joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
and dword [esi + 0x30], 0
push edi
call fcn.004015a9
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov ebx, dword [edi]
jmp 0x401728
push 0xa
push 0xa
push 0x1506204
push 0x3114b604
call fcn.00401dce
add esp, 0xc
push eax
push dword [ebx + 0x30]
call fcn.00401618
add esp, 0xc
test eax, eax
je 0x401731
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x401700
jmp 0x4017c3
mov ebx, dword [ebx + 0x18]
test ebx, ebx
je 0x4017c3
mov eax, dword [ebx + 0x3c]
mov edi, dword [eax + ebx + 0x78]
and dword [esp + 0xc], 0
add edi, ebx
mov eax, dword [edi + 0x1c]
add eax, ebx
push ebp
mov ebp, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x24]
add eax, ebx
add ebp, ebx
cmp dword [edi + 0x18], 0
mov dword [esp + 0x18], eax
jbe 0x4017bf
mov eax, dword [esp + 0x10]
mov eax, dword [ebp + eax*4]
push 0x16
add eax, ebx
push 0x15061ec
push 0x40704011
mov dword [esp + 0x20], eax
call fcn.00401d80
push eax
push dword [esp + 0x24]
call fcn.00401644
add esp, 0x14
test eax, eax
je 0x4017a7
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [edi + 0x18]
jb 0x401768
jmp 0x4017bf
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
add eax, ebx
mov dword [esi + 4], eax
mov dword [esi + 0x30], ebx
pop ebp
cmp dword [esi + 0x30], 0
je 0x40192a
push 0xa
push 0x15061e0
push 0x29a1a909
call fcn.00401d80
add esp, 0xc
push eax
push esi
mov ecx, esi
call fcn.004016ba
push 0xc
push 0x15061d0
push 0x13cbcee9
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 8]
push eax
mov ecx, esi
call fcn.004016ba
push 0x18
push 0x15061b4
push 0x17ce53be
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0xc]
push eax
mov ecx, esi
call fcn.004016ba
push 0xf
push 0x15061a4
push 0x26b30b69
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0x10]
push eax
mov ecx, esi
call fcn.004016ba
push 0x12
push 0x1506190
push 0x3d924530
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0x14]
push eax
mov ecx, esi
call fcn.004016ba
push 7
push 0x1506188
push 0x2236409a
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0x18]
push eax
mov ecx, esi
call fcn.004016ba
push 0x14
push 0x1506170
push 0x149ccd04
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0x1c]
push eax
mov ecx, esi
call fcn.004016ba
push 0x11
push 0x150615c
push 0x673ebfe9
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0x20]
push eax
mov ecx, esi
call fcn.004016ba
push 0x11
push 0x1506148
push 0x68d29b96
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0x24]
push eax
mov ecx, esi
call fcn.004016ba
push 0x16
push 0x1506130
push 0x7db65c79
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0x28]
push eax
mov ecx, esi
call fcn.004016ba
push 0x13
push 0x150611c
push 0x65fa79df
call fcn.00401d80
add esp, 0xc
push eax
lea eax, [esi + 0x2c]
push eax
mov ecx, esi
call fcn.004016ba
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x401933
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, section..data
mov ecx, 0x7ffb
mov esi, 0x534ba3
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov edx, ecx
shr edx, 0xc
xor byte [eax], dl
inc eax
dec esi
jne 0x401943
pop esi
ret

Function at 0x401a9f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x401ae6
push 7
push str..custom
push edi
call fcn.00401618
add esp, 0xc
test eax, eax
je 0x401aed
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x401ac3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.00401e2c
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x40195c
mov dword [ebp - 0x14], 0x401967
call fcn.004037de
add esp, 0x28
test eax, eax
je 0x401b4d
push dword [ebp - 4]
call fcn.00401e43
pop ecx
jmp 0x401ae6
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x401ae8

Function at 0x401d80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
je 0x401dbf
push edi
mov edi, dword [esp + 0x14]
sub edi, 0x1a3bbb0
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov eax, edx
shr eax, 0xc
xor al, byte [edi + esi + 0x1a3bbb0]
inc esi
mov byte [esi + 0x1a3bbaf], al
cmp esi, ebx
jb 0x401d9b
pop edi
pop esi
mov byte [ebx + 0x1a3bbb0], 0
mov eax, 0x1a3bbb0
pop ebx
ret

Function at 0x401dce
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x401e0c
mov eax, dword [esp + 0x10]
sub eax, 0x1a3bbb0
push ebx
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov ebx, edx
shr ebx, 0xc
xor bl, byte [eax + esi + 0x1a3bbb0]
inc esi
mov byte [esi + 0x1a3bbaf], bl
cmp esi, edi
jb 0x401de8
pop ebx
mov byte [edi + 0x1a3bbb0], 0
mov byte [edi + 0x1a3bbb1], 0
pop edi
mov eax, 0x1a3bbb0
pop esi
ret
Function at 0x401f2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401f47
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x401f6a
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401f6f
inc edi
cmp edi, dword [ebp - 4]
jb 0x401f61
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x402067
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x401fc6
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x401f9a
cmp cl, 0xff
jne 0x401ff1
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x401fff
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x402006
dec ecx
shl edx, cl
and edx, 7
je 0x401f8b
movzx ecx, byte [edx + 0x1506294]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x150628c], 0
mov cl, byte [ebx + 4]
je 0x401fee
test cl, cl
je 0x401fee
cmp cl, 0xff
jne 0x401f8b
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401f5c
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x40203a
movzx esi, byte [edx + 0x1506294]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x402025
cmp al, 0xff
jne 0x402037
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x401fb8
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401f5c
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x1001a71d
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082200
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001a7af
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call fcn.100188e3
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
call fcn.1001ac57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1001ac8c
jmp 0x1001a7cf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1001a7cf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10021428
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002145d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002145b
push 0x1672
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10021480
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10021480
push 0x1582
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret
Function at 0x1002e64d
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002e67e
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002e67c
push 0x1681
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1002e6a8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x100335f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10033614
xor eax, eax
jmp 0x1003374d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10033632
xor eax, eax
jmp 0x1003374d
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.1003316d
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x10033650
xor eax, eax
jmp 0x1003374d
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1003343e
add esp, 0x18
push 0x75f8
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push 0
call fcn.10030165
add esp, 0x14
push 0x6fc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push 0x40f1
lea eax, [ebp - 0xc]
push eax
call fcn.100334ba
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x100336c8
push 0x3ecf
lea eax, [ebp - 4]
push eax
push 0x5f94
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.1003352b
add esp, 0x14
push dword [ebp - 4]
call fcn.10033041
pop ecx
test eax, eax
jne 0x100336d9
xor eax, eax
jmp 0x1003374d
push 1
push dword [ebp - 4]
call fcn.1002d095
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10033735
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10033704
xor eax, eax
jmp 0x1003374d
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1003371d
xor eax, eax
jmp 0x1003374d
push 0x1a31
lea eax, [ebp - 4]
push eax
push 0x244d
push 1
call fcn.1003359b
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10033746
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1003374a
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004abc4
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004abdd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x1004abf6
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1005a4f0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10085340]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x1005a514
jmp 0x1005a583
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1005a528
jmp 0x1005a583
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x1005a554
jmp 0x1005a583
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x1005a575
jmp 0x1005a583
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006b58e
mov esp, ebp
pop ebp
ret

Function at 0x1005cd20
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x106710e3]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x11a9a310
call fcn.1005aa90
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x1007ea50
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10085340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006ed20
mov dword [ebp - 0x14], eax
cmp dword [0x11a9b3a4], esi
jne 0x1007eb43
push 0x800
push esi
push 0x100079cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007ead0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007ec23
push esi
push esi
push 0x100079cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007ec23
push 0x100079e4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007ec23
push eax
call ebx
push 0x100079f0
push edi
mov dword [0x11a9b3a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007a00
push edi
mov dword [0x11a9b3a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007a14
push edi
mov dword [0x11a9b3ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11a9b3b4], eax
test eax, eax
je 0x1007eb40
push 0x10007a30
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11a9b3b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007eb68
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007eb5b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007eb7d
push 4
pop eax
jmp 0x1007ec25
cmp dword [ebp - 0x14], esi
je 0x1007eb7d
push dword [0x11a9b3a4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007eb62
mov eax, dword [0x11a9b3b0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007ebdb
cmp dword [0x11a9b3b4], edi
je 0x1007ebdb
push eax
call ebx
push dword [0x11a9b3b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007ebdb
test eax, eax
je 0x1007ebdb
call ecx
test eax, eax
je 0x1007ebd0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007ebd0
test byte [ebp - 8], 1
jne 0x1007ebdb
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007ec0b
mov eax, dword [0x11a9b3a8]
cmp eax, edi
je 0x1007ec08
push eax
call ebx
test eax, eax
je 0x1007ec08
call eax
mov esi, eax
test esi, esi
je 0x1007ec08
mov eax, dword [0x11a9b3ac]
cmp eax, edi
je 0x1007ec08
push eax
call ebx
test eax, eax
je 0x1007ec08
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x11a9b3a4]
call ebx
test eax, eax
je 0x1007ec23
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007ec25
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006b58e
mov esp, ebp
pop ebp
ret
Function at 0x43b64a
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
sub edx, edi
add edi, edx
mov edx, edi
call fcn.0043b683
sub edx, 0x29f4520d
xor dword [esi], ecx
push edx
pop edx
add esi, 1
add edi, 1
add edi, edx
cmp esi, eax
jne fcn.0043b64a
sub edx, edx
inc edx
add edi, edi
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b645
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
add eax, 0x77d38d12
call fcn.0043b672
mov eax, edi
xor dword [ecx], ebx
or eax, edi
or edi, eax
sub edi, eax
inc ecx
sub eax, 0x5bc539b0
cmp ecx, edx
jne fcn.0043b645
add eax, edi
or edi, edi
dec eax
ret
Function at 0x98b15c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98b183
call fcn.0092d6a8
mov dword [eax], esi
call fcn.0092d695
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092e2ea
mov eax, esi
jmp 0x98b1d8
test dword [ebp + 0xc], 0xfffffff9
jne 0x98b169
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98b1b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092d6bb
pop ecx
call fcn.0092d695
mov eax, dword [eax]
jmp 0x98b1d8
test al, 0x10
jne 0x98b1d6
test al, 1
je 0x98b1d6
test byte [ebp + 0xc], 2
je 0x98b1d6
call fcn.0092d6a8
mov dword [eax], 5
call fcn.0092d695
mov dword [eax], 0xd
jmp 0x98b1a7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x43b648
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
sub edx, 0x1aa10e34
mov edx, 0xc31c16c6
call fcn.0043b68b
sub edi, 1
xor dword [esi], ecx
sub edx, edi
or edx, edi
inc edx
inc esi
sub edx, 0xf2c4f01d
add edx, 0x97765e5d
push 0xbd0f363d
pop edx
cmp esi, ebx
jne fcn.0043b648
add edx, 0xc544b367
inc edi
ret
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40894f
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add eax, 0xbdcf28a7
call fcn.0040898d
sub eax, 0x87b70d4a
xor dword [edx], edi
or ecx, ecx
add edx, 1
and ecx, eax
add ecx, 0x9a3d7f04
cmp edx, esi
jne fcn.0040894f
sub ecx, 0xfe28e53c
mov ecx, 0x3e20dc97
ret