joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468120
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4aad70
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4682c7
mov ecx, dword [0x546140]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x46821c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00466e40
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0049b740
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0049b653
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x53ef4c
call fcn.0049b6c1
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00467200
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0049b740
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0049b653
lea ecx, [esp + 0xc]
call fcn.0049bb1b
mov ecx, dword [esp + 0xc]
push 0x53f98c
push ecx
call fcn.0048a5c4
add esp, 8
test eax, eax
je 0x468244
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x46817d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0049b653
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0049b653
jmp 0x4682cb
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00467ec0
test eax, eax
push 0
je 0x4682af
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.00466560
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x468295
cmp eax, 0x64
jg 0x468283
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x468220
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x468220
cmp eax, 0x64
jge 0x46821c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x468220
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.00466560
mov esi, eax
jmp 0x468220
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x4682d5
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x46fd10
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x46fdb3
test eax, eax
jbe 0x46fdb3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x46fdb3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46fd5e
xor esi, esi
jmp 0x46fd64
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46fd8f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00471ca0
add esi, eax
push esi
mov ebx, esi
call fcn.00471ca0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x46fd70
pop ebp
test edi, edi
pop edi
jne 0x46fdb3
test ebx, ebx
je 0x46fdb3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0048af00
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x46fef5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x47000d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47000d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0049d090
mov esi, eax
test esi, esi
je 0x47000d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x47000d
mov ecx, esi
call fcn.0046fe60
cmp edi, eax
jge 0x47000d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46ff93
mov dword [esp + 0x34], 1
jmp 0x46ffee
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x47000d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046f460
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4795d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ab9d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004a16e6
xor eax, eax
mov dword [esi + 0x10], 0x522a04
mov dword [esp + 0x10], eax
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi], method.CDC.virtual_0
mov byte [esp + 0x10], cl
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ecx], eax
mov edx, dword [esp + 0x24]
mov dword [ecx + 4], eax
push edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004796d0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x479660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ab9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], method.CDC.virtual_0
mov eax, dword [esi + 0x30]
mov dword [esp + 0x14], 1
push eax
call fcn.0047a310
lea ecx, [esi + 0x10]
mov dword [esp + 8], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x14], 2
call fcn.004a2334
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004a181b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x481ac0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x481b0c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x481b0c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x481af6
push eax
call ebp
test ax, ax
jl 0x481b04
inc esi
add edi, 4
cmp esi, 6
jb 0x481ae8
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004817c0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x484630
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x484690
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x484690
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x484690
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x484690
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4846a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x485100
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x485166
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x485166
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x485147
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x485ca0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00485df0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x485cc0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x485ca1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00485df0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x485cc0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x485cf0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x485d47
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x485d5d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00485d80
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x485d80
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x485e10
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x485e59
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x4862d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ac310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00485e80
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00485f00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00485f00
lea ecx, [esi + 0xc]
call fcn.0049b5de
lea ecx, [esi + 0x10]
call fcn.0049b5de
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00488730
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00488730
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00488730
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0049b653
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049b653
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x486f78
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ac538
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x486f88
call fcn.004874a0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x48706b
cmp byte [edi], 0
je 0x48706b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x486fad
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00485ca0
test eax, eax
jne 0x486fcd
push 0x545ed0
lea ecx, [esi + 0x38]
call fcn.0049b790
jmp 0x48706b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00485cf0
test eax, eax
jne 0x486ffc
mov ecx, esi
call fcn.00485df0
push edi
add esi, 0x38
push 0x545eac
push esi
call fcn.0049910a
add esp, 0xc
jmp 0x48706b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00487d20
test eax, eax
je 0x487064
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00487140
test eax, eax
jne 0x487080
push edi
lea eax, [esi + 0x38]
push 0x545e88
push eax
call fcn.0049910a
add esp, 0xc
mov ecx, esi
call fcn.004874a0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x487128
mov ecx, dword [0x546140]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0049910a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00485da0
test eax, eax
jne 0x4870ea
push 0x545e6c
lea ecx, [esi + 0x38]
call fcn.0049b790
jmp 0x4870fa
push 0xfa
mov ecx, esi
call fcn.00487d20
test eax, eax
jne 0x487117
mov ecx, esi
call fcn.004874a0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0049b653
jmp 0x48706b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0049b653
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x49da34
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49da6c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049baae
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049ba86
jmp 0x49da78
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49f12b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49f16d
call fcn.004a5015
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49f16d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49f164
xor eax, eax
jmp 0x49f175
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049f17b
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a5545
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a5573
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a5591
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a54ab
jmp 0x4a5591
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a5591
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a54ab
test edi, edi
mov eax, edi
jne 0x4a557b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x423697
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x4238dd
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x40
pop edi
push edi
lea eax, [ebp - 0x40]
push 0x36
push eax
call fcn.0042f5c0
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x423917
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x423917
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x423905
push dword [ebp + 8]
call fcn.00423697
push edi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
call fcn.004236c9
push edi
lea eax, [ebp - 0x40]
push 0x5c
push eax
call fcn.0042f5c0
add esp, 0x1c
xor ecx, ecx
test ebx, ebx
jle 0x42395b
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x42395b
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x423949
mov edx, dword [ebp + 8]
add edx, 0x60
push edx
call fcn.00423697
push edi
lea eax, [ebp - 0x40]
push eax
push edx
call fcn.004236c9
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00428411
add esp, 0x18
pop edi
pop esi
leave
ret

Function at 0x42aaf3
Capabilities:
Terminate process

Disassembly:
push esi
push 0x445438
mov esi, 0x448950
push esi
call fcn.0042ef33
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
call fcn.00430203
push esi
push 0xa
call fcn.0042f6d6
add esp, 0x1c
push 1
call fcn.004300ff
pop esi
Function at 0x42c3d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push dword [ebp + 0x14]
call fcn.0042d810
pop ecx
push 1
push dword [ebp + 8]
mov edi, eax
inc edi
call fcn.0042d810
push dword [ebp + 0x10]
mov esi, eax
call fcn.0042d810
pop ecx
lea eax, [esi + eax + 5]
pop ecx
lea eax, [eax + eax*2]
push eax
call fcn.00403bc7
push dword [ebp + 0x10]
mov ebx, eax
push dword [ebp + 0xc]
mov esi, ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
call fcn.0042c396
add esp, 0x14
lea eax, [ebp - 8]
push eax
push 0x446048
push 0x80000001
call dword [0x437008]
test eax, eax
je 0x42c44f
push ebx
call fcn.00403c87
pop ecx
xor eax, eax
inc eax
jmp 0x42c5f6
push 1
push edi
mov dword [ebp - 0xc], edi
call fcn.00403bc7
mov esi, dword [0x437004]
pop ecx
pop ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
push dword [ebp - 8]
call esi
test eax, eax
mov dword [ebp - 0x10], eax
je 0x42c5a7
cmp eax, 0xea
je 0x42c5a7
push 0x438728
push dword [ebp + 0x10]
call fcn.0042dac0
test eax, eax
pop ecx
pop ecx
jne 0x42c5a7
push 0x43bc68
push ebx
call fcn.0042fb00
lea eax, [eax + ebx + 1]
mov dword [ebp - 0x18], eax
lea eax, [edi + 0xa]
push 1
push eax
call fcn.00403bc7
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
push dword [ebp - 8]
call esi
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x42c59e
cmp dword [ebp - 0x14], 1
jne 0x42c59e
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x18], 2
mov byte [esi], 0x30
inc esi
push 0x43812c
mov byte [esi], 0x78
push edi
inc esi
call fcn.0042fb00
pop ecx
pop ecx
mov ecx, eax
push 4
cdq
pop ebx
idiv ebx
lea edx, [ecx - 1]
mov dword [ebp - 0x24], eax
jmp 0x42c52a
cmp ecx, 1
jle 0x42c535
dec ecx
dec edx
mov eax, edx
xor eax, 3
cmp byte [eax + edi], 0x30
je 0x42c523
xor ebx, ebx
test ecx, ecx
jle 0x42c54f
lea edx, [ecx + esi - 1]
mov eax, ebx
xor eax, 3
mov al, byte [eax + edi]
inc ebx
mov byte [edx], al
dec edx
cmp ebx, ecx
jl 0x42c53f
mov eax, dword [ebp - 0x24]
lea edi, [edi + eax*4]
add esi, ecx
cmp byte [edi], 0
je 0x42c561
inc edi
mov byte [esi], 0x2c
inc esi
dec dword [ebp - 0x18]
mov byte [esi], 0
jne 0x42c4fe
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.0042dac0
test eax, eax
pop ecx
pop ecx
jne 0x42c59b
push dword [ebp - 4]
call fcn.0042d810
mov ebx, dword [ebp - 0x1c]
pop ecx
inc eax
push eax
push dword [ebp - 4]
push 1
push 0
push ebx
push dword [ebp - 8]
call dword [0x43701c]
jmp 0x42c59e
mov ebx, dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.00403c87
pop ecx
push dword [ebp - 8]
call dword [section..rdata]
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.0042dac0
push dword [ebp - 4]
mov esi, eax
call fcn.00403c87
push ebx
call fcn.00403c87
add esp, 0x10
cmp dword [ebp - 0x10], 0xea
je 0x42c5f3
cmp dword [ebp - 0x10], 0
jne 0x42c447
cmp dword [ebp - 0x14], 1
jne 0x42c447
test esi, esi
jne 0x42c5f3
xor eax, eax
jmp 0x42c5f6
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4302c3
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x446b08
call fcn.00431ed4
mov edi, 0x94
mov eax, edi
call fcn.0042fef0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x437090]
mov ecx, dword [esi + 0x10]
mov dword [0x449e0c], ecx
mov eax, dword [esi + 4]
mov dword [0x449e18], eax
mov edx, dword [esi + 8]
mov dword [0x449e1c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x449e10], esi
cmp ecx, 2
je 0x430323
or esi, 0x8000
mov dword [0x449e10], esi
shl eax, 8
add eax, edx
mov dword [0x449e14], eax
xor edi, edi
push edi
call dword [0x43713c]
cmp word [eax], 0x5a4d
jne 0x43035c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43035c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x430374
cmp eax, 0x20b
je 0x430361
mov dword [ebp - 0x1c], edi
jmp 0x430388
cmp dword [ecx + 0x84], 0xe
jbe 0x43035c
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x430382
cmp dword [ecx + 0x74], 0xe
jbe 0x43035c
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push edi
call fcn.00432741
pop ecx
test eax, eax
jne 0x4303b4
cmp dword [0x449e58], 2
je 0x4303a1
call fcn.004342f6
push 0x1c
call fcn.0043417f
push 0xff
call fcn.0042ffa4
pop ecx
pop ecx
call fcn.0043461d
mov dword [ebp - 4], edi
call fcn.004324a9
test eax, eax
jge 0x4303cd
push 0x1b
call fcn.0043029e
pop ecx
call dword [0x437148]
mov dword [0x44a4c0], eax
call fcn.00434c2e
mov dword [0x449e50], eax
call fcn.00434b8c
test eax, eax
jge 0x4303f3
push 8
call fcn.0043029e
pop ecx
call fcn.00434959
test eax, eax
jge 0x430404
push 9
call fcn.0043029e
pop ecx
push 1
call fcn.0042ffd4
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x43041a
push eax
call fcn.0043029e
pop ecx
mov eax, dword [0x449e2c]
mov dword [0x449e30], eax
push eax
push dword [0x449e24]
push dword [0x449e20]
call fcn.0042af8e
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x430449
push esi
call fcn.004300ff
call fcn.00430121
jmp 0x43047b
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.00431f0f
ret