joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fa2a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5023f1
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x5405e4]
xor eax, ebp
mov dword [ebp - 0x58], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xf0], 0
lea ecx, [ebp - 0x84]
call fcn.004e9010
mov dword [ebp - 4], 0
mov dword [ebp - 0x54], 0
push 0x40
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.004804b0
add esp, 0xc
mov dword [ebp - 0x94], 0
xor ecx, ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x54], 0x44
push 0x5197a8
lea ecx, [ebp - 0xb4]
call fcn.00405940
mov dword [ebp - 0xf8], eax
mov edx, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xfc]
push ecx
lea edx, [ebp - 0xd0]
push edx
call fcn.00425c60
add esp, 0xc
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x104], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xf4]
add ecx, 4
push ecx
mov edx, dword [ebp - 0xf4]
add edx, 0x20
push edx
lea eax, [ebp - 0xec]
push eax
call fcn.00425c60
add esp, 0xc
mov dword [ebp - 0x108], eax
lea ecx, [ebp - 0x94]
push ecx
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp - 0xf4]
add ecx, 0x20
call fcn.00405920
push eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x104]
call fcn.00405920
push eax
mov ecx, dword [ebp - 0x108]
call fcn.00405920
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x95], al
lea ecx, [ebp - 0xec]
call fcn.00405980
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd0]
call fcn.00405980
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb4]
call fcn.00405980
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x4fa441
push 0
push 0
mov ecx, 0x54ad18
call fcn.00405920
push eax
call fcn.00468555
jmp 0x4fa46d
mov ecx, dword [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0x84]
call fcn.004e8c20
mov edx, dword [ebp - 0x94]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x84]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00425be0
mov edx, dword [ebp - 0xf0]
or edx, 1
mov dword [ebp - 0xf0], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.004e8db0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x58]
xor ecx, ebp
call fcn.0047d69b
mov esp, ebp
pop ebp
ret 8
Function at 0x402e60
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402e9a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x402ea1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x402e80
jmp 0x402ea3
mov eax, 0x1505
jmp 0x402ea3
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x408b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x408b7b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x408b83
mov word [ebx], 1
add esp, 4
pop esi
pop edi
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x408c1b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x408bc9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x408c2a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x408bde
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x408bf0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x408bb0
jmp 0x408bf9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x408bb0
cmp edi, ebx
jge 0x408c10
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x408bb4
jmp 0x408c14
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x408bbd
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x408cb2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x408cb2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408c64
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x408c50
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x408cb2
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x408c70
dec eax
mov ecx, 1
xor esi, esi
jmp 0x408ccc
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x408b7b
test edx, edx
mov dword [esp], ecx
js 0x408d00
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x408d10
inc ebp
dec edx
cmp edi, ebp
jne 0x408ce0
mov edx, 0xffffffff
jmp 0x408d12
xor edi, edi
jmp 0x408d15
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x408cc0
and ebp, 3
je 0x408d48
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408d30
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x408d4a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x408cc0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408d60
jmp 0x408cc0
Function at 0x409970
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x4099d2
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x409990
mov eax, 0x270
jmp 0x4099e4
cmp eax, 0x4e0
jb 0x4099e4
mov esi, ecx
call fcn.00409a30
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
mov ecx, eax
and ecx, edx
add ecx, ecx
sub eax, ecx
add eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
mov edx, ecx
and edx, eax
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret

Function at 0x409a30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [ecx + 0x9c4]
mov eax, 0x3fe
jmp 0x409a66
shr esi, 1
xor esi, dword [ecx + eax*4]
xor esi, edi
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
je 0x409a97
mov esi, edx
and esi, 0x80000000
mov edx, dword [ecx + eax*4 - 0x630]
lea edi, [edx - 0x80000000]
mov ebx, edx
or ebx, 0x7fffffff
and ebx, edi
or esi, ebx
mov edi, esi
xor edi, 0xfffffffe
and edi, ebx
je 0x409a50
mov edi, 0x9908b0df
jmp 0x409a50
mov edi, dword [ecx + 0xd50]
mov eax, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax - 1]
and edi, 0x80000000
mov ebx, dword [ecx + eax*4 + 0x9c4]
mov esi, ebx
and esi, 0x7ffffffe
or esi, edi
shr esi, 1
mov edi, ebx
and ebx, 1
neg ebx
and ebx, 0x9908b0df
mov ebp, edx
or ebp, 0x3ffffd8f
and edx, 0x18f
add edx, ebp
xor ebx, dword [ecx + edx*4 + 0x63c]
xor ebx, esi
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, 0x270
jne 0x409ab0
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412460
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x6d0
mov esi, esp
mov edi, dword [ebp + 8]
call fcn.00414770
push eax
mov ebx, esp
push eax
mov dword [esi + 0x21c], esp
sub esp, 0x3c
mov dword [esi + 0xc0], esp
push eax
mov dword [esi + 0x218], esp
sub esp, 0x34
mov dword [esi + 0xbc], esp
push eax
mov dword [esi + 0x214], esp
sub esp, 0x44
mov dword [esi + 0x1b4], esp
sub esp, 0x10
mov dword [esi + 0x1b0], esp
sub esp, 8
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x1ac], eax
mov esp, eax
push eax
push eax
mov dword [esi + 0xb8], esp
push eax
mov dword [esi + 0x210], esp
sub esp, 0x44
mov dword [esi + 0x20c], esp
sub esp, 0x10
mov dword [esi + 0xb4], esp
sub esp, 4
mov dword [esp], edi
call fcn.00402750
add esp, 4
mov edx, eax
cmp edx, 0
sete al
test al, 1
jne 0x412502
jmp 0x412509
xor eax, eax
jmp 0x4142b6
mov dword [esi + 0xc4], ebx
xor ebx, ebx
jmp 0x412513

Function at 0x414c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x418
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x414c40
mov eax, ebx
sar eax, 1
mov dword [esp + 0xd8], eax
cmp eax, 0xfffffff2
jge 0x414c62
mov eax, 0xffffffff
jmp 0x414c65
lea eax, [ebx + 0x1c]
push eax
call fcn.00408f10
add esp, 4
mov esi, eax
mov dword [esp + 0x290], 0xe3aee1bc
mov dword [esp + 0x294], 0xe795e585
mov dword [esp + 0x298], 0xebcae99c
mov dword [esp + 0x29c], 0xef8bedba
mov dword [esp + 0x2a0], 0xf381f182
mov dword [esp + 0x2a4], 0xf799f59d
mov dword [esp + 0x2a8], 0xfbfaf996
xor eax, eax
nop
movzx ecx, byte [esp + eax + 0x290]
xor cl, al
xor cl, 0xe0
mov byte [esp + eax + 0x290], cl
inc eax
cmp eax, 0x1c
jne 0x414cc0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x414d01
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x414cf0
mov word [eax], 0
movzx ecx, word [esp + 0x290]
test cx, cx
je 0x414d31
lea edx, [esp + 0x292]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414d20
mov word [eax], 0
lea eax, [esp + 0x110]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00439cd0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43e6e0]
Function at 0x419440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0xe388e1cf
mov dword [esp + 0x14], 0xe789e597
mov dword [esp + 0x18], 0xebeae986
xor eax, eax
nop
movzx ecx, byte [esp + eax + 0x10]
xor cl, al
xor cl, 0xe0
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0xc
jne 0x419470
mov dword [esp + 0x34], 0xe275e077
mov dword [esp + 0x38], 0xe675e477
mov dword [esp + 0x3c], 0xda86d8ad
mov dword [esp + 0x40], 0xde41dc84
mov dword [esp + 0x44], 0xd272d040
mov dword [esp + 0x48], 0xd649d472
mov dword [esp + 0x4c], 0xca56c84f
mov dword [esp + 0x50], 0xce59cc58
mov dword [esp + 0x54], 0xc2c1c085
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x57
xor cl, byte [esp + eax + 0x34]
add cl, 0x48
mov byte [esp + eax + 0x34], cl
mov ecx, eax
and ecx, 0x2d
xor eax, 0x97076d2d
lea eax, [eax + ecx*2]
add eax, 0x68f892d4
cmp eax, 0x24
jb 0x4194d0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14c]
test cx, cx
je 0x419521
lea edx, [esp + 0x36]
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419510
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x419551
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419540
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x419581
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419570
mov word [eax], 0
mov edi, dword [esi]
mov dword [esp + 0x34], 0xd8dddfa3
mov byte [esp + 0x38], 0xbd
mov eax, 0x94aa6b31
mov esi, 0x6b5594ce
nop
movzx ebx, byte [esp + eax + 0x6b559503]
mov ecx, esi
and ecx, 0x4a41844e
mov edx, eax
and edx, 0x90086301
or edx, ecx
xor edx, ebx
mov ebx, edx
not ebx
xor edx, 0x81
and ebx, 1
add edx, 0x89
or edx, 1
sub ebx, edx
mov byte [esp + eax + 0x6b559503], bl
inc eax
dec esi
cmp eax, 0x94aa6b36
jne 0x4195a0
movzx eax, byte [esp + 0x34]
test al, al
je 0x41960b
lea ecx, [esp + 0x35]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x419600
mov byte [edi], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x140]
lea edx, [esp + 0x20]
lea esi, [esp + 0x14c]
push eax
push ecx
push edx
push esi
call fcn.0040be20
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x43ea40]
mov ecx, 0xcf1d2b71
xor ecx, dword [0x43ea48]
add eax, ecx
inc eax
jmp eax
Function at 0x41b7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
cmp dword [ecx], 0xffffffff
je 0x41b977
mov esi, ecx
lea eax, [esp + 0x20]
push 0
push 0
push 2
push eax
call fcn.0041cac0
test al, al
je 0x41b977
movzx eax, byte [esp + 0x21]
mov ecx, eax
and ecx, 0x7f
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0
cmp ecx, 0x7f
je 0x41b858
cmp ecx, 0x7e
jne 0x41b953
mov word [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 2
push eax
call fcn.0041cac0
movzx ecx, word [esp + 8]
rol cx, 8
mov ebx, eax
movzx eax, cx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
jmp 0x41b890
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 8
push eax
call fcn.0041cac0
mov ebx, eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
bswap ecx
bswap eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
movzx eax, byte [esp + 0x21]
test al, al
js 0x41b95d
xor eax, eax
test bl, bl
je 0x41b977
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
push edi
mov dword [esp + 0x3c], eax
call fcn.00408f10
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
mov ecx, esi
push edx
push ebx
push edi
push eax
call fcn.0041cac0
mov ebx, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
xor eax, edx
mov edi, dword [esp + 0x28]
xor edi, ecx
or edi, eax
sete byte [esp + 7]
or ecx, edx
setne cl
mov eax, dword [esp + 0x38]
and al, cl
cmp al, 1
jne 0x41b933
xor eax, eax
xor edx, edx
nop
mov edi, dword [esp + 0x34]
mov ecx, eax
and ecx, 3
movzx ecx, byte [esp + ecx + 0x30]
xor byte [edi + eax], cl
add eax, 1
adc edx, 0
cmp eax, dword [esp + 0x18]
mov ecx, edx
sbb ecx, dword [esp + 0x1c]
jb 0x41b910
mov edi, dword [ebp + 8]
and bl, byte [esp + 7]
cmp byte [esi + 4], 0
je 0x41b985
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0041cd50
jmp 0x41b996
xor ebx, ebx
test al, al
jns 0x41b89d
lea eax, [esp + 0x30]
mov ecx, esi
push 0
push 0
push 4
push eax
call fcn.0041cac0
test bl, bl
jne 0x41b8a7
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0041cbd0
mov eax, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], ecx
mov dword [edi], eax
jmp 0x41b979
Function at 0x4239aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp], 0
mov eax, dword [0x444998]
xor ebx, ebx
test eax, eax
je 0x423855
mov edi, dword [esp + 0x30]
mov ecx, dword [0x44499c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x67f3d776
je 0x4237f0
inc ebx
cmp eax, ebx
jne 0x4237e0
jmp 0x423853
mov eax, dword [ecx + ebx*8 + 4]
cmp eax, 0xffffffff
je 0x423853
mov ecx, esp
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x4449a0]
call fcn.00437df0
add esp, 0x1c
cmp eax, 0xc0000004
jne 0x423853
push dword [esp]
call fcn.00436a00
add esp, 4
mov esi, eax
mov ecx, dword [0x444998]
xor ebx, ebx
test ecx, ecx
je 0x423a14
mov eax, dword [esp]
mov edx, dword [0x44499c]
cmp dword [edx + ebx*8], 0x67f3d776
je 0x42385f
inc ebx
cmp ecx, ebx
jne 0x423840
jmp 0x423913
xor ebx, ebx
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [edx + ebx*8 + 4]
cmp ecx, 0xffffffff
je 0x423913
push 0
push eax
push esi
push 5
push 0x10
push ecx
push dword [0x4449a0]
call fcn.00437df0
add esp, 0x1c
xor ebx, ebx
test eax, eax
js 0x423a14
mov ebp, dword [esi]
xor eax, eax
mov ecx, ebp
mov dword [esp + 8], esi
mov edx, esi
nop
nop
nop
nop
nop
nop
nop
lea esi, [edx + ecx]
mov ecx, dword [edx + ecx]
add eax, 0x208
add ebx, 0x104
mov edx, esi
test ecx, ecx
jne 0x4238a0
test ebx, ebx
jns 0x4238c0
mov eax, 0xffffffff
push eax
call fcn.00408f10
add esp, 4
mov dword [esp + 4], eax
mov esi, dword [esp + 8]
mov ecx, esi
jmp 0x4238f0
add ecx, ebp
mov word [eax], 0xa
add eax, 2
mov ebp, dword [ecx]
test ebp, ebp
je 0x42391a
mov edx, dword [ecx + ebp + 0x3c]
movzx ebx, word [edx]
test bx, bx
je 0x4238e0
add edx, 2
nop
mov word [eax], bx
add eax, 2
movzx ebx, word [edx]
add edx, 2
test bx, bx
jne 0x423900
jmp 0x4238e0
xor ebx, ebx
jmp 0x423a14
xor ebx, ebx
mov ebp, dword [esp + 4]
cmp eax, ebp
je 0x423a0b
mov word [eax], 0
movzx ecx, word [ebp]
test cx, cx
je 0x423976
mov eax, ebp
add eax, 2
xor ebx, ebx
jmp 0x423955
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x423976
cmp cx, 0x7f
jbe 0x42393f
movzx edx, cx
cmp edx, 0x7ff
ja 0x42396b
add ebx, 2
jmp 0x42394a
cmp cx, 0xffff
je 0x42394a
add ebx, 3
jmp 0x42394a
lea esi, [ebx + 1]
push esi
call fcn.00408f10
add esp, 4
mov ecx, ebp
mov ebp, eax
push ecx
push esi
push eax
call fcn.00409d70
add esp, 0xc
mov dword [esp + 0xe], 0x78756b48
mov dword [esp + 0x12], 0x7a6d6e79
mov dword [esp + 0x16], 0x5b568f53
mov word [esp + 0x1a], 0xa550
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xe]
lea edx, [eax + 0x58]
and edx, ecx
add ecx, eax
add ecx, 0x58
add edx, edx
sub ecx, edx
add cl, 0x40
mov byte [esp + eax + 0xe], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xe
jb 0x4239c0
lea eax, [esp + 0xe]
mov ecx, edi
push ebx
push ebp
push eax
call fcn.00409f00
mov ebx, eax
push ebp
call fcn.00408f20
add esp, 4
mov esi, dword [esp + 8]
mov ebp, dword [esp + 4]
push ebp
call fcn.00408f20
add esp, 4
push esi
call fcn.00436a20
add esp, 4
jmp 0x423855
Function at 0x425460
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
add al, 0x89
jp 0x42bb35
add byte [eax + 0x1808e], cl
add dh, al
inc esi
cmp al, 0x1e
add dword [eax], eax
add byte [eax + 0x18c8e], cl
add dword [eax], eax
add dword [eax], eax
add dh, al
inc esi
xor byte [esi], bl
and al, 4
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xdc
push eax
sub esp, 0x14
mov dword [ebp - 0x1c], esp
sub esp, 0x18
mov esi, esp
sub esp, 0xc
mov dword [ebp - 0x58], esp
sub esp, 0x1c
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x78], esp
sub esp, 0x18
mov dword [ebp - 0xbc], esp
sub esp, 8
mov dword [ebp - 0xb8], esp
sub esp, 8
mov dword [ebp - 0x54], esp
sub esp, 0x10
mov dword [ebp - 0x20], esp
sub esp, 0x30
mov eax, esp
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x88], eax
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xc4], eax
push eax
mov dword [ebp - 0xc0], esp
mov dword [ebp - 0x74], 0xf634f4d6
mov dword [ebp - 0x70], 0xea79e867
mov dword [ebp - 0x6c], 0xee0cec2f
mov dword [ebp - 0x68], 0xe200e07b
mov dword [ebp - 0x64], 0xe6e5e4c6
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xab
xor cl, byte [ebp + eax - 0x74]
add cl, 0xa8
mov byte [ebp + eax - 0x74], cl
inc eax
cmp eax, 0x14
jne case.default.0x425559
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0x74]
mov edi, edx
mov ecx, 5
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0xd4]
lea eax, [ebp - 0x60]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 9
push edx
push 0
call dword [0x444994]
xor ecx, ecx
cmp eax, 0xc0000023
setne cl
jmp dword [ecx*4 + 0x43fc34]
inc esp
and al, 0x37
hlt
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406064], 1
mov dword [0x406060], 1
mov dword [0x40605c], 1
mov dword [0x406054], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x406014], eax
mov eax, dword [0x406070]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406084]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40606c]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x40301c], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x401850
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]