joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fa82
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41fb1f
push ebx
push esi
call fcn.0041fa4b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041e82c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41facc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41fb1e
push edi
push eax
call fcn.004193ad
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41faec
call fcn.0041858f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41fb1d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041e82c
add esp, 0x20
test eax, eax
jne 0x41fb0b
push edi
call fcn.0041858f
jmp 0x41fb13
push ebx
call fcn.0041858f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x426e50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426e7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426e7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x428000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x14
mov ecx, dword [ebp + 8]
sub eax, ecx
sar eax, 2
push esi
push edi
test eax, eax
je 0x4280d1
xor edi, edi
mov esi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov al, byte [esi + 0x4649b0]
mov edx, str.Own_head
xor al, 0x73
sub al, 0x6c
xor al, 0x74
mov byte [esi + 0x4649b0], al
call fcn.00404768
push eax
call fcn.00404928
mov al, byte [esi + 0x4649b0]
mov edx, str.Earth
add al, 0x4e
xor al, 0xdc
pop ecx
mov byte [esi + 0x4649b0], al
call fcn.00404768
push eax
call fcn.00404928
mov al, byte [esi + 0x4649b0]
xor al, 0xac
mov dword [esp], 0x430db8
sub al, 0x65
xor al, 0x22
sub al, 0x73
mov byte [esi + 0x4649b0], al
call fcn.00411bcd
pop ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push edi
call fcn.00405922
mov ecx, dword [ebp - 0x10]
mov al, byte [ecx]
xor byte [esi + 0x4649b0], al
mov eax, dword [ebp - 8]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.004051ef
inc esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
pop ecx
pop ecx
cmp esi, 0x4ac
jb 0x428028
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4280e6
mov eax, dword [ebp + 0x10]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.004051ef
pop ecx
pop ecx
pop edi
pop esi
leave
ret 0x14

Function at 0x428706
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x428614
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x4036d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
lea ecx, [edi + 1]
push ecx
push 0
push dword [esp + 0x30]
call fcn.00459cc8
xor esi, esi
add esp, 0xc
test edi, edi
je 0x403741
movzx edx, byte [esp + 0x30]
mov dword [esp + 0x18], edx
neg edx
sbb edx, edx
neg edx
mov byte [esp + 0x20], dl
xor ebx, ebx
cmp byte [esp + 0x20], bl
je 0x40373c
mov ecx, dword [esp + 0x28]
add ecx, esi
mov dword [esp + 0x1c], ecx
mov edx, edi
imul edx, ebx
add edx, esi
push edx
push dword [esp + 0x38]
call fcn.004062a2
mov cl, bl
mov edx, dword [esp + 0x24]
inc ebx
shl al, cl
or byte [edx], al
add esp, 8
cmp ebx, dword [esp + 0x18]
jb 0x403717
inc esi
cmp esi, edi
jb 0x403705
xor ebx, ebx
mov esi, 1
cmp edi, 1
jb 0x4037c0
mov ecx, dword [esp + 0x28]
mov dl, byte [esi + ecx]
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], edx
and dl, bl
mov ecx, dword [esp + 0xc]
xor cl, bl
mov ebx, edx
mov edx, dword [esp + 0x28]
mov byte [esi + eax], cl
mov eax, 1
and cl, al
sub al, cl
lea ecx, [esi + edx]
mov byte [esp + 0x21], al
mov dl, byte [ecx - 1]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], edx
imul dl
mov dl, byte [esi + ecx]
and al, dl
or bl, al
mov eax, dword [esp + 0x10]
imul byte [esp + 0x21]
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
xor al, cl
mov byte [esi + edx], al
mov cl, byte [esp + 0x21]
mov edx, dword [esp + 0x28]
lea edx, [esi + edx]
inc esi
shl cl, 7
or byte [edx - 1], cl
cmp edi, esi
jae 0x40374d
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x403dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
mov edx, 1
push eax
push ebx
mov ebx, dword [esp + 0x10]
lea ecx, [ebx + 0x34]
push esi
push edi
mov edi, dword [esp + 0x24]
push edx
sub esp, 4
push ecx
lea ecx, [edi + 0xc]
push ecx
call fcn.00406d05
add esp, 8
test eax, eax
jne 0x403e0b
lea edx, [ebx + 0x28]
push edx
push edi
call fcn.00406d05
add esp, 8
test eax, eax
je 0x403e0f
xor ecx, ecx
jmp 0x403e14
mov ecx, 1
mov byte [esp + 0x19], cl
push ecx
push ebx
call fcn.00403d80
mov ecx, eax
mov byte [esp + 0x20], cl
add esp, 0xc
dec ecx
pop edx
shl dl, cl
mov eax, dword [ebx + 0x5c]
mov byte [esp + 0x12], dl
movzx ecx, byte [esp + 0x10]
lea eax, [ecx + eax - 1]
xor edx, edx
div ecx
mov dword [esp + 0xc], eax
cmp byte [esp + 0x11], 0
je 0x403e5b
cmp dword [ebx + 0x74], 0
je 0x403e5b
mov esi, dword [ebx + 0x74]
mov eax, 1
jmp 0x403ead
push 0x24
movzx edx, byte [esp + 0x16]
push edx
call fcn.0045a474
add esp, 8
mov esi, eax
test eax, eax
jne 0x403e7b
mov edi, 0xffffb280
jmp 0x403f13
mov dword [esp + 0x18], ebx
xor ebx, ebx
cmp byte [esp + 0x12], bl
je 0x403ea7
movzx ecx, bl
lea edx, [ecx + ecx*8]
lea edx, [edx*4]
add edx, esi
push edx
call fcn.00402180
add esp, 4
inc bl
cmp bl, byte [esp + 0x12]
jb 0x403e87
mov ebx, dword [esp + 0x18]
xor eax, eax
test al, al
jne 0x403ee7
mov dword [esp + 0x24], edi
push dword [esp + 0x30]
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x30]
push esi
push ebx
call fcn.004037c7
add esp, 0x18
mov edi, eax
test eax, eax
jne 0x403f13
cmp byte [esp + 0x11], 0
je 0x403ee7
mov dword [ebx + 0x74], esi
movzx ecx, byte [esp + 0x12]
mov dword [ebx + 0x78], ecx
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x26]
push esi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push ebx
call fcn.00403ca0
mov edi, eax
add esp, 0x28
cmp dword [ebx + 0x74], esi
jne 0x403f1a
xor esi, esi
test esi, esi
je 0x403f4f
xor ebx, ebx
cmp byte [esp + 0x12], bl
je 0x403f46
movzx edx, bl
lea ecx, [edx + edx*8]
lea ecx, [ecx*4]
add ecx, esi
push ecx
call fcn.00402225
add esp, 4
inc bl
cmp bl, byte [esp + 0x12]
jb 0x403f26
push esi
call fcn.0045ace4
add esp, 4
test edi, edi
je 0x403f5f
push dword [esp + 0x1c]
call fcn.00402225
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x40b344
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], 0x67452301
mov dword [edx + 0xc], 0xefcdab89
mov dword [edx + 0x10], 0x98badcfe
mov dword [edx + 0x14], 0x10325476
mov dword [edx + 0x18], 0xc3d2e1f0
ret

Function at 0x40e0d4
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
test ecx, ecx
je 0x40e0eb
cmp ecx, 1
je 0x40e0eb
mov eax, 0xffffff8c
ret
xor eax, eax
test ecx, ecx
mov dword [edx], eax
mov dword [edx + 4], eax
jne 0x40e130
mov dword [edx + 8], 0x6a09e667
mov dword [edx + 0xc], 0xbb67ae85
mov dword [edx + 0x10], 0x3c6ef372
mov dword [edx + 0x14], 0xa54ff53a
mov dword [edx + 0x18], 0x510e527f
mov dword [edx + 0x1c], 0x9b05688c
mov dword [edx + 0x20], 0x1f83d9ab
mov dword [edx + 0x24], 0x5be0cd19
jmp 0x40e168
mov dword [edx + 8], 0xc1059ed8
mov dword [edx + 0xc], 0x367cd507
mov dword [edx + 0x10], 0x3070dd17
mov dword [edx + 0x14], 0xf70e5939
mov dword [edx + 0x18], 0xffc00b31
mov dword [edx + 0x1c], 0x68581511
mov dword [edx + 0x20], 0x64f98fa7
mov dword [edx + 0x24], 0xbefa4fa4
mov dword [edx + 0x68], ecx
ret
Function at 0x410084
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], 0x67452301
mov dword [edx + 0xc], 0xefcdab89
mov dword [edx + 0x10], 0x98badcfe
mov dword [edx + 0x14], 0x10325476
mov dword [edx + 0x18], 0xc3d2e1f0
ret

Function at 0x413fa4
Capabilities:
Hash data with md5

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], 0x67452301
mov dword [edx + 0xc], 0xefcdab89
mov dword [edx + 0x10], 0x98badcfe
mov dword [edx + 0x14], 0x10325476
ret

Function at 0x415c65
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
test ecx, ecx
je 0x415c7c
cmp ecx, 1
je 0x415c7c
mov eax, 0xffffff8b
ret
mov dword [edx], 0
test ecx, ecx
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
jne 0x415d0d
mov dword [edx + 0x10], 0xf3bcc908
mov dword [edx + 0x14], 0x6a09e667
mov dword [edx + 0x18], 0x84caa73b
mov dword [edx + 0x1c], 0xbb67ae85
mov dword [edx + 0x20], 0xfe94f82b
mov dword [edx + 0x24], 0x3c6ef372
mov dword [edx + 0x28], 0x5f1d36f1
mov dword [edx + 0x2c], 0xa54ff53a
mov dword [edx + 0x30], 0xade682d1
mov dword [edx + 0x34], 0x510e527f
mov dword [edx + 0x38], 0x2b3e6c1f
mov dword [edx + 0x3c], 0x9b05688c
mov dword [edx + 0x40], 0xfb41bd6b
mov dword [edx + 0x44], 0x1f83d9ab
mov dword [edx + 0x48], 0x137e2179
mov dword [edx + 0x4c], 0x5be0cd19
jmp 0x415d7d
mov dword [edx + 0x10], 0xc1059ed8
mov dword [edx + 0x14], 0xcbbb9d5d
mov dword [edx + 0x18], 0x367cd507
mov dword [edx + 0x1c], 0x629a292a
mov dword [edx + 0x20], 0x3070dd17
mov dword [edx + 0x24], 0x9159015a
mov dword [edx + 0x28], 0xf70e5939
mov dword [edx + 0x2c], 0x152fecd8
mov dword [edx + 0x30], 0xffc00b31
mov dword [edx + 0x34], 0x67332667
mov dword [edx + 0x38], 0x68581511
mov dword [edx + 0x3c], 0x8eb44a87
mov dword [edx + 0x40], 0x64f98fa7
mov dword [edx + 0x44], 0xdb0c2e0d
mov dword [edx + 0x48], 0xbefa4fa4
mov dword [edx + 0x4c], 0x47b5481d
mov dword [edx + 0xd0], ecx
xor eax, eax
ret
Function at 0x41b0b8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
push ebx
mov ebx, dword [esp + 0x40]
push esi
push edi
lea esi, [esp + 0x14]
push 0x30
push 0
lea ecx, [esp + 0x1c]
push ecx
call fcn.00459cc8
lea edx, [ebx + 0x20]
xor edi, edi
mov dword [esp + 0x18], edx
add esp, 0xc
mov edx, 0x10
lea ecx, [edx + ebx]
inc byte [ecx - 1]
jne 0x41b0f2
dec edx
test edx, edx
jne 0x41b0e5
push esi
push ebx
push 1
push dword [esp + 0x18]
call fcn.0041d7a5
add esp, 0x10
test eax, eax
mov dword [esp + 0x10], eax
jne 0x41b159
mov edx, 0x10
add esi, edx
add edi, edx
cmp edi, 0x30
jb 0x41b0e0
mov esi, dword [esp + 0x4c]
xor edx, edx
mov cl, byte [edx + esi]
xor byte [esp + edx + 0x14], cl
inc edx
cmp edx, 0x30
jb 0x41b11e
push 0x100
lea eax, [esp + 0x18]
lea esi, [ebx + 0x20]
push eax
push esi
call fcn.0041bd12
add esp, 0xc
test eax, eax
mov dword [esp + 0x10], eax
jne 0x41b159
push 0x10
lea edi, [esp + 0x38]
push edi
push ebx
call fcn.0045a4e0
add esp, 0xc
push 0x30
lea edx, [esp + 0x18]
push edx
call fcn.0041a350
add esp, 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x38
ret
Function at 0x41fcc1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0xc
push ebx
push esi
cmp byte [esp + 0x18], 0
setne al
push eax
call fcn.0041fb90
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add esp, 4
mov eax, dword [0x49de90]
mov edx, dword [0x49de94]
add eax, eax
mov ebx, dword [esp + 0xc]
rcl edx, 1
add eax, eax
mov ecx, dword [esp + 0x10]
rcl edx, 1
add eax, eax
rcl edx, 1
sub ebx, dword [0x49de80]
sbb ecx, dword [0x49de84]
cmp edx, ecx
jne 0x41fd13
cmp eax, ebx
jae 0x41fd2d
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
sub ebx, eax
sbb ecx, edx
mov dword [0x49de80], ebx
mov dword [0x49de84], ecx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub eax, dword [0x49de80]
sbb edx, dword [0x49de84]
cmp edx, dword [0x49de94]
jne 0x41fd4f
cmp eax, dword [0x49de90]
jae 0x41fd88
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub eax, dword [0x49de80]
sbb edx, dword [0x49de84]
cmp edx, dword [0x49de94]
jne 0x41fd86
cmp eax, dword [0x49de90]
jb 0x41fd51
mov edx, dword [0x49de94]
mov eax, dword [0x49de90]
add dword [0x49de80], eax
adc dword [0x49de84], edx
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4204a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x280
push ebx
push esi
push edi
mov eax, dword [esp + 0x290]
mov cl, byte [eax]
or cl, 2
lea edx, [esp + 0xc]
mov byte [esp + 0x14], cl
push edx
push 0xf003f
push 0
push 0x4723fc
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x4205ea
mov dword [esp + 0x10], 1
lea ebx, [esp + 0x10]
push ebx
lea esi, [esp + 0x19]
push esi
push 0
push 0
push 0x472418
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x4205e0
mov dword [esp + 0x10], 0x40
push ebx
lea eax, [esp + 0x1a]
push eax
push 0
push 0
push 0x472424
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x4205e0
mov dword [esp + 0x10], 5
push ebx
lea ecx, [esp + 0x5a]
push ecx
push 0
push 0
push 0x472430
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x4205e0
mov dword [esp + 0x10], 0x1d
push ebx
lea edx, [esp + 0x5f]
push edx
push 0
push 0
push 0x47243c
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x4205e0
mov dword [esp + 0x10], 0x14
push ebx
lea edi, [esp + 0x7c]
push edi
push 0
push 0
push 0x472448
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x4205e0
mov dword [esp + 0x10], 0x200
push ebx
lea ebx, [esp + 0x90]
push ebx
push 0
push 0
push 0x472454
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x4205e0
lea esi, [esp + 0x14]
mov edi, dword [esp + 0x290]
mov ecx, 0x9e
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x280
ret
Function at 0x4205f4
Capabilities:
Set registry value

Disassembly:
sub esp, 0x280
push ebx
push esi
push edi
mov eax, dword [esp + 0x290]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4723fc
and byte [eax], 0xfd
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
jne 0x4207d4
push 1
mov edx, dword [esp + 0x294]
lea ebx, [edx + 1]
push ebx
push 0
push 0
push 0x472418
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
test eax, eax
jne 0x4206f2
push 0x40
mov esi, dword [esp + 0x294]
lea eax, [esi + 2]
push eax
push 0
push 0
push 0x472424
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
test eax, eax
jne 0x4206f2
push 5
lea ecx, [esi + 0x42]
push ecx
push 0
push 0
push 0x472430
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
test eax, eax
jne 0x4206f2
push 0x1d
lea edx, [esi + 0x47]
push edx
push 0
push 0
push 0x47243c
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
test eax, eax
jne 0x4206f2
push 0x14
lea ebx, [esi + 0x64]
push ebx
push 0
push 0
push 0x472448
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
test eax, eax
jne 0x4206f2
push 0x200
lea esi, [esi + 0x78]
push esi
push 0
push 0
push 0x472454
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
lea eax, [esp + 0x14]
push eax
call fcn.004204a0
add esp, 4
mov ecx, dword [esp + 0x290]
xor ebx, ebx
mov dl, byte [ecx + 1]
cmp dl, byte [esp + 0x15]
je 0x420720
mov ebx, 1
xor edx, edx
mov edi, dword [esp + 0x290]
lea esi, [edx + edi]
mov al, byte [esi + 2]
cmp al, byte [esp + edx + 0x16]
je 0x42073a
mov ebx, 1
inc edx
cmp edx, 0x40
jb 0x420722
xor edx, edx
mov ecx, dword [esp + 0x290]
lea edi, [edx + ecx]
mov al, byte [edi + 0x42]
cmp al, byte [esp + edx + 0x56]
je 0x42075a
mov ebx, 1
inc edx
cmp edx, 5
jb 0x420742
xor edx, edx
mov esi, dword [esp + 0x290]
lea ecx, [edx + esi]
mov al, byte [ecx + 0x47]
cmp al, byte [esp + edx + 0x5b]
je 0x42077a
mov ebx, 1
inc edx
cmp edx, 0x1d
jb 0x420762
xor edx, edx
mov edi, dword [esp + 0x290]
lea esi, [edx + edi]
mov cl, byte [esi + 0x64]
cmp cl, byte [esp + edx + 0x78]
je 0x42079a
mov ebx, 1
inc edx
cmp edx, 0x14
jb 0x420782
xor edx, edx
mov eax, dword [esp + 0x290]
lea edi, [edx + eax]
mov cl, byte [edi + 0x78]
cmp cl, byte [esp + edx + 0x8c]
je 0x4207bd
mov ebx, 1
inc edx
cmp edx, 0x200
jb 0x4207a2
test bl, bl
jne 0x4207d4
mov edx, dword [esp + 0x290]
or byte [edx], 2
pop edi
pop esi
pop ebx
add esp, 0x280
ret
Function at 0x4207e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x210
push ebx
push esi
push edi
mov ecx, dword [esp + 0x220]
movzx eax, byte [ecx]
movzx edx, byte [esp + 0x224]
test edx, eax
je 0x42090e
xor edx, edx
cmp byte [ecx + 1], 2
jbe 0x420810
mov edx, 1
xor ecx, ecx
mov ebx, dword [esp + 0x220]
add ebx, ecx
mov al, byte [ebx + 0x42]
cmp al, 0x41
jb 0x420826
cmp al, 0x5a
jbe 0x420833
cmp al, 0x61
jb 0x42082e
cmp al, 0x7a
jbe 0x420833
mov edx, 1
inc ecx
cmp ecx, 5
jb 0x420812
mov esi, dword [esp + 0x220]
test byte [esi + 0x63], 0xe0
je 0x42084b
mov edx, 1
mov ecx, dword [esp + 0x220]
test byte [ecx + 0x77], 0xf0
je 0x42085d
mov edx, 1
mov edi, dword [esp + 0x220]
cmp byte [edi + 1], 0
jne 0x4208f8
mov byte [esp + 0x218], dl
lea edx, [edi + 0x78]
push 0x200
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0045a4e0
lea ecx, [edi + 2]
push 0
push 0x200
lea ebx, [esp + 0x2c]
push ebx
push 0
push 0
push ecx
push ecx
call fcn.0041f7f8
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
add esp, 0x28
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + ecx*8 + 0x18]
mov edx, dword [esp + ecx*8 + 0x1c]
xor eax, 0x37373737
or dword [esp + 0xc], eax
xor edx, 0x37373737
inc ecx
or dword [esp + 0x10], edx
cmp ecx, 0x40
jb 0x4208c1
mov esi, dword [esp + 0x10]
mov dl, byte [esp + 0x218]
or esi, dword [esp + 0xc]
je 0x4208f8
mov edx, 1
test dl, dl
je 0x42090e
mov bl, byte [esp + 0x224]
mov edi, dword [esp + 0x220]
not bl
and byte [edi], bl
pop edi
pop esi
pop ebx
add esp, 0x210
ret
Function at 0x425470
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0x28]
cmp esi, 4
push edi
mov edi, dword [esp + 0x20]
jb 0x4254d6
push 4
mov ecx, dword [esp + 0x28]
lea edx, [ebx + ecx]
push edx
lea ecx, [esp + 0x18]
push ecx
call fcn.0045a4e0
push 4
mov edx, dword [esp + 0x38]
lea ecx, [ebx + edx]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.0045a4e0
mov ecx, dword [esp + 0x2c]
xor ecx, dword [esp + 0x28]
mov dword [esp + 0x30], ecx
lea ecx, [ebx + edi]
push 4
lea edx, [esp + 0x34]
push edx
push ecx
call fcn.0045a4e0
add ebx, 4
add esp, 0x24
lea edx, [ebx + 4]
cmp esi, edx
jae 0x425485
mov eax, dword [esp + 0x24]
cmp ebx, esi
jae 0x4254f0
mov edx, dword [esp + 0x28]
mov cl, byte [ebx + eax]
xor cl, byte [ebx + edx]
mov byte [ebx + edi], cl
inc ebx
cmp ebx, esi
jb 0x4254de
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x44b594
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
xor eax, eax
push 0x44b620
push edx
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov dword [ebp - 0x18], ecx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
lea ecx, [ecx + 0x20]
call fcn.004338f0
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x18]
xor edx, edx
mov dword [ebx + 0x24], edx
lea ecx, [ebx + 0x48]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
call fcn.0042e8f8
mov dword [ebp - 4], 1
mov eax, ebx
mov dword [ebx], 0x482e28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4584bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x58]
push ebx
push ebp
push esi
mov esi, ecx
mov edx, dword [esi + 0x50]
push edi
mov dword [esi + 0x54], eax
cmp edx, dword [esi + 0x4c]
jbe 0x458500
mov edi, dword [esi + 0x50]
mov ebx, dword [esi + 0x4c]
mov ebp, dword [esi + 0x44]
cmp edi, ebx
jne 0x4584e4
mov edx, ebp
jmp 0x4584fb
mov edx, edi
sub edx, ebx
push edx
push ebx
push ebp
call fcn.0045a4e0
mov ecx, edi
mov edx, eax
sub ecx, ebx
add esp, 0xc
add edx, ecx
mov dword [esi + 0x50], edx
jmp 0x458506
mov ebx, dword [esi + 0x44]
mov dword [esi + 0x50], ebx
lea eax, [esi + 0x58]
lea ebp, [esi + 0x24]
mov dword [esp + 0x28], eax
mov edx, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
sub edx, ecx
push edx
push ecx
mov ecx, ebp
call fcn.00458bc0
mov ebx, eax
test eax, eax
jg 0x458534
pop edi
mov eax, 0xffffffff
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
add dword [esi + 0x50], ebx
mov edi, dword [esi + 0x70]
mov edx, dword [esp + 0x28]
mov ecx, dword [edx]
mov dword [esp + 0x24], ecx
lea edx, [esp + 0x20]
push edx
push dword [esi + 0x40]
push dword [esi + 0x3c]
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
push dword [esi + 0x50]
push dword [esi + 0x44]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [edi]
call dword [edx + 8]
cmp eax, 3
jne 0x458575
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ebx, 2
cmp eax, ebx
je 0x4585c4
mov eax, dword [esi + 0x3c]
cmp eax, dword [esp + 0x20]
je 0x458590
mov edi, dword [esi + 0x44]
cmp edi, dword [esp + 0x1c]
je 0x4585c4
cmp byte [esi + 0x34], 0
je 0x4585b2
mov ecx, dword [esp + 0x20]
sub ecx, eax
test ecx, ecx
jns 0x4585a1
inc ecx
sar ecx, 1
imul ecx, dword [esi + 0x74]
mov edx, dword [esp + 0x1c]
sub edx, dword [esi + 0x44]
cmp ecx, edx
jne 0x4585c4
cmp eax, dword [esp + 0x20]
jne 0x4585d3
mov ebx, dword [esp + 0x1c]
sub ebx, dword [esi + 0x44]
cmp ebx, dword [esi + 0x78]
jl 0x4585d3
mov ecx, esi
call fcn.0045849c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
cmp eax, dword [esp + 0x20]
je 0x458510
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x4c], edi
mov edx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov ebx, dword [esp + 0x18]
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov ax, word [eax]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x4589c4
Capabilities:
Get file size

Disassembly:
push eax
push eax
lea eax, [esp + 4]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x4589eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4589eb
xor eax, eax
jmp 0x4589ee
mov eax, dword [esp]
add esp, 8
ret