joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402780
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x472962
mov eax, dword fs:[0]
push eax
sub esp, 0x3f8
mov eax, dword [0x48e230]
xor eax, esp
mov dword [esp + 0x3f4], eax
push esi
push edi
mov eax, dword [0x48e230]
xor eax, esp
push eax
lea eax, [esp + 0x404]
mov dword fs:[0], eax
mov eax, dword [esp + 0x418]
mov esi, dword [esp + 0x414]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov eax, 1
lea ecx, [esp + 0xc]
push ecx
push eax
push 0
lea ecx, [esp + 0x428]
mov dword [esp + 0x418], eax
mov dword [esp + 0x20], 0x3e8
mov dword [esp + 0x1c], eax
call dword [sym.imp.mfc80.dll_Ordinal_874]
mov edx, dword [esp + 0x18]
push eax
push edx
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x402817
push 0x4736bb
jmp 0x402857
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
lea ecx, [esp + 0x430]
call dword [sym.imp.mfc80.dll_Ordinal_874]
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test edi, edi
jne 0x402810
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call dword [sym.imp.mfc80.dll_Ordinal_304]
lea ecx, [esp + 0x41c]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x420]
call dword [sym.imp.mfc80.dll_Ordinal_575]
mov eax, esi
mov ecx, dword [esp + 0x404]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x3f4]
xor ecx, esp
call fcn.00471992
add esp, 0x404
ret 0x10

Function at 0x4028b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4729a8
mov eax, dword fs:[0]
push eax
sub esp, 0x3f4
mov eax, dword [0x48e230]
xor eax, esp
mov dword [esp + 0x3f0], eax
push esi
mov eax, dword [0x48e230]
xor eax, esp
push eax
lea eax, [esp + 0x3fc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40c]
lea eax, [esp + 0x10]
push eax
push 0x3e8
mov dword [esp + 0x14], 0
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
jne 0x402916
push eax
mov ecx, esi
call dword [sym.imp.mfc80.dll_Ordinal_304]
jmp 0x40297b
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc80.dll_Ordinal_304]
push str.SplashFile.txt
lea ecx, [esp + 0x10]
mov dword [esp + 0x408], 0
call dword [sym.imp.mfc80.dll_Ordinal_304]
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x408], 1
call dword [sym.imp.mfc80.dll_Ordinal_907]
lea ecx, [esp + 0xc]
mov byte [esp + 0x404], 0
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea edx, [esp + 8]
push edx
mov ecx, esi
call dword [sym.imp.mfc80.dll_Ordinal_297]
lea ecx, [esp + 8]
call dword [sym.imp.mfc80.dll_Ordinal_575]
mov eax, esi
mov ecx, dword [esp + 0x3fc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x3f0]
xor ecx, esp
call fcn.00471992
add esp, 0x400
ret 4
Function at 0x402b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472a71
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x48e230]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push str.90125
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call dword [sym.imp.mfc80.dll_Ordinal_304]
push 2
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
mov dword [esp + 0x38], 0
call dword [sym.imp.mfc80.dll_Ordinal_3997]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc80.dll_Ordinal_293]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov bl, 3
push str.DownloadTo
mov byte [esp + 0x38], bl
call dword [sym.imp.mfc80.dll_Ordinal_304]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.SoftwareMetalixVersLocations
mov byte [esp + 0x3c], 4
call dword [sym.imp.mfc80.dll_Ordinal_304]
push 0x80000002
lea edx, [esp + 0x24]
push edx
mov ecx, esi
mov byte [esp + 0x40], bl
call fcn.00402780
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 5
call dword [sym.imp.mfc80.dll_Ordinal_781]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call dword [sym.imp.mfc80.dll_Ordinal_575]
push 0x4736bb
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc80.dll_Ordinal_1482]
test eax, eax
jne 0x402c04
mov esi, dword [esp + 0x38]
push 0x4736bb
mov ecx, esi
call dword [sym.imp.mfc80.dll_Ordinal_304]
jmp 0x402ccd
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc80.dll_Ordinal_2901]
sub eax, 1
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc80.dll_Ordinal_865]
cmp al, 0x5c
je 0x402c2f
push 0x4744e4
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc80.dll_Ordinal_897]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc80.dll_Ordinal_297]
mov bl, 6
push str.cncKadSP
lea ecx, [esp + 0x28]
mov byte [esp + 0x34], bl
call dword [sym.imp.mfc80.dll_Ordinal_304]
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x3c], 7
call fcn.004029b0
push str..exe
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x48], 8
call fcn.00402a50
add esp, 0x18
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 9
call dword [sym.imp.mfc80.dll_Ordinal_907]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], bl
call dword [sym.imp.mfc80.dll_Ordinal_575]
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [sym.imp.mfc80.dll_Ordinal_297]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc80.dll_Ordinal_575]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x402d00
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x472aa5
mov eax, dword fs:[0]
push eax
sub esp, 0x400
mov eax, dword [0x48e230]
xor eax, esp
mov dword [esp + 0x3fc], eax
push ebx
push esi
push edi
mov eax, dword [0x48e230]
xor eax, esp
push eax
lea eax, [esp + 0x410]
mov dword fs:[0], eax
mov edi, dword [esp + 0x420]
mov dword [esp + 0x14], 0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x428]
mov dword [esp + 0x41c], 0
call dword [sym.imp.mfc80.dll_Ordinal_874]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
push esi
call dword [sym.imp.msvcr80.dll_malloc]
mov ecx, dword [esp + 0x20]
add esp, 4
mov ebx, eax
push ebx
push esi
push ecx
lea ecx, [esp + 0x430]
call dword [sym.imp.mfc80.dll_Ordinal_874]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x402daa
push 0x4736bb
mov ecx, edi
call dword [sym.imp.mfc80.dll_Ordinal_304]
jmp 0x402e57
lea edx, [esp + 0x18]
push edx
push 0x48e30c
push str.VarFileInfoTranslation
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x402d98
mov eax, dword [esp + 0x18]
shr eax, 2
xor esi, esi
test eax, eax
jle 0x402e1f
mov eax, dword [0x48e30c]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ecx
push edx
push str.StringFileInfo_04x_04xFileVersion
lea eax, [esp + 0x30]
push 0x32
push eax
call fcn.00402ae0
add esp, 0x14
test eax, eax
jl 0x402d98
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x402d98
mov ecx, dword [esp + 0x18]
add esi, 1
shr ecx, 2
cmp esi, ecx
jl 0x402dd0
mov edx, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc80.dll_Ordinal_304]
push ebx
mov byte [esp + 0x41c], 1
call dword [sym.imp.msvcr80.dll_free]
add esp, 4
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [sym.imp.mfc80.dll_Ordinal_297]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x424]
call dword [sym.imp.mfc80.dll_Ordinal_575]
mov eax, edi
mov ecx, dword [esp + 0x410]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3fc]
xor ecx, esp
call fcn.00471992
add esp, 0x40c
ret 8
Function at 0x402e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472b0d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x48e230]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x10], eax
push str.90125
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], eax
call dword [sym.imp.mfc80.dll_Ordinal_304]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 2
push ecx
mov ecx, eax
mov byte [esp + 0x2c], 1
call dword [sym.imp.mfc80.dll_Ordinal_3997]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SoftwareMetalixVersLocations
mov byte [esp + 0x2c], 2
call dword [sym.imp.mfc80.dll_Ordinal_304]
push 0x80000002
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.00402780
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 4
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 8]
call dword [sym.imp.mfc80.dll_Ordinal_2901]
sub eax, 1
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc80.dll_Ordinal_865]
cmp al, 0x5c
je 0x402f4d
push 0x4744e4
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc80.dll_Ordinal_897]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004029b0
add esp, 0xc
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 5
call dword [sym.imp.mfc80.dll_Ordinal_781]
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 4
call dword [sym.imp.mfc80.dll_Ordinal_575]
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call dword [sym.imp.mfc80.dll_Ordinal_297]
lea ecx, [esp + 8]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc80.dll_Ordinal_575]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8

Function at 0x402fc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472b41
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x48e230]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call sub.mfc80.dll_Ordinal_556
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004028b0
push 0
push 0x5001
mov ecx, eax
mov byte [esp + 0x34], 1
call dword [sym.imp.mfc80.dll_Ordinal_874]
push eax
lea ecx, [esp + 0x1c]
call sub.mfc80.dll_Ordinal_5097
test eax, eax
lea ecx, [esp + 0xc]
sete bl
mov byte [esp + 0x2c], 0
call dword [sym.imp.mfc80.dll_Ordinal_575]
test bl, bl
lea ecx, [esp + 0x10]
jne 0x403055
push str.text
call sub.mfc80.dll_Ordinal_6310
lea ecx, [esp + 0x10]
call sub.mfc80.dll_Ordinal_1452
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call sub.mfc80.dll_Ordinal_744
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x403450
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x472c2d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48e230]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, ecx
push str.metalix.ini
push 1
push str.CheckUpdates
push str.UpdateInfo
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
cmp eax, 1
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
sete bl
call fcn.00402b10
test bl, bl
mov dword [esp + 0x38], 0
je 0x4035f4
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc80.dll_Ordinal_3933]
test al, al
jne 0x4035f4
push str.90125
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc80.dll_Ordinal_304]
push 2
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
mov byte [esp + 0x40], 1
call dword [sym.imp.mfc80.dll_Ordinal_3997]
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 3
call dword [sym.imp.mfc80.dll_Ordinal_575]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call dword [sym.imp.mfc80.dll_Ordinal_297]
mov ecx, ebp
call fcn.00403360
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, esi
imul eax, eax, 0x3e8
sub ecx, eax
mov ebx, ecx
push str.90125
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc80.dll_Ordinal_304]
push 2
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
mov byte [esp + 0x40], 4
call dword [sym.imp.mfc80.dll_Ordinal_3997]
mov ecx, eax
call dword [sym.imp.mfc80.dll_Ordinal_874]
push eax
call dword [sym.imp.msvcr80.dll_atoi]
add esp, 4
lea ecx, [esp + 0x28]
mov edi, eax
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc80.dll_Ordinal_293]
push edi
lea edx, [esp + 0x1c]
push 0x474588
push edx
mov byte [esp + 0x44], 5
call dword [sym.imp.mfc80.dll_Ordinal_2322]
add esp, 0xc
mov ecx, ebp
call fcn.00403290
lea ecx, [esp + 0x1c]
mov ebp, eax
call dword [sym.imp.mfc80.dll_Ordinal_293]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc80.dll_Ordinal_575]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc80.dll_Ordinal_575]
cmp edi, esi
jne 0x4035fe
cmp ebx, ebp
setg al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc80.dll_Ordinal_575]
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x40a440
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x4c63e0]
test eax, eax
jne 0x40a476
push esi
push 0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateMutexA]
push 0
mov esi, eax
push esi
push 0x4c63e0
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp dword [0x4c63e0], esi
je 0x40a475
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop esi
mov eax, dword [0x4c63e0]
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
ret
Function at 0x40a5a0
Capabilities:
Get disk information
Query environment variable

Disassembly:
sub esp, 0x100
push 0x100
push 0
push 0x5ad760
call fcn.0042cd70
add esp, 0xc
push 0xfe
lea eax, [esp + 4]
push eax
push str.SystemDrive
mov dword [0x4c6398], 0
mov byte [esp + 0xc], 0
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40a5e9
cmp eax, 0xfe
jbe 0x40a5fa
lea ecx, [esp]
push 0x47f124
push ecx
call fcn.0041c3b0
add esp, 8
lea edx, [esp]
push edx
call fcn.0042ce30
add esp, 4
test eax, eax
je 0x40a61a
cmp byte [esp + eax - 1], 0x5c
je 0x40a61a
mov byte [esp + eax], 0x5c
mov byte [esp + eax + 1], 0
push 0
push 0
push 0
push 0
push 0x5ad760
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
test eax, eax
je 0x40a644
mov dword [0x4c6398], 4
add esp, 0x100
ret

Function at 0x40ac80
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x47f230]
test eax, eax
je 0x40acaf
mov dword [0x4c641c], 0xffffffff
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x47f114], eax
je 0x40acb9
mov dword [0x47f230], 0
jmp 0x40acb4
mov eax, dword [0x47f114]
cmp eax, 0xffffffff
jne 0x40acbc
xor eax, eax
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x40acfe
push 4
call fcn.0040caf0
mov esi, eax
add esp, 4
test esi, esi
je 0x40acfa
mov eax, dword [0x47f114]
push esi
push eax
mov dword [esi], 0xffffffff
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
jne 0x40acfe
push esi
call fcn.0040cb10
add esp, 4
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x40dba0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.00435690
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
pop esi
ret

Function at 0x40dc30
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
mov eax, dword [0x47f240]
and eax, 0xff00
cmp eax, 0x5000
je 0x40dc7d
shr edi, 2
xor edx, edx
test edi, edi
jle 0x40dc7d
push ebx
mov edi, edi
mov ecx, dword [esi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x40dc50
pop ebx
pop edi
ret
Function at 0x4115b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp dword [ebx], 0
push ebp
push edi
je 0x4115cc
pop edi
mov dword [esp + 0xc], 0xdd
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x10]
movzx edx, byte [eax + 2]
xor ecx, ecx
mov ch, byte [eax]
push esi
mov cl, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
cmp ecx, 0x54534421
jne 0x411613
movzx esi, byte [eax + 6]
xor edx, edx
mov dh, byte [eax + 4]
mov ecx, 1
mov dl, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
or edx, esi
jmp 0x411633
mov edx, dword [eax]
xor ecx, ecx
cmp edx, 0x54534421
je 0x411630
pop esi
pop edi
mov dword [esp + 0xc], 0xd8
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
mov edx, dword [eax + 4]
cmp edx, 2
je 0x411649
pop esi
pop edi
mov dword [esp + 0xc], 0xdf
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
cmp ecx, 1
jne 0x41166a
movzx edx, byte [eax + 0x16]
xor ecx, ecx
mov ch, byte [eax + 0x14]
mov cl, byte [eax + 0x15]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0x17]
shl ecx, 8
or ecx, edx
jmp 0x41166d
mov ecx, dword [eax + 0x14]
add ecx, 0x20
push ecx
push eax
call fcn.00436da0
mov esi, eax
add esp, 8
test esi, esi
je 0x411715
push ebx
push esi
call fcn.004365a0
mov edi, eax
push esi
mov dword [esp + 0x20], edi
call fcn.00436d40
add esp, 0xc
test edi, edi
jne 0x41171d
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
xor ebp, ebp
test ecx, ecx
jbe 0x41171d
xor ebx, ebx
jmp 0x4116b0
mov esi, dword [eax + 0x14]
mov ecx, dword [esi + ebx]
mov edx, dword [eax + 0x18]
add esi, ebx
lea eax, [edx + ecx*8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ecx
push edx
call fcn.00436ce0
mov edi, eax
add esp, 8
test edi, edi
je 0x411706
push edi
call fcn.004110d0
push edi
mov dword [esi + 0xc], eax
call fcn.004369a0
mov eax, dword [esi + 0xc]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
je 0x411726
mov eax, dword [eax]
mov ecx, dword [eax + 8]
inc ebp
add ebx, 0x10
cmp ebp, ecx
jb 0x4116b0
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push edx
call fcn.00410fb0
add esp, 4
mov dword [esp + 0x14], 0xc
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [eax]
push ecx
call fcn.00410fb0
add esp, 4
pop esi
pop edi
mov dword [esp + 0xc], 0x7d1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
Function at 0x416fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
jmp 0x417387
push edi
mov edi, ecx
cmp eax, 0xae4f
je 0x4173ac
cmp eax, 0
je 0x4173ca
cmp eax, 0
je 0x4173e8
cmp eax, 0
je 0x417406
add byte [eax + 0x5f], dh
pop edi
jmp 0x41900e
mov eax, 0xe21f93cf
stosd dword es:[edi], eax
mov eax, 0xacef72d4
stosd dword es:[edi], eax
mov eax, 0xd89329ec
stosd dword es:[edi], eax
mov eax, 0xb78515cc
stosd dword es:[edi], eax
pop edi
jmp 0x41903c
jb 0x4173e4
add byte [eax], al
adc eax, 0x2fdd5d14
jp 0x417433
adc eax, 0x5ca563b
xor eax, 0x42fc5d9f
adc dword [edx - 0x4de64edf], esi
jge 0x417430
jno 0x41740f
sub dh, byte [ecx - 0x44]
jno 0x4173a3
and dword [edx + 0x48da735a], esi
mov dl, 0x5a
jae 0x4173c6
dec eax
pop ecx
xor dword [ecx + 0x67ebb231], esi
xor eax, 0x3f90241e
push ebx
xor eax, 0x603c5822
mov esi, ecx
or eax, 0x58b9211a
or eax, 0x723872e8
pop eax
push eax
xor dword [ebx + 0x49d17553], esi
push ebx
jne 0x4173e3
dec ecx
adc eax, 0x388f268d
xor ecx, 0x6ef66fe6
sbb dword [ebx + 0x55bd57d], esi
sub eax, 0x7a43d726
movsb byte es:[edi], byte [esi]
push ebx
adc dword [ebx - 0x4ccec08c], esi
and eax, 0x1b4d4997
inc ecx
inc edx
mov bl, 0x74
aas
xor dword [ebx + 0x4d499725], esi
mov bl, 0x25
xchg edi, eax
dec ecx
dec ebp
sbb eax, dword [ecx + 0x42]
push eax
jno 0x41742c
int3
mov eax, 0xfffffffe
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41c600
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x41c621
ret
mov eax, dword [esp + 0xc]
ret
Function at 0x41d9f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [ecx]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
add dword [eax + 4], edx
mov edx, dword [ecx + 4]
add esi, edx
mov dword [eax], esi
lea edx, [ecx + 0x10]
mov dword [esp + 0x10], 3
mov edi, edi
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
xor ebx, ebp
mov esi, ebx
mov edi, ebp
shr edi, 4
and edi, 0x1f
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
mov edi, dword [edx - 8]
shl ebx, cl
mov ecx, 0x20
or esi, ebx
sub esi, edi
mov dword [eax + 4], esi
mov edi, esi
shr edi, 7
xor esi, ebp
and edi, 0x1f
sub ecx, edi
mov ebx, esi
shr ebx, cl
mov ecx, edi
shl esi, cl
mov ecx, dword [edx - 4]
or ebx, esi
add ecx, ebx
mov ebx, dword [eax + 4]
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx]
mov edi, ecx
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
xor ebx, esi
mov edi, esi
mov dword [eax + 4], esi
shr edi, 7
and edi, 0x1f
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, dword [edx + 4]
or esi, ebx
mov ebx, dword [eax + 4]
add ecx, esi
mov edi, ecx
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx + 8]
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
mov edi, esi
shr edi, 7
and edi, 0x1f
mov dword [eax + 4], esi
xor ebx, esi
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, dword [edx + 0xc]
add edx, 0x20
or esi, ebx
mov ebx, dword [eax + 4]
add ecx, esi
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx - 0x10]
mov edi, ecx
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
mov edi, esi
xor ebx, esi
shr edi, 7
mov dword [eax + 4], esi
and edi, 0x1f
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
mov edi, dword [edx - 0xc]
shl ebx, cl
mov ecx, dword [esp + 0x10]
or esi, ebx
add esi, edi
dec ecx
mov dword [eax], esi
mov dword [esp + 0x10], ecx
jne 0x41da10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41db50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, 0xc
jmp 0x41db60
mov ebx, dword [edi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + ebp*8 + 4]
mov edx, dword [edi]
sub edx, ecx
mov esi, ebx
shr esi, 7
and esi, 0x1f
mov eax, edx
mov ecx, 0x20
sub ecx, esi
shl eax, cl
mov ecx, esi
shr edx, cl
mov ecx, dword [esp + 0x10]
or eax, edx
xor eax, ebx
mov dword [edi], eax
mov edx, dword [ecx + ebp*8]
lea esi, [edx + ebx]
mov edx, eax
shr edx, 4
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
mov ebx, esi
shl ebx, cl
mov ecx, edx
shr esi, cl
or ebx, esi
xor ebx, eax
dec ebp
mov dword [edi + 4], ebx
jne 0x41db60
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
sub dword [edi], ecx
mov edx, dword [eax]
mov eax, ebx
pop esi
sub eax, edx
pop ebp
mov dword [edi + 4], eax
pop ebx
ret