joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408900
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, ecx
and esi, 3
je 0x40892b
cmp esi, 2
jne 0x40893b
shr ecx, 1
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp 0x4089cd
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
jmp 0x4089cd
test ecx, ecx
je 0x4089cd
mov edi, ecx
and edi, 7
je 0x40896b
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
mov byte [eax + esi], bl
inc esi
cmp edi, esi
jne 0x408950
add edx, esi
mov edi, ecx
sub edi, esi
add esi, eax
cmp ecx, 8
jae 0x408974
jmp 0x4089cd
mov edi, ecx
mov esi, eax
cmp ecx, 8
jb 0x4089cd
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
movzx ebx, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], bl
movzx ebx, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], bl
movzx ebx, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], bl
movzx ebx, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], bl
movzx ebx, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], bl
movzx ebx, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], bl
movzx ebx, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], bl
add ecx, 8
cmp edi, ecx
jne 0x408980
pop esi
pop edi
pop ebx
ret

Function at 0x409040
Capabilities:
Terminate process

Disassembly:
sub esp, 0x110
call fcn.004302d0
test al, 1
jne 0x409051
jmp 0x4090c3
call fcn.0042b9a0
test al, 1
jne 0x40905c
jmp 0x4090be
mov dword [esp], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x100
call fcn.004089e0
lea eax, [esp + 0x10]
lea ecx, str.eleet_or_leetspeak__is_a_system_of_modified_spellings_used_primarily_on_the_internet._it_often_uses_character_replacements_in_ways_that_play_on_the_similarity_of_their_glyphs_via_reflection_or_other_resemblance
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004090e0
call fcn.0040a540
test al, 1
jne 0x4090af
jmp 0x4090b6
call fcn.00410460
jmp 0x4090b6
jmp 0x4090b8
jmp 0x4090ba
jmp 0x4090bc
jmp 0x4090be
call fcn.00432240
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x4092a6
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x4091bd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4091e1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x4091b0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x4091b0
lea esi, [ebx + 1]
push esi
call fcn.004088d0
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x4092b4
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409228
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x4092b6
movzx edx, word [edi]
test dx, dx
je 0x4092b6
cmp dx, 0x7f
jbe 0x409210
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x409270
cmp ecx, 2
jb 0x409270
mov ecx, edx
shr ecx, 6
or cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409217
xor esi, esi
cmp ecx, 3
jb 0x409217
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409217
push 1
call fcn.004088d0
add esp, 4
mov ebp, eax
jmp 0x4092b6
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4092d7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4092d2
test eax, eax
jne 0x4092d0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004052d0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40a2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov esi, 0xffffffff
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, 2
cmp byte [ebx + esi + 1], 0
lea esi, [esi + 1]
jne 0x40a300
mov ecx, esi
and ecx, 3
mov edi, esi
or edi, 3
imul edi, ecx
xor ecx, 3
mov edx, esi
and edx, 0xfffffffc
imul edx, ecx
add edi, edx
shr edi, 2
movzx ecx, byte [ebx + esi - 1]
cmp ecx, 0x3d
je 0x40a339
cmp ecx, 0x2e
jne 0x40a33a
dec edi
mov ecx, esi
xor ecx, 0xfffffffd
and eax, 0xfffffffa
add eax, ecx
cmp byte [ebx + eax + 1], 0x3d
je 0x40a352
cmp byte [ebx + esi - 2], 0x2e
jne 0x40a353
dec edi
mov dword [esp + 4], edi
mov edx, 0
test esi, esi
je 0x40a444
xor edi, edi
mov ebp, 2
jmp 0x40a382
lea eax, [ebp + 4]
add ebp, 2
mov edi, edx
cmp ebp, esi
mov ebp, eax
jae 0x40a444
mov ebx, dword [esp + 0x3c]
movzx eax, byte [ebx + ebp - 2]
push eax
call fcn.00410190
add esp, 4
mov byte [esp], al
movzx eax, byte [ebx + ebp - 1]
push eax
call fcn.00410190
add esp, 4
mov ebx, eax
movzx eax, al
mov ecx, eax
not ecx
or ecx, 0x30
add eax, ecx
inc eax
movzx ecx, byte [esp]
shr eax, 4
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x40]
mov byte [ecx + edi], al
lea edx, [edi + 1]
cmp ebp, esi
jae 0x40a370
mov eax, dword [esp + 0x3c]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 4], edx
call fcn.00410190
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x40a370
mov bh, al
shl bl, 4
shr al, 2
and al, 0xf
or al, bl
lea edx, [edi + 2]
mov ecx, dword [esp + 0x40]
mov byte [ecx + edi + 1], al
lea eax, [ebp + 1]
cmp eax, esi
jae 0x40a370
mov eax, dword [esp + 0x3c]
movzx eax, byte [eax + ebp + 1]
push eax
mov dword [esp + 4], edx
call fcn.00410190
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x40a370
shl bh, 6
add al, bh
mov ecx, dword [esp + 0x40]
mov byte [ecx + edi + 2], al
add edi, 3
mov edx, edi
jmp 0x40a370
mov esi, dword [esp + 4]
cmp edx, esi
mov eax, 0
jne 0x40a4d7
mov eax, esi
or eax, 0xffffffdf
mov edx, esi
and edx, 0xffffffdf
add edx, eax
lea edi, [esp + 8]
mov ebp, dword [esp + 0x40]
mov eax, ebp
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, edx
inc eax
je 0x40a4d2
mov ecx, esi
and ecx, 1
xor edi, edi
cmp esi, 0x21
je 0x40a4bc
mov edx, eax
sub edx, ecx
xor edi, edi
nop
nop
nop
nop
nop
mov esi, edi
and esi, 0x1e
movzx ebx, byte [esp + esi + 8]
xor bl, byte [ebp + edi + 0x20]
mov byte [ebp + edi], bl
lea esi, [edi + 1]
and esi, 0x1f
movzx ebx, byte [esp + esi + 8]
xor bl, byte [ebp + edi + 0x21]
mov byte [ebp + edi + 1], bl
add edi, 2
cmp edx, edi
jne 0x40a490
test ecx, ecx
je 0x40a4d2
mov ecx, edi
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 8]
xor cl, byte [ebp + edi + 0x20]
mov byte [ebp + edi], cl
mov byte [ebp + eax], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x417b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], 0xeb2f952b
mov dword [esp + 0x14], 0xef9ce965
mov dword [esp + 0x18], 0xe348ed9c
mov dword [esp + 0x1c], 0xe7e0e144
mov dword [esp + 0x20], 0
mov dword [esp + 0x23], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x16
ja 0x417bf0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add ecx, 0x3d
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0x92
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x17
jb 0x417bc0
lea eax, [esp + 0x10]
push eax
push esi
push edi
call fcn.004146d0
add esp, 0xc
mov byte [esp + 0xf], al
mov dword [esp + 0x10], 0x4b274d23
mov dword [esp + 0x14], 0x572a4936
mov dword [esp + 0x18], 0x5360556d
mov dword [esp + 0x1c], 0x5f30513c
mov word [esp + 0x20], 0x5d5c
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0
mov dword [esp + 0x32], 0
mov word [esp + 0x36], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x27
ja 0x417ca8
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 0xba08e94a
add ecx, 0xba08e94a
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0xfa
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x28
jb 0x417c70
lea eax, [esp + 0x10]
push eax
push esi
push edi
call fcn.004146d0
add esp, 0xc
mov byte [esp + 0xe], al
mov dword [esp + 0x10], 0x63f5650c
mov dword [esp + 0x14], 0x6ff361fc
mov dword [esp + 0x18], 0x6bfb6d06
mov dword [esp + 0x1c], 0x97f469f7
mov dword [esp + 0x20], 0x930a9507
mov dword [esp + 0x24], 0x9fc29115
mov dword [esp + 0x28], 0x9b039d03
mov dword [esp + 0x2c], 0x870f990e
mov dword [esp + 0x30], 0x83ef851a
mov word [esp + 0x34], 0x8182
mov dword [esp + 0x36], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3d], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x30
ja 0x417d78
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 0x3cf2e571
add ecx, 0x3cf2e571
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0xe9
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x31
jb 0x417d40
lea eax, [esp + 0x10]
push eax
push esi
push edi
call fcn.004146d0
add esp, 0xc
mov bh, al
mov eax, dword [0x43b27c]
mov ecx, 0xd3340c36
xor ecx, dword [0x43b284]
add eax, ecx
inc eax
nop
nop
nop
nop
jmp eax
Function at 0x41ba40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov dword [esp + 0x10], 0x63236145
mov dword [esp + 0x14], 0x67f665f4
mov dword [esp + 0x18], 0x6b0b692c
mov dword [esp + 0x1c], 0x6f0f6df8
mov dword [esp + 0x20], 0x93ee91b5
mov dword [esp + 0x24], 0x97fe95e0
mov dword [esp + 0x28], 0x9bf4990d
mov dword [esp + 0x2c], 0x9ffb9df8
mov dword [esp + 0x30], 0x83e08112
mov dword [esp + 0x34], 0x871485ed
mov dword [esp + 0x38], 0x8bf689ec
mov dword [esp + 0x3c], 0x8f1c8dfc
mov dword [esp + 0x40], 0xb3d4b1df
mov dword [esp + 0x44], 0xb7dab5dd
mov dword [esp + 0x48], 0xbb29b9dd
mov dword [esp + 0x4c], 0xbdbc
mov byte [esp + 0x50], 0
mov dword [esp + 0x6c], 0
mov eax, dword [esp + 0x6c]
cmp eax, 0x40
ja 0x41bb32
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x6c]
movzx edx, byte [esp + ecx + 0x10]
lea ecx, [eax + edx]
add ecx, 0x6ca9d570
add eax, 0x6ca9d570
and eax, edx
add eax, eax
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
add al, 0xf0
mov ecx, dword [esp + 0x6c]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
cmp eax, 0x41
jb 0x41baf0
movzx ecx, word [esp + 0x10]
lea esi, [esp + 0x6c]
mov eax, esi
test cx, cx
je 0x41bb61
lea eax, [esp + 0x6c]
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bb50
mov word [eax], 0
lea ebx, [esp + 0xc]
push ebx
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x4419d8]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41bb89
mov eax, 0xffffffff
jmp 0x41bb8c
lea eax, [edi + edi]
push eax
call fcn.004088d0
add esp, 4
push ebx
push edi
mov edi, eax
push eax
push 0x1e
push esi
push 0
call dword [0x4419d8]
mov dword [esp + 0x10], 0x33ac359a
mov dword [esp + 0x14], 0x2fa231b9
mov dword [esp + 0x18], 0x2bb72db2
mov dword [esp + 0x1c], 0x27b629a4
mov dword [esp + 0x20], 0x23aa25b1
mov dword [esp + 0x24], 0x1f2021be
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x2f
ja 0x41bc45
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
add al, 9
xor al, byte [esp + ecx + 0x10]
add al, 0xc1
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x30
jb 0x41bc20
lea eax, [esp + 0x10]
push eax
push edi
push dword [ebp + 8]
call fcn.00417880
add esp, 0xc
mov ebx, eax
jmp dword [0x43bd88]
Function at 0x421590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xfc0
mov esi, esp
push 0x1000
call fcn.004088d0
add esp, 4
mov dword [esi + 0x2c], eax
mov dword [esi + 0x540], 0x3bf4e6c8
mov dword [esi + 0x544], 0x21101d0d
mov word [esi + 0x548], 0xedce
mov dword [esi + 0x54a], 0
mov dword [esi + 0x54d], 0
mov dword [esi + 0x90], 0
mov eax, dword [esi + 0x90]
cmp eax, 0x10
ja 0x421652
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0x90]
movzx edx, byte [esi + ecx + 0x540]
lea ecx, [eax + edx]
add ecx, 0x399a149d
add eax, 0x399a149d
and eax, edx
add eax, eax
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
add al, 0xb5
mov ecx, dword [esi + 0x90]
mov byte [esi + ecx + 0x540], al
inc dword [esi + 0x90]
mov eax, dword [esi + 0x90]
cmp eax, 0x11
jb 0x421600
mov eax, dword [str.LPnhqo___Lolzteam0ne0uts]
mov dword [esi + 0x90], 0x784aa5ab
mov dword [esi + 0x94], 0x7e72a105
mov dword [esi + 0x98], 0x57ac4b77
mov dword [esi + 0x9c], 0x6348a943
mov dword [esi + 0xa0], 0x7c67666d
mov dword [esi + 0xa4], 0x6e696060
mov dword [esi + 0xa8], 0xa88a6860
mov dword [esi + 0xac], 0x54634dba
mov dword [esi + 0xb0], 0x9d694a55
mov dword [esi + 0xb4], 0x585b6f82
mov dword [esi + 0xb8], 0x8b6a415a
mov dword [esi + 0xbc], 0x97564679
mov dword [esi + 0xc0], 0x8d948a96
mov dword [esi + 0xc4], 0xa98c8f82
mov dword [esi + 0xc8], 0x6c689d8d
mov dword [esi + 0xcc], 0x47987f76
mov byte [esi + 0xd0], 0
mov dword [esi + 0x904], 0
mov ecx, dword [esi + 0x904]
cmp ecx, 0x40
ja 0x421757
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esi + 0x904]
mov edx, dword [esi + 0x904]
add cl, 0xc1
xor cl, byte [esi + edx + 0x90]
add cl, 0xb9
mov edx, dword [esi + 0x904]
mov byte [esi + edx + 0x90], cl
inc dword [esi + 0x904]
mov ecx, dword [esi + 0x904]
cmp ecx, 0x41
jb 0x421720
movzx ecx, byte [esi + 0x90]
mov ebx, dword [esi + 0x2c]
test cl, cl
je 0x42177b
lea edx, [esi + 0x91]
mov ebx, dword [esi + 0x2c]
nop
nop
mov byte [ebx], cl
inc ebx
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x421770
mov byte [ebx], 0
movzx ecx, byte [eax]
test cl, cl
je 0x42179b
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], cl
inc ebx
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x421790
mov byte [ebx], 0
movzx eax, byte [esi + 0x540]
test al, al
je 0x4217bb
lea ecx, [esi + 0x541]
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4217b0
mov byte [ebx], 0
push 0
call fcn.00432860
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x43d4f8]
mov ecx, 0x4dde548d
xor ecx, dword [0x43d500]
add ecx, edx
inc ecx
jmp ecx
Function at 0x42cfb0
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x42d06d
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x42d010
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.0042d7e0
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x42d000
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x42d164
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x42d14d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x42d110
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x42d164
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x42d1aa
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.0042d7e0
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.0042d7e0
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4302d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x2c0
mov dword [esp + 0xb0], 0x23ac21b0
mov dword [esp + 0xb4], 0xdf48ddbe
mov dword [esp + 0xb8], 0xdb0ed94a
mov dword [esp + 0xbc], 0xd740d546
mov dword [esp + 0xc0], 0xd3d0d142
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 0
mov byte [esp + 0xd4], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x24
ja 0x4303ae
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
movzx esi, byte [esp + eax + 0xb0]
lea eax, [edx - 0x4dc8f285]
lea ecx, [edx + esi]
add ecx, 0xb2370d7b
add edx, 0x7b
and edx, esi
and eax, esi
add eax, edx
mov edx, eax
xor edx, ecx
not eax
and eax, ecx
add eax, eax
sub eax, edx
add al, 0xa3
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0xb0], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 0x25
jb 0x430360
lea edi, [esp + 0xb0]
push edi
call fcn.00432340
add esp, 4
mov ecx, eax
mov dword [0x442034], eax
xor eax, eax
test ecx, ecx
sete al
mov eax, dword [eax*4 + 0x43ef08]
mov edx, 0xa85c977
xor edx, dword [0x43ef10]
add edx, eax
inc edx
xor eax, eax
jmp edx
Function at 0x4336a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov ebx, dword [esp + 0x70]
mov ebp, dword [esp + 0x5c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x4336c0
cmp edi, 0xfffffff5
jge 0x4336d7
mov eax, 0xffffffff
jmp 0x4336da
lea eax, [edi + 0xa]
push eax
call fcn.004088d0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebp]
test cx, cx
je 0x433722
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebp]
add ebp, 2
test cx, cx
jne 0x433710
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 0x18], ax
add edi, 0xa
mov word [esp + 0x1a], di
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov ecx, dword [0x441bec]
mov edi, 0xffffffff
test ecx, ecx
je 0x433864
mov eax, dword [0x441bf0]
add eax, 8
nop
nop
nop
nop
nop
nop
nop
cmp dword [eax - 8], 0xb1cf12ba
je 0x4337a4
add eax, 0xc
dec ecx
jne 0x433790
jmp 0x433864
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], 0x900000c2
mov dword [esp + 0xc], 0xd2ff0000
mov dword [esp + 8], 0xba00
mov dword [esp + 4], 0xb8
mov eax, dword [eax]
mov dword [esp + 5], eax
mov eax, dword [0x441bf4]
mov dword [esp + 0xa], eax
mov word [esp + 0x11], 0x2c
mov dword [esp], 0
mov dword [esp + 0x24], 0x10
lea eax, [esp + 0x24]
mov ebp, esp
push 0x40
push 0x3000
push eax
push 0
push ebp
push 0xffffffffffffffff
call dword [0x441bf8]
mov edi, dword [esp]
lea eax, [esp + 4]
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea ecx, [esp + 0x40]
lea eax, [esp + 0x28]
push 0
push 0
push ebx
push dword [esp + 0x78]
push dword [esp + 0x78]
push 0x80
push 0
push ecx
push eax
push dword [esp + 0x88]
push dword [esp + 0x88]
call dword [esp + 0x2c]
mov edi, eax