joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x405087
cmp dword [esp + 0x1c], 0
jle 0x40502e
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea esi, [edx + ecx]
mov dword [esp], esi
jmp 0x404ea8
cmp esi, 0xc0
jne 0x405087
and ebp, 0x1ff800
cmp ebp, 0xd800
mov esi, dword [esp]
je 0x405087
add edx, edi
cmp edx, esi
jae 0x40502e
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x405087
mov ecx, ebx
and cl, 0xfe
cmp cl, 0xc0
je 0x405087
mov ecx, ebx
and ecx, 0xffffffc0
cmp ecx, 0x80
je 0x405087
mov edi, 1
test bl, bl
jns 0x404e9e
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x404f13
movzx ebp, byte [edx + 1]
mov ecx, ebp
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x405087
and ebx, 0x1f
shl ebx, 6
and ebp, 0x3f
or ebp, ebx
mov edi, 2
jmp 0x404f6f
mov ecx, ebx
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x404f82
movzx edi, byte [edx + 1]
mov ecx, edi
xor ecx, 0xffffff3f
mov ebp, edi
or ebp, 0xc0
and ebp, ecx
cmp ebp, 0x80
jne 0x405087
movzx ebp, byte [edx + 2]
mov ecx, ebp
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x405087
and ebx, 0xf
shl ebx, 0xc
and edi, 0x3f
shl edi, 6
or edi, ebx
and ebp, 0x3f
or ebp, edi
mov edi, 3
xor ebx, ebx
cmp ebp, 0x80
jae 0x405002
jmp 0x405087
mov ecx, ebx
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x405087
movzx edi, byte [edx + 1]
mov ecx, edi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x405087
movzx ebp, byte [edx + 2]
mov ecx, ebp
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x405087
movzx eax, byte [edx + 3]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x405085
and eax, 0x3f
and ebx, 7
shl ebx, 0xc
and edi, 0x3f
shl edi, 6
or edi, ebx
and ebp, 0x3f
or ebp, edi
shl ebp, 6
or ebp, eax
mov bl, 1
mov edi, 4
xor eax, eax
cmp ebp, 0x80
jb 0x405087
cmp ebp, 0x7ff
jbe 0x404e7d
cmp ebp, 0xffff
ja 0x405020
test bl, bl
je 0x404e89
jmp 0x405087
cmp ebp, 0x10ffff
jbe 0x404e89
jmp 0x405087
mov edi, dword [esp + 0x1c]
lea eax, [edi + 1]
push eax
call dword [0x44b008]
add esp, 4
test eax, eax
je 0x405085
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040cbf0
add esp, 0xc
push 0x10
call dword [0x44b008]
add esp, 4
test eax, eax
je 0x40507b
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x405087
push esi
call dword [0x44b004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405090
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4051a2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4051a2
cmp dword [esp + 0x2c], 0
je 0x4051a2
push esi
call fcn.0040ce20
add esp, 4
test eax, eax
je 0x4050fa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405101
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4050e0
jmp 0x405103
mov ebx, 0x1505
jmp 0x405103
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4051aa
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405167
call fcn.00405e00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4051a2
push ecx
call fcn.0040ce20
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40521d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4051c8
inc edi
dec esi
je 0x40511c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405121
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4051c0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040ce20
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4051c0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040ce50
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4051c0
mov eax, 0xffffffff
jmp 0x4051a2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405238
inc edi
dec esi
je 0x405162
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405167
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405230
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040ce20
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405230
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040ce50
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405230
jmp 0x405167
Function at 0x405b50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405d3a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405d3a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405d3a
cmp dword [ecx], 0
jne 0x405d3a
push esi
call fcn.0040ce20
add esp, 4
test eax, eax
je 0x405bba
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405bc1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405ba0
jmp 0x405bc3
mov edi, 0x1505
jmp 0x405bc3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405c94
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405c21
call fcn.00405e00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405d3a
push esi
call fcn.0040ce20
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405d50
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040ce20
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44b008]
add esp, 4
test eax, eax
je 0x405d35
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040cbf0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405d3a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405cb8
inc ebx
dec edx
je 0x405bdc
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405be1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405cb0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040ce20
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405cb0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040ce50
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405cb0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404c20
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405c89
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406e20
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x406fc6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406fbf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x406eb0
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov ebx, 0x15b0
je 0x406fbf
mov dword [esp + 4], esi
xor edx, edx
cmp ebx, 8
mov dword [esp], ebx
jb 0x406f24
xor eax, eax
movzx edx, byte [ebp]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + 1]
add esi, edx
add ecx, esi
movzx ebx, byte [ebp + 2]
add ebx, esi
mov edx, ecx
and edx, ebx
xor ecx, ebx
movzx edi, byte [ebp + 3]
add edi, ebx
movzx esi, byte [ebp + 4]
add esi, edi
add edi, ecx
movzx ebx, byte [ebp + 5]
add ebx, esi
lea ecx, [edi + edx*2]
movzx edx, byte [ebp + 6]
add edx, ebx
add ecx, esi
movzx edi, byte [ebp + 7]
add edi, edx
add ecx, ebx
mov ebx, dword [esp]
add ecx, edx
add ecx, edi
mov esi, eax
and esi, 8
xor eax, 8
lea edx, [eax + esi*2]
add ebp, 8
lea esi, [eax + esi*2]
add esi, 7
mov eax, edx
cmp esi, ebx
jb 0x406ec0
mov eax, edx
sub eax, ebx
jae 0x406e74
sub ebx, edx
mov dword [esp + 0x10], ebx
and ebx, 3
mov dword [esp + 8], ebx
je 0x406f70
mov dword [esp + 0xc], eax
neg dword [esp + 8]
xor esi, esi
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec esi
cmp dword [esp + 8], esi
jne 0x406f50
sub edx, esi
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffc
ja 0x406e70
jmp 0x406f7b
mov ebx, ebp
cmp eax, 0xfffffffc
ja 0x406e70
mov eax, dword [esp]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x406f90
jmp 0x406e70
shl ecx, 0x10
or ecx, edi
jmp 0x406fcb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406fe0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40700e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x4070ac
not eax
test bl, 1
jne 0x407015
mov edx, ebx
cmp ebx, 1
jne 0x407046
jmp 0x4070aa
xor eax, eax
jmp 0x4070ac
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x448c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x448c50]
cmp ebx, 1
je 0x4070aa
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x448c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x448c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x448c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x448c50]
add esi, 2
cmp edx, esi
jne 0x407050
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40caa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40cb0c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40caee
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40caf0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40cad0
jmp 0x40caf0
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40cb0a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40cb0c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40d3d0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
call fcn.00441c40
test al, al
je 0x40d596
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
call fcn.00439ed0
test al, al
je 0x40d591
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
mov dword [esp], 0x12db0c0f
mov dword [esp + 4], 0x263cfa22
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, esp
xor ecx, ecx
xor edx, edx
nop
mov ebx, edx
and bl, 0xf0
add bl, cl
xor bl, byte [eax]
xor bl, 0x68
add bl, 0xf8
mov byte [eax], bl
inc eax
add edx, 2
inc cl
cmp edx, 0x16
jne 0x40d420
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], 0x26bf8545
mov dword [esp + 4], 0xe83f9ac3
mov word [esp + 8], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0x18
mov edx, ecx
xor edx, 0x7c
add edx, edi
xor dl, byte [esp + ecx]
add dl, 0x94
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0xa
jne 0x40d470
mov dword [esp], 0x710e0f6f
mov eax, 0xbd
mov ecx, 0x2ee55842
nop
movzx edx, byte [esp + eax - 0xbd]
lea edi, [eax - 0x2ee55900]
and edi, 0xc1100607
mov ebx, ecx
and ebx, 0x22600078
or ebx, edi
xor ebx, edx
xor ebx, 7
lea edi, [ecx - 0x2ee55800]
and edi, edx
or edi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
or ebx, eax
and ebx, edi
mov dl, 0x4e
sub dl, bl
mov byte [esp + eax - 0xbd], dl
inc eax
dec ecx
cmp eax, 0xc1
jne 0x40d4a0
test esi, esi
je 0x40d537
mov dword [esp], 0x9a73d53
mov dword [esp + 4], 0xe3d8ec2a
mov byte [esp + 8], 0
mov eax, 0x9f0b2738
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x60f4d8c8]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xe8
mov byte [esp + eax + 0x60f4d8c8], cl
inc eax
cmp eax, 0x9f0b2741
jne 0x40d510
mov dword [esp], 0xfefdfc03
mov dword [esp + 4], 0xfaf9f8ff
mov dword [esp + 8], 0
mov eax, 0x38
mov ecx, 7
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x39
mov edx, eax
and edx, 0x46
sub edx, esi
xor dl, byte [esp + eax - 0x38]
add dl, 5
mov byte [esp + eax - 0x38], dl
inc eax
dec ecx
cmp eax, 0x44
jne 0x40d560
call fcn.0040e450
test al, al
je 0x40d591
call fcn.00411e20
call fcn.004108c0
call fcn.00442790
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x411e20
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x310
mov esi, esp
push eax
push eax
mov ecx, esp
sub esp, 8
mov dword [esi + 8], esp
sub esp, 0x68
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
sub esp, 0x64
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x64], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x60], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x5c], eax
mov esp, eax
mov dword [esi + 0xc], ecx
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x58], eax
mov esp, eax
push eax
sub esp, 0xfc
mov dword [esi + 0x54], esp
sub esp, 0xc
mov dword [esi + 0x4c], esp
sub esp, 8
mov dword [esi + 0x48], esp
sub esp, 0x24
mov dword [esi + 0x10], esp
push eax
mov dword [esi + 0x44], esp
push eax
mov dword [esi + 0x78], esp
sub esp, 0x68
mov ecx, esp
sub esp, 0x10
mov edx, esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x40], eax
mov esp, eax
push eax
sub esp, 0xc
mov eax, esp
sub esp, 0x800
mov dword [esi + 0x3c], esp
sub esp, 0x80
mov dword [esi + 0x6c], esp
mov dword [esi + 0x18], edx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x74], eax
sub esp, 0x44
mov dword [esi + 0x70], esp
sub esp, 0x10
mov dword [esi + 0x38], esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, eax
shr ecx, 0x1f
xor eax, eax
jmp dword [ecx*4 + 0x44cb44]
Function at 0x41ea90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.0040cb20
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41eab0
sar esi, 1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4528c8]
mov ebx, dword [esp + 0x28]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41eae4
mov eax, 0xffffffff
jmp 0x41eae7
lea eax, [ebx + ebx]
push eax
call fcn.0040cbc0
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x4528c8]
mov eax, dword [esp + 0x28]
mov ecx, eax
add ecx, 0xd
js 0x41eb1c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cbc0
add esp, 4
mov edi, eax
mov dword [esp + 0xb4], 0x895e8b28
mov dword [esp + 0xb8], 0x850b8737
mov dword [esp + 0xbc], 0x81628308
mov dword [esp + 0xc0], 0x9d259f2a
mov dword [esp + 0xc4], 0x99179b12
mov dword [esp + 0xc8], 0x9527972f
mov dword [esp + 0xcc], 0x91929326
mov dword [esp + 0xd0], 0
mov eax, 0x62
mov ecx, 0x2f641d9c
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x52]
lea esi, [eax - 0x17b20eff]
mov ebx, ecx
xor ebx, esi
and ebx, edx
xor ebx, esi
add ebx, 0xee0afc50
mov edx, ebx
and edx, 0x10
xor ebx, 0x10
lea edx, [ebx + edx*2]
add dl, 0xb1
mov byte [esp + eax + 0x52], dl
inc eax
dec ecx
cmp eax, 0x82
jne 0x41eb90
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41ebf1
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ebe0
mov word [eax], 0
movzx ecx, word [esp + 0xb4]
test cx, cx
je 0x41ec21
lea edx, [esp + 0xb6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ec10
mov word [eax], 0
lea eax, [esp + 0x48]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00445bb0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d9b4]
Function at 0x421d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov edi, dword [esp + 0x5c]
xor eax, eax
test edi, edi
setne al
xor esi, esi
mov dword [esp + 0x3c], 0
mov dword [esp], 0
jmp dword [eax*4 + 0x44db74]
Function at 0x424020
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x424030
sar ebp, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x4528c8]
mov edi, dword [esp + 4]
test edi, edi
jns 0x42405f
mov eax, 0xffffffff
jmp 0x424062
lea eax, [edi + edi]
push eax
call fcn.0040cbc0
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x4528c8]
lea eax, [esp + 8]
push eax
push esi
call fcn.00445d90
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44dd0c]
Function at 0x425ebc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x14], esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425ed0
cmp eax, 0xffffffed
jge 0x425ee7
mov eax, 0xffffffff
jmp 0x425eea
add eax, 0x12
push eax
call fcn.0040cbc0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0x11831f70
mov dword [ebp - 0x28], 0x15991377
mov dword [ebp - 0x24], 0x9481740
mov dword [ebp - 0x20], 0xd680b6c
mov word [ebp - 0x1c], 0xf0c
mov dword [ebp - 0x1a], 0
mov word [ebp - 0x16], 0
mov eax, 0x4c52c85
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ebp + eax - 0x4c52cb1]
lea esi, [eax - 0x20000000]
mov edx, ebx
and edx, 0x59
or edx, 0x500004
and ebx, 0xffffffa6
mov ecx, eax
or ecx, 0xe0852419
and ecx, esi
xor ecx, ebx
xor ecx, edx
mov edx, ecx
xor edx, 0x500004
mov esi, 0x19
sub esi, edx
or esi, 1
add esi, edx
xor ecx, 5
lea ecx, [ecx + esi*2]
add cl, 0x34
mov byte [ebp + eax - 0x4c52cb1], cl
inc eax
cmp eax, 0x4c52c9d
jne 0x425f30
movzx ecx, word [edi]
mov ebx, dword [ebp - 0x10]
mov eax, ebx
test cx, cx
je 0x425fb1
add edi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425fa0
mov word [eax], 0
movzx ecx, word [ebp - 0x2c]
test cx, cx
je 0x425fe1
lea edx, [ebp - 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425fd0
mov word [eax], 0
mov esi, dword [ebp - 0x14]
push esi
push ebx
call fcn.00445d90
add esp, 8
mov edi, eax
mov eax, ebx
mov ebx, dword [esi]
jmp dword [0x44ddd4]
Function at 0x428b50
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov eax, dword [0x4528c8]
mov dword [esp], 0x41b2476b
mov dword [esp + 4], 0x4daf43d1
mov dword [esp + 8], 0x49da4faf
mov dword [esp + 0xc], 0x75da4b8b
mov dword [esp + 0x10], 0x71ba77e4
mov dword [esp + 0x14], 0x7dee7393
mov dword [esp + 0x18], 0x79517f9f
mov word [esp + 0x1c], 0x7b78
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x91
xor dl, byte [esp + ecx]
add dl, 0x2b
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x23
jne 0x428bb0
lea edi, [esp + 0x50]
mov ebp, esp
push edi
push 0
push 0
push 0xe
push ebp
push 0
call eax
mov ebx, dword [esp + 0x50]
test ebx, ebx
jns 0x428be5
mov eax, 0xffffffff
jmp 0x428be8
lea eax, [ebx + ebx]
push eax
call fcn.0040cbc0
add esp, 4
mov dword [esp + 0x68], eax
mov eax, dword [0x4528c8]
mov dword [esp], 0xe9a6eb8f
mov dword [esp + 4], 0xed4bef79
mov dword [esp + 8], 0xd17ed34b
mov dword [esp + 0xc], 0xd546d797
mov dword [esp + 0x10], 0xd99edb44
mov dword [esp + 0x14], 0xdd4adf7f
mov dword [esp + 0x18], 0xc1a9c37b
mov word [esp + 0x1c], 0xc7c0
mov dword [esp + 0x1e], 0
mov ecx, 0xe8061a57
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x17f9e5a9]
xor edx, ecx
lea esi, [edx + 0x4c]
and edx, 2
xor esi, 0x82
lea edx, [esi + edx*2]
add dl, 0x7f
mov byte [esp + ecx + 0x17f9e5a9], dl
inc ecx
cmp ecx, 0xe8061a79
jne 0x428c50
push edi
push ebx
mov ebx, dword [esp + 0x70]
push ebx
push 0xe
push ebp
push 0
call eax
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x428c9c
mov eax, 0xffffffff
jmp 0x428ca3
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040cbc0
add esp, 4
mov edi, eax
mov dword [esp], 0xc372c17c
mov dword [esp + 4], 0xc765c565
mov dword [esp + 8], 0xcb6bc963
mov dword [esp + 0xc], 0xcf6bcd6b
mov dword [esp + 0x10], 0xb3b2b123
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x30
xor cl, byte [esp + eax]
add cl, 0x10
mov byte [esp + eax], cl
inc eax
cmp eax, 0x14
jne 0x428ce0
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x428d21
lea edx, [ebx + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428d10
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x428d51
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428d40
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.00445d90
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44e4b0]