov dword [esp + 0x10], 6
call fcn.00432f18
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.00432f18
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.00432f18
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.00432f18
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 2
call fcn.00432f18
lea ecx, [esi + 8]
mov byte [esp + 0x10], 1
call fcn.00432f18
lea ecx, [esi + 4]
mov byte [esp + 0x10], 0
call fcn.00432f18
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.00432f18
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x419d36
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x439c4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x34]
mov dword [esp + 0x10], 6
call fcn.00432f18
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.00432f18
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.00432f18
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.00432f18
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 2
call fcn.00432f18
lea ecx, [esi + 8]
mov byte [esp + 0x10], 1
call fcn.00432f18
lea ecx, [esi + 4]
mov byte [esp + 0x10], 0
call fcn.00432f18
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.00432f18
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41b400
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x41b40b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x41b50e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x43b670]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x43b670]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x43b670]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x43b670]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x43b670]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x43b670]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x43b670]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x43b670]
xor eax, edx
inc ecx
dec edi
jne 0x41b426
pop edi
test esi, esi
je 0x41b530
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x43b670]
xor eax, edx
inc ecx
dec esi
jne 0x41b512
pop esi
pop ebx
not eax
ret
Function at 0x41bd00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x424c80], ecx
inc edx
cmp edx, 0x100
jb 0x41bd02
cmp edx, 0x800
jae 0x41bdd9
lea esp, [esp]
mov eax, dword [edx*4 + 0x424880]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x424c80]
inc edx
mov dword [edx*4 + 0x424c7c], eax
cmp edx, 0x800
jb 0x41bdb0
mov eax, 0x41c5e0
mov dword [0x424c7c], eax
mov dword [0x426c80], eax
mov dword [0x424c78], 0x41c500
call fcn.0041c010
test eax, eax
jne 0x41be05
mov dword [0x426c80], 0x41c500
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4085a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4085b5
pop dword [ebp - 0x24]
mov eax, 0x4085b5
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xd3120644
sub dword [ebp - 0x34], 0x84bfc0f9
mov dword [ebp - 0x30], 0xad009317
sub dword [ebp - 0x30], 0x7acd46d2
mov dword [ebp - 0x2c], 0x704369ff
add dword [ebp - 0x2c], 0xdc08da2f
mov dword [ebp - 0x28], 0xff98ba1f
sub dword [ebp - 0x28], 0xff98ba1f
lea eax, [ebp - 0x34]
push eax
mov eax, 0x3e008876
sub eax, 0x3dbe5802
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x94a4a121
sub dword [ebp - 0x34], 0x203237cb
mov dword [ebp - 0x30], 0x65dd52c8
add dword [ebp - 0x30], 0xdb8f0ead
mov dword [ebp - 0x2c], 0x46f02aca
add dword [ebp - 0x2c], 0x1c7f41a2
mov dword [ebp - 0x28], 0xc2157ff8
sub dword [ebp - 0x28], 0xc2157ff8
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x3a69c98f
add eax, 0xc5d86795
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3feec
push 0
call eax
mov ecx, 0x271a9b91
add ecx, 0xd8e5b54f
xor esi, esi
add esi, eax
mov edi, 0x3d1d6892
add edi, 0xc325db6e
add edi, dword [ebp - 0x24]
mov edx, 0x4913896
mov dword [ebp - 0x14], 0x81386ae2
mov ebx, dword [edi]
xor dword [ebp - 4], eax
sub ebx, edx
mov dword [ebp - 0x14], 0x6d259c31
mov dword [esi], ebx
add dword [ebp - 4], 0xff862156
add esi, 4
add edi, 4
loop 0x4086ce
add eax, 0x68a3e55
sub eax, 0x6890802
mov ebx, eax
add eax, 0x20a292ca
add eax, 0xdf5d6d3b
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret