joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4161c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x4161ee
call fcn.0041aea0
cmp byte [esi + 0x40], 0
je 0x4161e5
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x4161f5
cmp eax, 0xcb
jne 0x41626a
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x416258
mov eax, dword [esi + 8]
test eax, eax
je 0x416210
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x416253
cmp eax, 2
je 0x416258
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x416201
cmp eax, 3
je 0x416238
cmp eax, 1
jne 0x416201
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x416201
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x416201
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov ecx, esi
pop edi
mov dword [esi + 0x84], eax
pop esi
jmp 0x4162a0
cmp eax, 0xcc
je 0x41628c
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
pop edi
mov ecx, esi
pop esi
jmp 0x4162a0
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0xcc
lea ebx, [esi + 0x78]
je 0x4162cd
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x416352
nop dword [eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x416326
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x416305
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x416369
cmp eax, dword [esi + 0x60]
jb 0x4162e7
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x4162e0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x41b290
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
mov edx, 0x100
mov dword [esp + 0x18], esi
mov ebp, dword [esi + 0x4c]
cmp ebp, 1
mov ebx, dword [esi + 0x1c0]
sete al
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebp
mov byte [ebx + 0x1c], al
mov eax, 0x2fe
push dword [esi + 0x64]
mov ecx, dword [esi + 4]
cmovne eax, edx
push eax
push 1
push esi
mov eax, dword [ecx + 8]
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0xc], ecx
cmp dword [esi + 0x64], ecx
jle 0x41b3a4
push edi
nop dword [eax + eax]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x41b30a
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
dec edi
xor ebx, ebx
push edi
push ebx
mov ebp, dword [eax + ecx*4]
call fcn.0041b100
add esp, 8
mov edx, eax
xor esi, esi
cmp esi, edx
jle 0x41b336
inc ebx
push edi
push ebx
call fcn.0041b100
mov edx, eax
add esp, 8
cmp esi, edx
jg 0x41b325
mov ecx, dword [esp + 0x14]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
cmp esi, 0xff
jle 0x41b321
cmp dword [esp + 0x18], 1
jne 0x41b381
mov ecx, 1
lea edx, [ebp - 1]
nop
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x41b360
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
inc ecx
mov ebp, dword [esp + 0x18]
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
jl 0x41b2f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x42fef0
Capabilities:
Compute adler32 checksum

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
mov eax, 0x5e6ea9af
push esi
push edi
mov edi, edx
movzx esi, cx
mul ebp
shr ecx, 0x10
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
mov dword [esp + 0xc], edx
test edi, edi
jne 0x42ff28
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
test ebp, ebp
je 0x430022
push ebx
xor ebx, ebx
cmp edx, 7
jbe 0x42ff8c
mov ebp, 7
sub ebp, edi
nop
movzx eax, byte [edi]
add ebx, 8
add esi, eax
movzx eax, byte [edi + 1]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 2]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 3]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 4]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 5]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 6]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 7]
add edi, 8
add ecx, esi
add esi, eax
add ecx, esi
lea eax, [edi + ebp]
cmp eax, edx
jb 0x42ff40
xor ebp, ebp
cmp ebx, edx
jae 0x42ffe2
mov eax, edx
sub eax, ebx
cmp eax, 2
jb 0x42ffd3
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, ebp
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [edi]
add esi, eax
movzx eax, byte [edi + 1]
add ebp, esi
add edi, 2
add esi, eax
add ebx, esi
sub edx, 1
jne 0x42ffb0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
jae 0x42ffdd
jmp 0x42ffd5
mov ebx, ebp
movzx eax, byte [edi]
add esi, eax
add ecx, esi
inc edi
lea eax, [ebx + ebp]
add ecx, eax
mov eax, 0x80078071
mov ebp, dword [esp + 0x20]
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, 0x15b0
add ecx, eax
sub ebp, dword [esp + 0x10]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x10], edx
jne 0x42ff31
pop ebx
shl ecx, 0x10
pop edi
lea eax, [esi + ecx]
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x430030
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
jne 0x43003b
xor eax, eax
pop esi
ret
push edi
mov edi, dword [esp + 0xc]
or eax, 0xffffffff
test edi, edi
je 0x430079
mov cl, byte [esi]
lea esi, [esi + 1]
movzx edx, cl
mov ecx, edx
shr edx, 4
xor ecx, eax
shr eax, 4
and ecx, 0xf
xor eax, dword [ecx*4 + 0x493fa0]
mov ecx, eax
shr eax, 4
and ecx, 0xf
xor edx, ecx
xor eax, dword [edx*4 + 0x493fa0]
sub edi, 1
jne 0x430047
pop edi
not eax
pop esi
ret
Function at 0x43cf60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, 8
mov esi, edx
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x20]
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x78]
lea ebp, [eax + 0x18]
call fcn.00449070
test eax, eax
je 0x43cfd2
push 0x13
push esi
lea edx, [edi - 1]
lea ecx, [esp + 0x28]
call fcn.00448f30
add esp, 8
test eax, eax
je 0x43cfd2
lea edx, [edi - 7]
mov ecx, ebp
call fcn.00444900
test eax, eax
je 0x43cff0
lea edx, [edi - 5]
mov ecx, ebp
call fcn.00444900
mov ecx, ebp
lea edx, [eax*2 + 2]
call fcn.00444900
lea ecx, [eax + 2]
mov eax, dword [esp + 0x38]
cmp ecx, eax
jle 0x43cff6
lea ecx, [esp + 0x20]
call fcn.004490b0
mov ecx, dword [esp + 0x1c]
mov edx, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
jmp fcn.0043cd80
mov eax, dword [esp + 0x38]
mov ecx, eax
xor ebx, ebx
test eax, eax
jle 0x43d0af
mov eax, ecx
dec ecx
mov dword [esp + 0x18], ecx
test eax, eax
je 0x43d0af
cmp dword [ebp + 0x14], 0x20
jl 0x43d01c
mov ecx, ebp
call fcn.004448b0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp]
and ecx, 0x3f
mov edx, dword [ebp + 4]
call fcn.0047aa10
mov ecx, dword [esp + 0x30]
and eax, 0x7f
mov ecx, dword [ecx]
lea ecx, [ecx + eax*4]
movzx eax, byte [ecx]
add dword [ebp + 0x14], eax
movzx esi, word [ecx + 2]
cmp esi, 0x10
jae 0x43d05d
mov eax, dword [esp + 0x3c]
mov dword [eax + ebx*4], esi
inc ebx
test esi, esi
cmove esi, edi
mov edi, esi
mov dword [esp + 0x14], edi
jmp 0x43d0a1
movzx edx, byte [esi + 0x48ba0c]
mov ecx, ebp
movzx edi, byte [esi + 0x48b9d4]
call fcn.00444900
lea ecx, [edi + eax]
lea edx, [ecx + ebx]
cmp edx, dword [esp + 0x38]
jg 0x43cfd2
mov edi, dword [esp + 0x14]
xor eax, eax
cmp esi, 0x10
cmove eax, edi
test ecx, ecx
jle 0x43d0a1
mov esi, dword [esp + 0x3c]
lea edi, [esi + ebx*4]
mov ebx, edx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp ebx, dword [esp + 0x38]
jl 0x43d000
lea ecx, [esp + 0x20]
call fcn.004490b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x24
ret
Function at 0x4494f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x14]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jle 0x44960b
push esi
cmp edi, 0x10
jb 0x4495db
lea eax, [edi - 1]
lea eax, [ebx + eax*4]
lea esi, [edi - 1]
lea esi, [edx + esi*4]
cmp edx, eax
ja 0x44952b
cmp esi, ebx
jae 0x4495db
movaps xmm2, xmmword [0x494c00]
lea esi, [ebx + 0x30]
movaps xmm3, xmmword [0x494920]
mov eax, edi
movaps xmm4, xmmword [0x494910]
and eax, 0xfffffff0
mov edi, ebx
mov dword [esp + 0xc], eax
lea eax, [edx + 0x10]
sub edi, edx
push ebp
movups xmm1, xmmword [esi - 0x30]
add ecx, 0x10
lea eax, [eax + 0x40]
lea esi, [esi + 0x40]
mov ebp, ecx
movaps xmm0, xmm1
andps xmm1, xmm4
andps xmm0, xmm2
psubd xmm0, xmm3
andps xmm0, xmm2
orps xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm1, xmmword [edi + eax - 0x40]
movaps xmm0, xmm1
andps xmm1, xmm4
andps xmm0, xmm2
psubd xmm0, xmm3
andps xmm0, xmm2
orps xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm1, xmmword [esi - 0x50]
movaps xmm0, xmm1
andps xmm1, xmm4
andps xmm0, xmm2
psubd xmm0, xmm3
andps xmm0, xmm2
orps xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm1, xmmword [esi - 0x40]
movaps xmm0, xmm1
andps xmm1, xmm4
andps xmm0, xmm2
psubd xmm0, xmm3
andps xmm0, xmm2
orps xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp ecx, dword [esp + 0x10]
jl 0x449554
mov edi, dword [esp + 0x20]
cmp ebp, edi
pop ebp
jge 0x44960a
sub ebx, edx
lea eax, [edx + ecx*4]
sub edi, ecx
mov ecx, dword [eax + ebx]
lea eax, [eax + 4]
and ecx, 0xff00ff00
add ecx, 0xff0000ff
mov edx, ecx
xor edx, dword [eax + ebx - 4]
and edx, 0xff00ff
xor edx, ecx
mov dword [eax - 4], edx
sub edi, 1
jne 0x4495e2
pop esi
pop edi
pop ebx
pop ecx
ret

Function at 0x449610
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi - 4]
test ebx, ebx
jle 0x449668
push ebp
mov ebp, dword [esp + 0x10]
push esi
sub ebp, edi
nop dword [eax]
mov esi, dword [edi + ebp]
lea edi, [edi + 4]
mov edx, eax
mov ecx, esi
and eax, 0xffff00ff
and edx, 0xff00ffff
and ecx, 0xff00ff00
and esi, 0xffff00ff
add eax, esi
add ecx, edx
xor eax, ecx
and eax, 0xff00ff
xor eax, ecx
mov dword [edi - 4], eax
sub ebx, 1
jne 0x449630
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x449670
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0x4496df
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
sub eax, ebp
push esi
mov esi, dword [esp + 0x1c]
sub ebp, esi
push edi
mov dword [esp + 0x18], eax
lea edi, [esi + ebp]
add eax, edi
push eax
lea eax, [esi - 4]
push eax
call fcn.00449110
mov edi, dword [edi]
lea esi, [esi + 4]
mov ecx, edi
mov edx, eax
and edi, 0xffff00ff
and eax, 0xffff00ff
add edi, eax
and edx, 0xff00ffff
mov eax, dword [esp + 0x20]
and ecx, 0xff00ff00
add ecx, edx
add esp, 8
xor edi, ecx
and edi, 0xff00ff
xor edi, ecx
mov dword [esi - 4], edi
sub ebx, 1
jne 0x449690
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x449de0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x449ef4
push esi
cmp edi, 8
jb 0x449ebb
lea eax, [edi - 1]
lea eax, [ebx + eax*4]
lea esi, [edi - 1]
lea esi, [edx + esi*4]
cmp edx, eax
ja 0x449e1a
cmp esi, ebx
jae 0x449ebb
movaps xmm3, xmmword [0x494800]
lea eax, [edx + 0x10]
movaps xmm4, xmmword [0x494c40]
movaps xmm5, xmmword [0x494910]
movaps xmm6, xmmword [0x494c00]
push ebp
mov ebp, edi
mov edi, ebx
and ebp, 0xfffffff8
sub edi, edx
movups xmm2, xmmword [ebx + ecx*4]
add ecx, 8
lea eax, [eax + 0x20]
mov esi, ecx
movaps xmm0, xmm2
psrld xmm0, 8
andps xmm0, xmm3
movaps xmm1, xmm0
pslld xmm1, 0x10
orps xmm1, xmm0
movaps xmm0, xmm2
andps xmm0, xmm4
andps xmm2, xmm6
paddd xmm1, xmm0
andps xmm1, xmm5
orps xmm1, xmm2
movups xmmword [eax - 0x30], xmm1
movups xmm2, xmmword [edi + eax - 0x20]
movaps xmm0, xmm2
psrld xmm0, 8
andps xmm0, xmm3
movaps xmm1, xmm0
pslld xmm1, 0x10
orps xmm1, xmm0
movaps xmm0, xmm2
andps xmm0, xmm4
andps xmm2, xmm6
paddd xmm1, xmm0
andps xmm1, xmm5
orps xmm1, xmm2
movups xmmword [eax - 0x20], xmm1
cmp ecx, ebp
jl 0x449e43
mov edi, dword [esp + 0x18]
pop ebp
cmp esi, edi
jge 0x449ef3
sub ebx, edx
lea eax, [edx + ecx*4]
sub edi, ecx
mov esi, dword [eax + ebx]
lea eax, [eax + 4]
mov ecx, esi
shr ecx, 8
movzx ecx, cl
mov edx, ecx
shl edx, 0x10
or edx, ecx
mov ecx, esi
and ecx, 0xffff00ff
add edx, ecx
xor edx, esi
and edx, 0xff00ff
xor edx, esi
mov dword [eax - 4], edx
sub edi, 1
jne 0x449ec2
pop esi
pop edi
pop ebx
ret

Function at 0x44a4c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x44a504
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr ecx, 0xc
add esi, 4
shr edx, 0x10
xor cl, dl
and cl, 0xf
xor cl, dl
mov byte [eax - 2], cl
mov ecx, ebx
shr ecx, 0x1c
and bl, 0xf0
or cl, bl
mov byte [eax - 1], cl
cmp esi, edi
jb 0x44a4d6
pop ebx
pop edi
pop esi
ret

Function at 0x44a510
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x44a559
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr ecx, 0xd
add esi, 4
shr edx, 0x10
xor cl, dl
and cl, 7
xor cl, dl
mov byte [eax - 2], cl
mov ecx, ebx
shr ebx, 3
shr ecx, 5
xor bl, cl
and bl, 0x1f
xor bl, cl
mov byte [eax - 1], bl
cmp esi, edi
jb 0x44a526
pop ebx
pop edi
pop esi
ret

Function at 0x45df93
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45dfd2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45dfd2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45dfd2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45dfd2
cmp dword [ecx + 0x74], 0xe
jbe 0x45dfd2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x472bae
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4822b0
push 0x4822a8
push str.FlsAlloc
push 0x1e
call fcn.00472a6f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x472be2
push dword [ebp + 8]
mov ecx, esi
call dword [0x47f3c4]
call esi
jmp 0x472be8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x472c2c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4822c0
push 0x4822b8
push str.FlsGetValue
push 0x20
call fcn.00472a6f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x472c63
push dword [ebp + 8]
mov ecx, esi
call dword [0x47f3c4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4750ad
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x49d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4750f8
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0047524c
test al, al
jne 0x4750f2
sub edx, 2
cmp edx, edi
jne 0x4750d8
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x47511a
lea eax, [edi + 2]
cmp edx, eax
je 0x47511a
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00474ff9
add esp, 0x10
jmp 0x475214
push esi
lea ecx, [ebp - 0x255]
call fcn.0047524c
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47515d
push dword [ebp - 0x25c]
jmp 0x47510a
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x47519a
cmp word [ebp - 0x226], 0
je 0x4751bb
cmp word [ebp - 0x226], ax
jne 0x47519a
cmp word [ebp - 0x224], 0
je 0x4751bb
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00474ff9
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x475207
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x475174
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4751ef
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x475214
push 0x474e29
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0046ec80
add esp, 0x10
jmp 0x4751e4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d68f
leave
ret
Function at 0x475b38
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x475bd5
push ebx
push esi
call fcn.00475b01
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00474d72
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x475b82
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x475bd4
push edi
push eax
call fcn.00471173
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x475ba2
call fcn.00470559
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x475bd3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00474d72
add esp, 0x20
test eax, eax
jne 0x475bc1
push edi
call fcn.00470559
jmp 0x475bc9
push ebx
call fcn.00470559
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x47a7e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47a80d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47a80d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x415349
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x415358
pop dword [ebp - 0x4c]
mov eax, 0x415358
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3f9c6
push 0
mov eax, 0x92872cac
add eax, 0x6dbb256c
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xd9271f0a
add ecx, 0x26d92ef9
xor edi, edi
add edi, eax
mov edx, 0x188c5f45
add edx, 0xe7b6f4bb
add edx, dword [ebp - 0x4c]
mov esi, 0xb56e033a
xor dword [ebp - 0x30], esi
mov ebx, dword [edx]
xor dword [ebp - 0x38], 0x1f3d94c5
xor ebx, esi
mov dword [edi], ebx
sub dword [ebp - 0x30], 0xa6b27060
add edi, 0x4ba330d4
sub edi, 0x4ba330d0
add edx, 4
loop 0x4153ae
add eax, 0x12911790
add eax, 0xed70134f
xor ebx, ebx
add ebx, eax
add eax, 0x6c30c180
sub eax, 0x6c30c17b
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40ce3e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40cf13
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40cf13
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x40cf13
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x40ce99
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x40cf13
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40cede
test dl, dl
je 0x40ceda
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40cede
add ecx, 2
add eax, 2
test dl, dl
jne 0x40cebe
xor eax, eax
jmp 0x40cee3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40cef5
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x40cf00
inc esi
cmp esi, ebp
jae 0x40cf13
mov edx, dword [esp + 0x10]
jmp 0x40ceb4
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x40d177
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x40d182
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x40d196
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40d19a
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x40d1d3
cmp dword [edi + ecx], 0x4550
jne 0x40d1d3
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x40d1d3
test byte [edi + ecx + 0x16], 2
je 0x40d1d3
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x40d1d8
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x40d214
xor eax, eax
jmp 0x40d1f7
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x40d21d
inc edx
movzx eax, dx
cmp eax, edi
jl 0x40d1f7
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret