joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push esi
push ebx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2a420], 0
je 0x402fa0
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov ebx, dword [ebp + 0xc]
push ebx
push eax
call fcn.00402d9c
add esp, 0x10
test eax, eax
je 0x402fa0
jmp 0x403090
mov eax, 0xffffffff
jmp 0x403090
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2a414], 0
jne 0x402fb9
cmp dword [eax + 0x2a41c], 0
je 0x40303d
xor edi, edi
xor esi, esi
mov ebx, dword [ebp + 8]
add ebx, 0x12c
jmp 0x402fda
mov ecx, dword [ebp + 8]
cmp edi, dword [ecx + 0x3f54]
jg 0x402f90
lea esi, [edx + 4]
add ebx, 0x64
inc edi
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_strcmp
add esp, 0x10
mov edx, esi
test eax, eax
jne 0x402fc8
mov ecx, dword [ebp + 8]
mov edx, dword [esi + ecx + 0x5b78]
add edx, edx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
lea ecx, [eax + ebx*2]
mov ebx, dword [ebp + 8]
mov eax, dword [esi + ebx + 0x5920]
add eax, eax
add eax, dword [ebx + 0x3f48]
add esp, 0xfffffffc
push edx
push eax
push ecx
call sub.msvcrt.dll_memcpy
lea eax, [edi + esi]
lea eax, [edi + eax*2]
mov edx, ebx
add edx, 0x3f80
mov eax, dword [edx + eax*4]
shr eax, 1
add esp, 0x10
test eax, eax
jne 0x403090
add esp, 0xfffffff8
push 0x401410
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_fopen
mov ebx, eax
push ebx
push 0x2c
push 1
mov eax, dword [ebp + 8]
add eax, 0x5dd0
push eax
call sub.msvcrt.dll_fread
mov edx, dword [ebp + 8]
mov esi, dword [edx + 0x5df8]
shr esi, 1
add esp, 0x20
push ebx
push 2
push esi
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
lea eax, [edx + ecx*2]
push eax
call sub.msvcrt.dll_fread
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll_fclose
mov eax, esi
lea esp, [ebp - 0x18]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4040e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push edi
push esi
push ebx
mov edi, dword [ebp + 8]
add esp, 0xfffffff8
lea eax, [ebp - 0x120]
push eax
push edi
call sub.msvcrt.dll__findfirst
add esp, 0x10
test eax, eax
je 0x404123
add esp, 0xfffffff8
push 0x401452
push edi
call sub.msvcrt.dll_fopen
mov esi, eax
add esp, 0x10
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x404130
xor eax, eax
jmp 0x4041df
add esp, 0xfffffff4
push eax
call sub.msvcrt.dll_malloc
mov ebx, eax
push esi
push dword [ebp - 0x110]
push 1
push ebx
call sub.msvcrt.dll_fread
add esp, 0x20
add esp, 0xfffffff4
push esi
call sub.msvcrt.dll_fclose
add esp, 0x10
xor ecx, ecx
mov esi, dword [ebp - 0x110]
mov dl, byte [ecx + ebx]
lea eax, [edx - 0x80]
cmp al, 0x3f
ja 0x404171
add dl, 0x40
mov byte [ecx + ebx], dl
inc ecx
cmp ecx, esi
jb 0x404161
mov byte [ecx + ebx], 0
add esp, 0xfffffff8
push 0
push dword [0x43c784]
call sub.USER32.dll_SetWindowTextA
push ebx
push dword [0x43c784]
call sub.USER32.dll_SetWindowTextA
add esp, 8
test eax, eax
setne al
mov byte [0x43ccb4], al
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll_free
add esp, 0xfffffff8
push edi
push 0x40e288
call sub.msvcrt.dll_strcpy
add esp, 0x20
add esp, 0xfffffff4
push edi
call fcn.00408614
mov al, byte [0x43ccb4]
mov byte [0x40e387], al
mov dword [0x43cc84], 0x80
mov eax, 1
lea esp, [ebp - 0x138]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4041f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push edi
push esi
push ebx
cmp dword [0x43cc84], 0x80
jne 0x404220
add esp, 0xfffffff4
mov eax, dword [ebp + 0xc]
push eax
call fcn.004040e0
test eax, eax
setne al
jmp 0x404399
add esp, 0xfffffff8
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll__findfirst
add esp, 0x10
test eax, eax
jne 0x404241
mov al, 0
jmp 0x404399
mov byte [ebp - 0x225], 0
add esp, 0xfffffffc
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x404369
add esp, 0xfffffff8
push 0
push edi
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x40435d
mov eax, dword [0x40e388]
cmp ebx, eax
jb 0x40429c
mov eax, dword [0x40e38c]
cmp ebx, eax
jae 0x4042a3
add eax, ebx
mov dword [0x43cc74], eax
add esp, 0xfffffff8
push dword [0x43cc74]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
add esp, 8
test esi, esi
je 0x40435d
add esp, 0xfffffff4
push 0
lea eax, [ebp - 0x224]
push eax
push ebx
push esi
push edi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x404351
mov byte [ebx + esi], 0
add esp, 0xfffffff8
push esi
push dword [0x43c784]
call sub.USER32.dll_SetWindowTextA
add esp, 8
test eax, eax
je 0x40434a
add esp, 0xfffffff8
push 0x40e248
lea ebx, [ebp - 0x220]
push ebx
call sub.msvcrt.dll_strcpy
add esp, 0xfffffff8
push 0x4041ea
push ebx
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push 0x4041ed
push ebx
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffff8
push ebx
push dword [0x43c780]
call sub.USER32.dll_SetWindowTextA
add esp, 8
mov byte [ebp - 0x225], 1
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
add esp, 0xfffffff4
push edi
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov al, byte [ebp - 0x225]
mov byte [0x40e387], al
test al, al
je 0x404389
add esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
push eax
push 0x40e288
call sub.msvcrt.dll_strcpy
mov dword [0x43cc84], 0x4e3
mov al, byte [ebp - 0x225]
lea esp, [ebp - 0x248]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x407684
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov edi, dword [ebp + 8]
add esp, 0xfffffff8
push 0x401410
push dword [ebp + 0xc]
call sub.msvcrt.dll_fopen
mov dword [ebp - 4], eax
push eax
push 1
push 0x5dd0
push edi
call sub.msvcrt.dll_fread
add esp, 0x20
lea ebx, [edi + 0x12c]
mov esi, 0x4a
nop
add esp, 0xfffffff8
push ebx
push 0x401413
call sub.msvcrt.dll_printf
add esp, 0x10
add ebx, 0x64
dec esi
jns 0x4076c0
mov eax, dword [ebp - 4]
push eax
push 1
push 4
lea eax, [edi + 0x3f50]
push eax
call sub.msvcrt.dll_fread
add esp, 0xfffffff8
push dword [edi + 0x3f50]
push 0x401417
call sub.msvcrt.dll_printf
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [edi + 0x3f50]
add eax, eax
push eax
call fcn.00408b94
mov dword [edi + 0x3f48], eax
add esp, 0xfffffff8
push eax
push 0x401428
call sub.msvcrt.dll_printf
add esp, 0x20
mov eax, dword [ebp - 4]
push eax
push 2
push dword [edi + 0x3f50]
push dword [edi + 0x3f48]
call sub.msvcrt.dll_fread
add esp, 0xfffffff4
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_fclose
add esp, 0x20
add esp, 0xfffffff4
push 0x401441
call sub.msvcrt.dll_printf
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x407f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push ebx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
add esp, 0xfffffff8
push esi
push 0x402d84
call sub.msvcrt.dll_printf
add esp, 0xfffffff8
push 0x401410
push esi
call sub.msvcrt.dll_fopen
mov esi, eax
add esp, 0x20
push esi
push 0x2c
push 1
add ebx, 0x5dd0
push ebx
call sub.msvcrt.dll_fread
add esp, 0xfffffff4
push esi
call sub.msvcrt.dll_fclose
lea esp, [ebp - 0x18]
pop ebx
pop esi
leave
ret

Function at 0x408a18
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
call fcn.00408b38
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
add esp, 0xfffffff4
lea eax, [ebp - 0x50]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
add esp, 0xc
test ebx, ebx
je 0x408a84
jmp 0x408a41
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x408a40
cmp al, 9
je 0x408a40
mov al, byte [ebx]
cmp al, 0x22
jne 0x408a6b
lea esi, [esi]
inc ebx
mov al, byte [ebx]
cmp al, 0x22
je 0x408a79
test al, al
jne 0x408a58
jmp 0x408a7a
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x408a79
cmp al, 9
je 0x408a7a
test al, al
jne 0x408a68
jmp 0x408a7a
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x408a79
cmp al, 9
je 0x408a79
mov eax, 0xa
test byte [ebp - 0x24], 1
je 0x408a93
movzx eax, word [ebp - 0x20]
push eax
push ebx
push 0
add esp, 0xfffffff4
push 0
call sub.KERNEL32.dll_GetModuleHandleA
add esp, 0xc
push eax
call fcn.00406af4
mov ebx, dword [ebp - 0x68]
leave
ret

Function at 0x40b590
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40b5b5
mov dword [0x44c39c], eax
add esp, 0xfffffff8
push 0x40b554
push eax
call fcn.0040d020
jmp 0x40b5ba
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40b5d0
mov dword [0x40e3d0], 0x40b6b4
jmp 0x40b5da
mov dword [0x40e3d0], 0x40b668
leave
ret
Function at 0x10001010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
jne 0x10001088
push esi
push edi
push 0x30
push 0x100020ac
push 0x100020ac
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [eax + 0x3c]
mov edi, dword [ecx + eax + 0x28]
add edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0x834
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [edi + 0x833]
mov ecx, 0x20d
mov esi, 0x100020b0
mov eax, 1
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000109d
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.1000109d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406140
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x40619e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x406160
mov eax, dword [edi]
jmp 0x406289
cmp eax, 0x4e0
jb 0x406289
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4061c0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x406210
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4079ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x43c018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x4079d1
xor eax, eax
jmp 0x407a2d
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x4079fe
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x4079fe
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x407ab4
cmp dword [edi + 0x4c], 0
je 0x407a27
mov ecx, edi
call fcn.00407637
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x407a3d
push dword [edi + 0x4c]
push ebx
call fcn.00406f29
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x407a2c
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00409a46
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x42d194]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x407a87
sub eax, 1
je 0x407a87
dec eax
sub eax, 1
jne 0x407a27
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x407a19
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x407aa4
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.00414e48
add esp, 0x10
cmp esi, eax
jne 0x407a27
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x407a27
mov ax, bx
jmp 0x407a2c

Function at 0x41da49
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041d6fa

Function at 0x41da54
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041d884

Function at 0x423f38
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00423a8b
Function at 0x9c12b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x9c50a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.009c11ad
test eax, eax
jne 0x9c1323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x9c1340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x9c1323
cmp dword [ebp - 0x10], 4
jne 0x9c1323
cmp dword [ebp - 8], 1
jne 0x9c1323
cmp dword [esi + 0xc], ebx
je 0x9c136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x9c133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0x9c1323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0x9c1323
Function at 0x9c25d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0x9c2d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x9c303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x9c2616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0x9c32d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0x9c32c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.009c2d61
test eax, eax
jne 0x9c25ec
jmp 0x9c32bd
shl eax, 0xa
push eax
jmp 0x9c2610
xor eax, eax
jmp 0x9c262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x9c25ec
jmp 0x9c32bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0x9c261f
Function at 0x404683
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push ebx
push esi
mov esi, eax
push edi
lea eax, [ecx + 0x10]
push eax
lea eax, [ecx + 8]
push eax
lea eax, [ebp - 0x308]
mov edi, edx
call fcn.00405fbf
push 8
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.0044680a
add esp, 0x14
test esi, esi
jbe 0x4046fa
mov ebx, dword [ebp + 0xc]
sub ebx, edi
dec esi
shr esi, 3
inc esi
lea ecx, [ebp - 0x188]
lea eax, [edi + ebx]
push ecx
call fcn.0040603b
and dword [ebp + 8], 0
pop ecx
mov eax, edi
mov ecx, dword [ebp + 8]
lea ecx, [ebp + ecx - 8]
mov dl, byte [ecx]
xor byte [eax], dl
mov dl, byte [ebx + eax]
inc dword [ebp + 8]
inc eax
cmp dword [ebp + 8], 8
mov byte [ecx], dl
jb 0x4046db
dec esi
mov edi, eax
jne 0x4046c5
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40523b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x14
pop esi
mov dword [ebp - 8], esi
call fcn.004053c0
cmp edi, esi
jae 0x40525b
mov dword [ebp - 8], edi
mov esi, 0xff
xor ebx, ebx
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.00446804
add esp, 0xc
push esi
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call fcn.00446804
add esp, 0xc
push esi
lea eax, [ebp - 0x30b]
push ebx
push eax
mov byte [ebp - 0x30c], bl
call fcn.00446804
add esp, 0xc
push dword [ebp - 8]
lea eax, [ebp - 0x20c]
push dword [ebp + 0xc]
push eax
call fcn.0044680a
add esp, 0xc
push dword [ebp - 8]
lea eax, [ebp - 0x10c]
push dword [ebp + 0xc]
push eax
call fcn.0044680a
add esp, 0xc
xor eax, eax
cmp edi, ebx
jbe 0x4052ec
xor byte [ebp + eax - 0x20c], 0x5c
xor byte [ebp + eax - 0x10c], 0x36
inc eax
cmp eax, edi
jb 0x4052d7
lea eax, [ebp - 0x30c]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x10c]
push dword [ebp + 0x10]
push edi
push eax
mov eax, dword [ebp + 8]
call fcn.0040532b
push dword [ebp + 0x18]
lea eax, [ebp - 0x30c]
push 0x14
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 8]
call fcn.0040532b
pop esi
pop ebx
leave
ret 0x14
Function at 0x406e4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edi
push ebx
mov byte [ebp - 0x14], 0xc1
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0xd9
mov byte [ebp - 0x16], 0xad
mov byte [ebp - 0x15], 0x5e
mov byte [ebp - 0x18], 0x18
mov byte [ebp - 0x17], 0x18
mov byte [ebp - 0x11], 0x62
xor edx, edx
lea ecx, [ebp - 0x11]
push esi
mov al, dl
mov bl, 0xd
imul bl
xor al, byte [ebp + edx - 0x18]
xor al, byte [ecx]
inc edx
mov byte [ebp + edx - 0x11], al
dec ecx
cmp edx, 8
jl 0x406e8b
xor ecx, ecx
lea esi, [ebp - 0x11]
mov al, cl
mov dl, 0xe
imul dl
xor al, byte [esi]
xor al, 0x45
mov byte [ebp + ecx - 8], al
inc ecx
dec esi
cmp ecx, 8
jl 0x406ea7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00405fbf
pop ecx
pop ecx
pop esi
pop ebx
leave
ret 4

Function at 0x406ed7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30c
push ebx
push esi
push edi
lea eax, [esp + 0x18]
push eax
call fcn.00406e4f
and dword [esp + 0xc], 0
cmp dword [ebp + 0xc], 0
mov byte [0x45b4e6], 0xf2
mov byte [0x45b4e7], 0x25
mov byte [0x45b4e5], 0xdf
mov byte [0x45b4e0], 0x7e
mov byte [0x45b4e3], 0xda
mov byte [0x45b4e4], 0x2a
mov byte [0x45b4e2], 0x1c
mov byte [0x45b4e1], 0x43
jbe 0x406f88
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x198]
push eax
lea edi, [esp + 0x14]
mov eax, ebx
call fcn.0040603b
pop ecx
xor eax, eax
lea esi, [eax + 0x45b4e0]
mov cl, byte [esi]
xor cl, byte [esp + 0xc]
xor byte [esp + eax + 0x10], cl
mov cl, byte [ebx + eax]
inc eax
cmp eax, 8
mov byte [esi], cl
jb 0x406f4c
push 8
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.0044680a
add dword [esp + 0x18], 8
mov eax, dword [esp + 0x18]
add esp, 0xc
add ebx, 8
cmp eax, dword [ebp + 0xc]
jb 0x406f36
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40aca5
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sbb bh, byte [edi]
rol al, 0
aas
fisttp qword [ecx]
add eax, 0xddffbf1a
or dword [esi], eax
adc al, 0x1a
cmp bh, byte [edi + 0x40]
add byte [edi], bh
lds edi, [edi + 0x3c]
adc dword [eax], eax
xor bh, bh
fisttp qword [ecx]
add dword [esi], ebp
add byte [edx], al
add byte [eax], al
cmp ch, byte [esp + edi*4]
mov edi, 0x6ed6ff
add al, byte [eax]
add byte [eax], dh
invalid

Function at 0x40e2ff
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x22c222c4
rol dword [ecx + 0x9d1eb03], 1
add dword [eax], eax
invalid
Function at 0x1001d970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c462
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100a5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x434
call fcn.1008ab52
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea edi, [eax + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], 0x100965d4
mov eax, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
movups xmmword [edi + 0x7c], xmm0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0xf
mov byte [edi + 0x7c], 0
mov byte [ebp - 4], 1
mov ecx, edi
push eax
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov byte [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov byte [edi + 0x3e0], 0
mov dword [edi + 0x3e4], 0
mov dword [edi + 0x3e8], 0
mov dword [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov dword [edi + 0x3f4], 0
mov dword [edi + 0x3f8], 0
mov word [edi + 0x408], 0
call fcn.10017740
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
movq qword [ecx], xmm0
mov dword [ecx + 4], 0
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret