joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0849
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x541638]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4c088c
cmp word [esi], dx
jne 0x4c088c
or byte [edi + eax + 0x28], 4
jmp 0x4c0891
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4c09ca
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4c09aa
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4c08d3
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4c0909
cmp eax, edx
jae 0x4c0915
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4c08ab
jmp 0x4c09ca
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c09a6
cmp dword [ebp - 0x14], 0
je 0x4c09a6
mov eax, dword [ebx*4 + 0x541638]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4c097e
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x4c09c4
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x541638]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x541638]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x541638]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x4c09c7
pop ebx
cmp word [ebp - 4], bx
jne 0x4c098f
cmp esi, dword [ebp + 0xc]
jne 0x4c098f
mov word [esi], bx
jmp 0x4c09c7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004c2c4e
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4c09ca
push 0xd
jmp 0x4c09c3
mov ecx, dword [ebx*4 + 0x541638]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4c09c1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4c09ca
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4c11eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c105c
Function at 0x4c363b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c3162

Function at 0x4c3e63
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4c3f00
push ebx
push esi
call fcn.004c3e2c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004bcce2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4c3ead
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4c3eff
push edi
push eax
call fcn.004ba8cf
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4c3ecd
call fcn.004b9d92
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4c3efe
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004bcce2
add esp, 0x20
test eax, eax
jne 0x4c3eec
push edi
call fcn.004b9d92
jmp 0x4c3ef4
push ebx
call fcn.004b9d92
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4c3f03
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4c3f14
pop esi
ret
push ebx
push edi
push esi
call fcn.004c3e2c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004ba8cf
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4c3f3c
push ebx
push esi
push edi
call fcn.004a77d0
add esp, 0xc
push 0
call fcn.004b9d92
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4ced15
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004cec91
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4cee8d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4cee8d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4cee3c
jg 0x4ced6e
test eax, eax
je 0x4cee32
push 1
push 0x1000
call fcn.004b9d35
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4ced94
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4cee29
push 0x8000
push ebx
call fcn.004b9aa3
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4cedc0
jg 0x4cedbb
cmp ecx, 0x1000
jb 0x4cedc0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004c2847
add esp, 0x10
cmp eax, 0xffffffff
je 0x4cee05
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4cedbb
jl 0x4cedec
test ecx, ecx
jne 0x4cedad
push dword [ebp - 0xc]
push ebx
call fcn.004b9aa3
push esi
call fcn.004b9d92
add esp, 0xc
xor edi, edi
jmp 0x4cee9e
cmp byte [edi + 0x24], 0
je 0x4cee1c
cmp dword [edi + 0x20], 5
jne 0x4cee1c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4cee27
mov edi, dword [edi + 0x18]
jmp 0x4cee29
xor edi, edi
push esi
call fcn.004b9d92
pop ecx
jmp 0x4cee9e
test ecx, ecx
jg 0x4cedfe
jl 0x4cee3c
test eax, eax
jae 0x4cedfe
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c2c4e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4cee5f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4cedfe
jmp 0x4cee96
push ebx
call fcn.004b559e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4cedfe
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4cee9e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4cee9b
mov edi, dword [edi + 0x18]
jmp 0x4cee9e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004c2c4e
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4cf3f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4cf41d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4cf41d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4095a1
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x425ab0
call fcn.00409ea0
mov edi, 0x94
mov eax, edi
call fcn.004093e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x424084]
mov ecx, dword [esi + 0x10]
mov dword [0x435d38], ecx
mov eax, dword [esi + 4]
mov dword [0x435d44], eax
mov edx, dword [esi + 8]
mov dword [0x435d48], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x435d3c], esi
cmp ecx, 2
je 0x409601
or esi, 0x8000
mov dword [0x435d3c], esi
shl eax, 8
add eax, edx
mov dword [0x435d40], eax
xor edi, edi
push edi
call dword [0x424080]
cmp word [eax], 0x5a4d
jne 0x40963a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40963a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x409652
cmp eax, 0x20b
je 0x40963f
mov dword [ebp - 0x1c], edi
jmp 0x409666
cmp dword [ecx + 0x84], 0xe
jbe 0x40963a
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x409660
cmp dword [ecx + 0x74], 0xe
jbe 0x40963a
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040e448
pop ecx
test eax, eax
jne 0x40967a
push 0x1c
call fcn.0040957d
pop ecx
call fcn.0040b51c
test eax, eax
jne 0x40968b
push 0x10
call fcn.0040957d
pop ecx
call fcn.0040f93c
mov dword [ebp - 4], edi
call fcn.0040f73e
test eax, eax
jge 0x4096a4
push 0x1b
call fcn.00409558
pop ecx
call dword [0x42424c]
mov dword [0x437754], eax
call fcn.0040f61c
mov dword [0x435d24], eax
call fcn.0040f57a
test eax, eax
jge 0x4096ca
push 8
call fcn.00409558
pop ecx
call fcn.0040f347
test eax, eax
jge 0x4096db
push 9
call fcn.00409558
pop ecx
push 1
call fcn.0040a914
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x4096f1
push eax
call fcn.00409558
pop ecx
mov eax, dword [0x435d58]
mov dword [0x435d5c], eax
push eax
push dword [0x435d50]
push dword [0x435d4c]
call fcn.00406560
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x409720
push esi
call fcn.0040aa41
call fcn.0040aa63
jmp 0x409752
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.00409edb
ret
Function at 0x40f9df
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40fa0d
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x40fa14
cmp ebx, dword [eax + 4]
jae 0x40fa14
xor eax, eax
jmp 0x40fc04
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40fa25
xor eax, eax
inc eax
jmp 0x40fc03
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40fa3b
cmp ecx, edx
jae 0x40fb80
cmp dword [eax + 4], 0
je 0x40fa44
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40fa2c
cmp dword [ebp + 8], 0
je 0x40fa66
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40fb80
cmp eax, esi
jae 0x40fb80
mov eax, dword [0x4360f8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40fa8b
cmp dword [esi*4 + 0x436100], edi
je 0x40fb84
inc esi
cmp esi, eax
jl 0x40fa79
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4240c4]
test eax, eax
je 0x40fc00
cmp dword [ebp - 8], 0x1000000
jne 0x40fc00
test byte [ebp - 0xc], 0xcc
je 0x40fb09
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40fc00
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40fc00
cmp word [eax + 0x18], 0x10b
jne 0x40fc00
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40fc00
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40fb09
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40fb09
test byte [ecx + 0x27], 0x80
jne 0x40fb80
push 1
push 0x436140
call dword [0x42421c]
test eax, eax
jne 0x40fa1d
mov ecx, dword [0x4360f8]
test ecx, ecx
mov edx, ecx
jle 0x40fb3d
lea eax, [ecx*4 + 0x4360fc]
cmp dword [eax], edi
je 0x40fb3d
dec edx
sub eax, 4
test edx, edx
jg 0x40fb31
test edx, edx
jne 0x40fb6e
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40fb4a
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40fb62
lea eax, [edx*4 + 0x436100]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40fb50
cmp ecx, 0x10
jge 0x40fb6e
inc ecx
mov dword [0x4360f8], ecx
push 0
push 0x436140
call dword [0x42421c]
jmp 0x40fa1d
xor eax, eax
jmp 0x40fc03
test esi, esi
jle 0x40fa1d
mov ebx, dword [0x42421c]
push 1
push 0x436140
call ebx
test eax, eax
jne 0x40fa1d
cmp dword [esi*4 + 0x436100], edi
je 0x40fbda
mov eax, dword [0x4360f8]
lea esi, [eax - 1]
test esi, esi
jl 0x40fbc8
cmp dword [esi*4 + 0x436100], edi
je 0x40fbc4
dec esi
jns 0x40fbb8
test esi, esi
jge 0x40fbd8
cmp eax, 0x10
jge 0x40fbd3
inc eax
mov dword [0x4360f8], eax
lea esi, [eax - 1]
jmp 0x40fbda
je 0x40fbf2
xor ecx, ecx
test esi, esi
jl 0x40fbf2
lea eax, [ecx*4 + 0x436100]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x40fbe0
push 0
push 0x436140
call ebx
jmp 0x40fa1d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417810
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x620072
mov word [ebp - 0x1c], ax
push esi
mov esi, ecx
mov dword [ebp - 0x30], 0x680006
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2e]
xor eax, ecx
mov dword [ebp - 0x28], 0x6a006a
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0x2c]
xor eax, ecx
mov dword [ebp - 0x24], 0x620028
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x2a]
xor eax, ecx
mov dword [ebp - 0x20], 0x6a006a
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 0x28]
xor eax, ecx
mov dword [esi], 0
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x26]
xor eax, ecx
mov dword [esi + 4], 0
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x24]
xor eax, ecx
mov dword [esi + 8], 0
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0x22]
xor eax, ecx
mov dword [esi + 0xc], 0
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x20]
xor eax, ecx
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x1e]
xor eax, ecx
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x1a]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x4179db
movaps xmm0, xmmword [0x50c930]
xor eax, eax
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x21290120
mov dword [ebp - 0x20], 0x353e23
mov cl, byte [ebp + eax - 0x33]
xor cl, byte [ebp - 0x34]
mov byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 0x16
jb 0x4178f2
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x1c]
push eax
push edx
mov byte [ebp - 6], 0
call edi
mov dword [esi + 4], eax
mov cl, 0x29
mov al, 1
mov dword [ebp - 0x1c], 0x3f29014d
mov bl, al
mov dword [ebp - 0x18], 0x292c2201
xor al, byte [ebp - 0x1c]
mov dh, cl
xor cl, byte [ebp - 0x1c]
mov bh, 9
mov byte [ebp - 0x35], bh
mov ah, 0x22
mov byte [ebp - 0x10], al
mov bh, 0x21
mov byte [ebp - 0x36], bh
mov dl, 0x3f
mov al, byte [ebp - 0x36]
mov ch, 0x2c
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x1c]
xor al, cl
mov byte [ebp - 0x37], bh
mov bh, byte [ebp - 0x35]
xor ah, cl
mov byte [ebp - 8], al
xor dl, cl
mov al, byte [ebp - 0x37]
xor bl, cl
xor al, cl
mov byte [ebp - 0xc], ah
mov byte [ebp - 7], al
xor ch, cl
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0x212109
push eax
push dword [esi]
xor dh, cl
mov byte [ebp - 0xe], dl
xor bh, cl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xb], ch
mov byte [ebp - 0xa], dh
mov byte [ebp - 9], bh
mov byte [ebp - 6], 0
call edi
mov dword [esi + 8], eax
mov dl, 0x26
mov dword [ebp - 0x20], 0x72517c26
xor ecx, ecx
mov dword [ebp - 0x1c], 0x67525543
mov dword [ebp - 0x18], 0x5254434a
mov byte [ebp - 0x14], 0
mov al, byte [ebp + ecx - 0x1f]
xor al, dl
mov byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xb
jae 0x4179ca
mov dl, byte [ebp - 0x20]
jmp 0x4179b5
lea eax, [ebp - 0x13]
mov byte [ebp - 8], 0
push eax
push dword [esi]
call edi
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a0525
mov esp, ebp
pop ebp
ret
Function at 0x42ea80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x52e990]
test eax, eax
je 0x42eaa7
mov ecx, dword [0x52e97c]
test ecx, ecx
jne 0x42ebe2
xor eax, eax
mov dword [ebp - 0x2c], 0x50015
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x30], 0xf0061
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2e]
xor eax, ecx
mov dword [ebp - 0x28], 0xd000d
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0x2c]
xor eax, ecx
mov dword [ebp - 0x24], 0x5004f
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x2a]
xor eax, ecx
mov dword [ebp - 0x20], 0xd000d
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 0x28]
xor eax, ecx
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x26]
xor eax, ecx
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x24]
xor eax, ecx
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0x22]
xor eax, ecx
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x20]
xor eax, ecx
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x1e]
xor eax, ecx
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x1a]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov dword [ebp - 0x1e], 0
movups xmmword [ebp - 0x2e], xmm0
mov edi, eax
mov dword [ebp - 0x50], 0x1013600
movaps xmm0, xmmword [0x50c860]
xor ecx, ecx
movups xmmword [ebp - 0x60], xmm0
mov word [ebp - 0x4c], 0x11c
mov byte [ebp - 0x4a], 0
mov al, byte [ebp + ecx - 0x5f]
xor al, byte [ebp - 0x60]
mov byte [ebp + ecx - 0x49], al
inc ecx
cmp ecx, 0x15
jb 0x42eb63
lea eax, [ebp - 0x49]
mov byte [ebp - 0x34], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmm0, xmmword [0x50cb90]
mov dword [0x52e990], eax
xor eax, eax
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x50], 0x322f2f18
mov word [ebp - 0x4c], 0x2f
mov cl, byte [ebp + eax - 0x5f]
xor cl, byte [ebp - 0x60]
mov byte [ebp + eax - 0x4a], cl
inc eax
cmp eax, 0x14
jb 0x42eba2
lea eax, [ebp - 0x4a]
mov byte [ebp - 0x36], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [ebp - 0x4f], 0
mov eax, dword [0x52e990]
xorps xmm0, xmm0
mov dword [0x52e97c], ecx
movups xmmword [ebp - 0x5f], xmm0
mov byte [ebp - 0x4b], 0
pop edi
test eax, eax
je 0x42ebf6
test ecx, ecx
je 0x42ebf6
push dword [ebp + 8]
call eax
push eax
call dword [0x52e97c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a0525
mov esp, ebp
pop ebp
ret
Function at 0x42ecf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x52610c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
mov esi, dword [0x52e9a0]
mov ebx, ecx
mov ecx, dword [0x52e9a4]
push edi
mov edi, edx
test esi, esi
jne 0x42ed83
test ecx, ecx
jne 0x42ed83
movaps xmm0, xmmword [0x50cb50]
xor eax, eax
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0x7951707d
mov dword [esp + 0x34], 0x656e7371
mov byte [esp + 0x38], cl
mov cl, byte [esp + eax + 0x21]
xor cl, byte [esp + 0x20]
mov byte [esp + eax + 0x39], cl
inc eax
cmp eax, 0x17
jb 0x42ed41
mov byte [esp + 0x50], 0
call fcn.0042e5a0
push edx
push eax
lea ecx, [esp + 0x41]
call fcn.0042ec10
mov esi, eax
add esp, 8
mov dword [0x52e9a0], esi
mov ecx, edx
mov dword [0x52e9a4], ecx
test esi, esi
jne 0x42ed83
test ecx, ecx
je 0x42edf3
push 0
push dword [ebp + 0x14]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], edi
push 0
push 0x3000
cdq
xorps xmm0, xmm0
push edx
push eax
push 0
push 0
lea eax, [esp + 0x30]
movlpd qword [esp + 0x30], xmm0
cdq
push edx
push eax
mov eax, ebx
mov dword [esp + 0x44], 0
cdq
push edx
push eax
push 6
push ecx
push esi
call fcn.0042dce0
add esp, 0x3c
test eax, eax
jne 0x42ede9
test edx, edx
jne 0x42ede9
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004a0525
mov esp, ebp
pop ebp
ret
push edx
push eax
call fcn.0042ea80
add esp, 8
mov ecx, dword [esp + 0x54]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
xor edx, edx
call fcn.004a0525
mov esp, ebp
pop ebp
ret

Function at 0x42ee10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x52e9a8]
mov ebx, ecx
mov ecx, dword [0x52e9ac]
push edi
mov edi, edx
test esi, esi
jne 0x42ee91
test ecx, ecx
jne 0x42ee91
movaps xmm0, xmmword [0x50cbc0]
xor eax, eax
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x6f64797b
mov byte [ebp - 0x1c], cl
mov cl, byte [ebp + eax - 0x2f]
xor cl, byte [ebp - 0x30]
mov byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0x13
jb 0x42ee52
mov byte [ebp - 8], 0
call fcn.0042e5a0
push edx
push eax
lea ecx, [ebp - 0x1b]
call fcn.0042ec10
mov esi, eax
add esp, 8
mov dword [0x52e9a8], esi
mov ecx, edx
mov dword [0x52e9ac], ecx
test esi, esi
jne 0x42ee91
test ecx, ecx
je 0x42eef1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x38]
push 0x3000
cdq
push edx
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], edi
cdq
push edx
push eax
mov eax, ebx
mov dword [ebp - 0x34], 0
cdq
push edx
push eax
push 4
push ecx
push esi
call fcn.0042dce0
add esp, 0x2c
test eax, eax
jne 0x42eee7
test edx, edx
jne 0x42eee7
lea eax, [edx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a0525
mov esp, ebp
pop ebp
ret
push edx
push eax
call fcn.0042ea80
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a0525
mov esp, ebp
pop ebp
ret
Function at 0x42ef10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x52610c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, dword [0x52e988]
mov ebx, edx
push edi
mov edi, ecx
mov ecx, dword [0x52e98c]
test esi, esi
jne 0x42efa2
test ecx, ecx
jne 0x42efa2
movaps xmm0, xmmword [0x50cad0]
xor eax, eax
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0x65787a72
mov word [esp + 0x2c], 0x6e
nop dword [eax]
mov cl, byte [esp + eax + 0x19]
xor cl, byte [esp + 0x18]
mov byte [esp + eax + 0x2e], cl
inc eax
cmp eax, 0x14
jb 0x42ef60
mov byte [esp + 0x42], 0
call fcn.0042e5a0
push edx
push eax
lea ecx, [esp + 0x36]
call fcn.0042ec10
mov esi, eax
add esp, 8
mov dword [0x52e988], esi
mov ecx, edx
mov dword [0x52e98c], ecx
test esi, esi
jne 0x42efa2
test ecx, ecx
je 0x42effa
lea eax, [esp + 0x10]
xorps xmm0, xmm0
cdq
push edx
push eax
push 0
push dword [ebp + 0x10]
mov eax, ebx
movlpd qword [esp + 0x20], xmm0
cdq
push edx
push eax
push dword [ebp + 0xc]
mov eax, edi
push dword [ebp + 8]
cdq
push edx
push eax
push 5
push ecx
push esi
call fcn.0042dce0
add esp, 0x34
test eax, eax
jne 0x42eff0
test edx, edx
jne 0x42eff0
lea eax, [edx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004a0525
mov esp, ebp
pop ebp
ret
push edx
push eax
call fcn.0042ea80
add esp, 8
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a0525
mov esp, ebp
pop ebp
ret

Function at 0x42f090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov ecx, 0x7fed7fed
push edi
mov edi, 0xeeeeeeee
cmp dword [ebp + 0x10], ebx
jbe 0x42f0e9
mov edx, dword [ebp + 8]
shl edx, 8
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0x500
push esi
mov eax, dword [ebp + 0xc]
add ecx, edi
mov al, byte [ebx + eax]
inc ebx
movsx esi, al
lea eax, [esi + edx]
cdq
idiv dword [ebp - 4]
mov eax, edi
shl eax, 5
add eax, esi
add eax, edi
xor ecx, dword [edx*4 + 0x502798]
mov edx, dword [ebp + 8]
lea edi, [ecx + 3]
add edi, eax
cmp ebx, dword [ebp + 0x10]
jb 0x42f0b8
pop esi
pop edi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc