joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66bf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x6809fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x66c002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.0066fdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x66c002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.006676e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0067020b
push 0x10
call fcn.006701d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x66bfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0065c1c0
jmp 0x66bfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0066bb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x66bff0
mov ecx, edi
call fcn.0065c2c0
push edi
call fcn.006701c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x66c021
inc ebx
cmp ebx, 0x20
jb 0x66bf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x66d250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x681808
push 0x671288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x66d329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x66d329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.006701d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x66d329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x66d329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x66d32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0066d351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x66dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x66dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x66dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x66dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x66dd94
push eax
push esi
call fcn.0067020b
add esp, 8
pop esi
ret 0x10

Function at 0x66dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x66de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x66de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x686320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0066fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x66ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x66de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x66dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x66deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x686320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0066fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x66deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x66de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x66e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x66e131
push esi
call fcn.00671145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00660080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x66e131
push 0
push ebp
call fcn.006603a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00660260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x66e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006602f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x66e121
push 0x686918
push edi
call fcn.0066f3f0
push eax
push ebx
push esi
call fcn.0066df60
push 0x6868f8
push edi
call fcn.0066f3f0
push eax
push ebx
push esi
call fcn.0066df60
push 0x6868d8
push edi
call fcn.0066f3f0
push eax
push ebx
push esi
call fcn.0066df60
push 0x6868c0
push edi
call fcn.0066f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0066df60
push 0x6868a0
push edi
call fcn.0066f3f0
push eax
push ebx
push esi
call fcn.0066df60
push 0x686888
push edi
call fcn.0066f3f0
push eax
push ebx
push esi
call fcn.0066df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x66f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0066f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0066f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0066f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0066f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x66fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x66fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x68187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x66fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x66fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0xdc7762d
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..tls
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x50c57689
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401190
Capabilities:
Read file on windows

Disassembly:
push ecx
mov al, 0xff
mov byte [esp], al
mov byte [esp + 1], al
mov eax, dword [0x486344]
push eax
push 2
lea ecx, [esp + 8]
push 1
push ecx
call fcn.00435763
movzx ax, byte [esp + 0x11]
mov edx, 0x4949
add esp, 0x10
cmp word [0x465c48], dx
jne 0x4011d6
movzx cx, byte [esp]
shl ax, 8
or ax, cx
movzx eax, ax
pop ecx
ret
movzx dx, byte [esp]
shl dx, 8
or dx, ax
movzx eax, dx
pop ecx
ret

Function at 0x401240
Capabilities:
Read file on windows

Disassembly:
push ecx
mov al, 0xff
mov byte [esp], al
mov byte [esp + 1], al
mov byte [esp + 2], al
mov byte [esp + 3], al
mov eax, dword [0x486344]
push eax
push 4
lea ecx, [esp + 8]
push 1
push ecx
call fcn.00435763
movzx ecx, byte [esp + 0x12]
mov edx, 0x4949
add esp, 0x10
cmp word [0x465c48], dx
movzx edx, byte [esp + 1]
jne 0x40129b
movzx eax, byte [esp + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [esp]
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
pop ecx
ret
movzx eax, byte [esp]
shl eax, 8
or eax, edx
movzx edx, byte [esp + 3]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
pop ecx
ret

Function at 0x4012c0
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 4], 3
jne 0x4012d0
call fcn.00401190
movzx eax, ax
ret
jmp fcn.00401240

Function at 0x4014f0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x486344]
push eax
push esi
push 2
push edi
call fcn.00435763
add esp, 0x10
cmp eax, esi
jae 0x40150c
call fcn.004010f0
push 0x1234
call dword [sym.imp.WS2_32.dll_ntohs]
xor edx, edx
mov ecx, 0x1234
cmp ax, cx
sete dl
xor ecx, ecx
mov eax, 0x4949
cmp word [0x465c48], ax
sete cl
cmp ecx, edx
jne 0x401547
lea edx, [esi + esi]
push edx
push edi
push edi
call fcn.00446b03
add esp, 0xc
pop ecx
ret
Function at 0x4027c0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4004
call fcn.00442760
mov eax, dword [0x4596ac]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [0x486344]
push esi
push 0
push 0
push eax
mov esi, 1
call fcn.00435f77
mov ecx, dword [0x486344]
push ecx
push 0x4000
lea edx, [esp + 0x18]
push esi
push edx
call fcn.00435763
add esp, 0x1c
mov eax, 0x21c
mov cl, 0xff
mov edi, edi
cmp byte [esp + eax + 4], cl
jne 0x40281f
cmp byte [esp + eax + 5], 0
jne 0x40283f
xor esi, esi
inc eax
cmp eax, 0x3fff
jb 0x402810
mov eax, esi
pop esi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.004334ab
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4004]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004334ab
add esp, 0x4004
ret
Function at 0x404160
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x4596ac]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
push 0x6000
push 0
push 0x486360
call fcn.00436440
add esp, 0xc
mov dword [0x465f4c], 0x486360
xor esi, esi
mov bl, 0xff
mov eax, dword [0x486344]
push eax
push 2
lea ecx, [esp + 0x18]
push 1
push ecx
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
call fcn.00435763
movzx ax, byte [esp + 0x21]
mov edx, 0x4949
add esp, 0x10
cmp word [0x465c48], dx
jne 0x4041d9
movzx cx, byte [esp + 0x10]
shl ax, 8
or ax, cx
movzx eax, ax
jmp 0x4041e9
movzx dx, byte [esp + 0x10]
shl dx, 8
or dx, ax
movzx eax, dx
mov word [esp + esi*2 + 0x14], ax
inc esi
cmp esi, 0xd
jl 0x404194
xor esi, esi
jmp 0x404200
mov ecx, dword [0x486344]
push ecx
call fcn.004361ad
and eax, 0xf
mov word [esp + esi*2 + 0x32], ax
inc esi
add esp, 4
cmp esi, 0xd
jl 0x404200
xor edi, edi
nop
xor eax, eax
mov edx, 0x486360
cmp ax, word [esp + edi*2 + 0x2e]
jae 0x40426a
movzx esi, word [esp + edi*2 + 0x14]
movzx ebp, word [esp + edi*2 + 0x2e]
mov ebx, 0xb
lea ecx, [ecx]
mov eax, esi
mov cl, bl
shr eax, cl
and eax, 1
cmp dword [edx + eax*4], 0
jne 0x404261
mov ecx, dword [0x465f4c]
add ecx, 0xc
mov dword [0x465f4c], ecx
mov dword [edx + eax*4], ecx
mov edx, dword [edx + eax*4]
dec ebx
sub ebp, 1
jne 0x404240
mov dword [edx + 8], edi
inc edi
cmp edi, 0xd
jl 0x404220
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004334ab
add esp, 0x3c
ret

Function at 0x404950
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
mov eax, dword [0x4596ac]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [0x465d28]
mov ecx, dword [0x486344]
push 0
push eax
push ecx
call fcn.00435f77
mov edx, dword [0x486344]
push edx
push 0x100
lea eax, [esp + 0x14]
push 1
push eax
call fcn.00435763
add esp, 0x1c
mov eax, 0xf
cmp byte [esp + eax], 0
jne 0x4049bf
add eax, 0x10
cmp eax, 0x100
jl 0x404998
xor eax, eax
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.004334ab
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
xor ecx, esp
mov eax, 1
call fcn.004334ab
add esp, 0x104
ret

Function at 0x404a80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x4596ac]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x486344]
push esi
push 0
push 0
push eax
call fcn.00435f77
add esp, 0xc
xor esi, esi
mov ecx, dword [0x486344]
push ecx
push 0xc
lea edx, [esp + 0xc]
push 1
push edx
call fcn.00435763
movzx ecx, byte [esp + 0x1b]
mov al, byte [esp + 0x1d]
mov dl, byte [esp + 0x18]
shr al, 4
shr cl, 4
and al, cl
movzx ecx, byte [esp + 0x16]
shr dl, 4
and al, dl
shr cl, 4
and al, cl
and al, byte [esp + 0x1f]
add esp, 0x10
and al, byte [esp + 0xc]
and al, byte [esp + 0xa]
and al, byte [esp + 5]
and al, 3
cmp al, 3
jne 0x404b13
inc esi
cmp esi, 0x400
jl 0x404aa3
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004334ab
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004334ab
add esp, 0x10
ret
Function at 0x404b30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4596ac]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [0x486344]
push ebx
push esi
push edi
push 0
push 0xc00
push eax
call fcn.00435f77
mov ecx, dword [0x486344]
push ecx
push 0x18
lea edx, [esp + 0x20]
push 1
push edx
call fcn.00435763
movzx esi, byte [esp + 0x30]
movzx eax, byte [esp + 0x3c]
and esi, 3
and eax, 3
shl esi, 4
or esi, eax
mov edi, 0x44e3ac
mov eax, 0xfffffff4
add esp, 0x1c
sub eax, edi
mov ebx, 4
cmp esi, dword [edi - 4]
jne 0x404bbf
mov ecx, edi
jmp 0x404ba0
mov dl, byte [ecx]
mov byte [eax + ecx + 0x4ac3cc], dl
inc ecx
test dl, dl
jne 0x404ba0
lea ecx, [edi + 0xc]
mov dl, byte [ecx]
mov byte [eax + ecx + 0x466060], dl
inc ecx
test dl, dl
jne 0x404bb1
sub eax, 0x20
add edi, 0x20
sub ebx, 1
jne 0x404b91
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004334ab
add esp, 0x1c
ret

Function at 0x404be0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x4596ac]
xor eax, esp
mov dword [esp + 0x1a8], eax
mov eax, dword [0x486344]
push 2
push 0xfffffe58
push eax
call fcn.00435f77
mov ecx, dword [0x486344]
push ecx
push 0x1a8
lea edx, [esp + 0x14]
push 1
push edx
call fcn.00435763
add esp, 0x1c
xor ecx, ecx
xor eax, eax
cmp byte [esp + ecx], 0
je 0x404c2c
inc eax
cmp byte [esp + ecx + 1], 0
je 0x404c34
inc eax
cmp byte [esp + ecx + 2], 0
je 0x404c3c
inc eax
cmp byte [esp + ecx + 3], 0
je 0x404c44
inc eax
add ecx, 4
cmp ecx, 0x1a8
jb 0x404c25
xor ecx, ecx
cmp eax, 0x14
setg cl
mov eax, ecx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.004334ab
add esp, 0x1ac
ret
Function at 0x40b190
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
je 0x40b245
xor eax, eax
jmp 0x40b1b0
imul ecx, ecx, 0x2e90edd
inc ecx
mov dword [eax + 0x45e820], ecx
add eax, 4
cmp eax, 0x10
jb 0x40b1b0
mov eax, dword [0x45e828]
xor eax, dword [0x45e820]
mov ecx, dword [0x45e82c]
shr eax, 0x1f
lea edx, [ecx + ecx]
or eax, edx
mov dword [0x45e82c], eax
mov eax, 0x45e824
mov ecx, 0x7b
lea ecx, [ecx]
mov edx, dword [eax + 8]
xor edx, dword [eax]
mov ebx, dword [eax - 4]
xor ebx, dword [eax + 4]
shr edx, 0x1f
add ebx, ebx
or edx, ebx
mov dword [eax + 0xc], edx
add eax, 4
sub ecx, 1
jne 0x40b1f0
mov ebx, dword [sym.imp.WS2_32.dll_htonl]
mov dword [0x45e818], ecx
lea esp, [esp]
mov eax, dword [ecx*4 + 0x45e820]
push eax
call ebx
mov ecx, dword [0x45e818]
mov dword [ecx*4 + 0x45e820], eax
inc ecx
mov dword [0x45e818], ecx
cmp ecx, 0x7f
jb 0x40b220
jmp 0x40b24b
mov ecx, dword [0x45e818]
test edi, edi
je 0x40b289
lea edx, [ecx + 1]
lea eax, [edx - 0x40]
and eax, 0x7f
mov eax, dword [eax*4 + 0x45e820]
mov ebx, edx
and ebx, 0x7f
xor eax, dword [ebx*4 + 0x45e820]
mov ebx, ecx
and ebx, 0x7f
mov dword [ebx*4 + 0x45e820], eax
xor dword [esi], eax
dec edi
inc ecx
inc edx
add esi, 4
test edi, edi
jne 0x40b252
mov dword [0x45e818], ecx
pop edi
pop esi
pop ebx
ret

Function at 0x40c700
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, dword [0x465c54]
mov ecx, dword [0x486344]
push ebp
push esi
push edi
push 0
push eax
push ecx
call fcn.00435f77
call fcn.00401240
mov edx, dword [0x486344]
mov ecx, dword [0x465f50]
push edx
mov esi, eax
mov eax, dword [0x465f6c]
push eax
push 1
push ecx
call fcn.00435763
mov ebp, dword [0x465f6c]
add esp, 0x1c
xor edi, edi
test ebp, ebp
jbe 0x40c78f
push ebx
mov ebx, dword [0x465f50]
nop
mov eax, esi
imul eax, eax, 0x63d
add eax, 0xca25
xor edx, edx
mov ecx, 0x3bcd0
div ecx
mov cl, 0x18
mov esi, edx
mov eax, esi
mov edx, 0x11f9f253
mul edx
call fcn.00447f10
mov ecx, esi
shl ecx, 8
sub ecx, eax
shr ecx, 1
add ecx, eax
shr ecx, 0x11
xor byte [ebx + edi], cl
inc edi
cmp edi, ebp
jb 0x40c750
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x416020
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
call fcn.00401190
movzx eax, ax
mov dword [esp + 0xc], eax
test eax, eax
je 0x4161f6
push ebx
push ebp
push esi
push edi
mov bl, 0xff
lea ecx, [ecx]
mov eax, dword [0x486344]
dec dword [esp + 0x1c]
push eax
push 2
lea ecx, [esp + 0x18]
push 1
push ecx
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
call fcn.00435763
movzx ax, byte [esp + 0x21]
mov edx, 0x4949
add esp, 0x10
cmp word [0x465c48], dx
jne 0x416089
movzx cx, byte [esp + 0x10]
shl ax, 8
or ax, cx
movzx eax, ax
jmp 0x416099
movzx dx, byte [esp + 0x10]
shl dx, 8
or dx, ax
movzx eax, dx
mov edx, dword [0x486344]
push edx
movzx ecx, ax
push 2
lea eax, [esp + 0x1c]
push 1
push eax
mov dword [esp + 0x30], ecx
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
call fcn.00435763
movzx dx, byte [esp + 0x25]
mov ecx, 0x4949
add esp, 0x10
cmp word [0x465c48], cx
jne 0x4160e6
movzx ax, byte [esp + 0x14]
shl dx, 8
or dx, ax
movzx eax, dx
jmp 0x4160f6
movzx cx, byte [esp + 0x14]
shl cx, 8
or cx, dx
movzx eax, cx
movzx ebp, ax
mov eax, dword [0x486344]
push eax
push 4
lea ecx, [esp + 0x20]
push 1
push ecx
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
call fcn.00435763
mov edx, 0x4949
add esp, 0x10
cmp word [0x465c48], dx
jne 0x416144
movzx esi, byte [esp + 0x1b]
movzx eax, byte [esp + 0x1a]
movzx ecx, byte [esp + 0x19]
movzx edx, byte [esp + 0x18]
jmp 0x416158
movzx esi, byte [esp + 0x18]
movzx eax, byte [esp + 0x19]
movzx ecx, byte [esp + 0x1a]
movzx edx, byte [esp + 0x1b]
shl esi, 8
or esi, eax
mov eax, dword [0x486344]
shl esi, 8
or esi, ecx
shl esi, 8
push eax
or esi, edx
call fcn.00435c4a
mov edi, eax
add esp, 4
add edi, 4
cmp ebp, 0xe
sbb eax, eax
and eax, ebp
movsx ecx, byte [eax + str.11124811248488]
sub ecx, 0x30
imul ecx, esi
cmp ecx, 4
jbe 0x4161ae
push 0
call fcn.00401240
add eax, dword [esp + 0x2c]
mov edx, dword [0x486344]
push eax
push edx
call fcn.00435f77
add esp, 0xc
mov esi, dword [esp + 0x20]
cmp esi, dword [esp + 0x2c]
jne 0x4161c6
call fcn.00401240
add eax, dword [esp + 0x28]
mov dword [0x465c44], eax
cmp esi, dword [esp + 0x30]
jne 0x4161d6
call fcn.00401240
mov dword [0x465c5c], eax
mov eax, dword [0x486344]
push 0
push edi
push eax
call fcn.00435f77
add esp, 0xc
cmp dword [esp + 0x1c], 0
jne 0x416040
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4179a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x4596ac]
xor eax, esp
mov dword [esp + 0x38], eax
cmp dword [esp + 0x40], 0
mov byte [esp + 0x37], 0
je 0x4179da
push esi
mov esi, 0x13
mov eax, dword [0x486344]
push eax
dec esi
call fcn.004361ad
add esp, 4
mov byte [esp + esi + 0x28], al
test esi, esi
jne 0x4179c0
pop esi
jmp 0x4179f2
mov ecx, dword [0x486344]
push ecx
push 1
lea edx, [esp + 0x2c]
push 0x13
push edx
call fcn.00435763
add esp, 0x10
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push str._d:_d:_d__d:_d:_d
push eax
call fcn.00434141
add esp, 0x20
cmp eax, 6
jne 0x417a84
sub dword [esp + 0x14], 0x76c
dec dword [esp + 0x10]
lea ecx, [esp]
push ecx
call fcn.00433d0e
add esp, 4
test edx, edx
jl 0x417a84
jg 0x417a6d
test eax, eax
jbe 0x417a84
lea edx, [esp]
push edx
call fcn.00433d0e
add esp, 4
mov dword [0x486168], eax
mov dword [0x48616c], edx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004334ab
add esp, 0x3c
ret