joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55b530
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x55f8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x55b4b0
push 0
push 0
call fcn.0053d041
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x55b59b
lea ecx, [esp + 0x10]
call fcn.0053d369
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.0043bc70
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x55b5c1
cmp eax, 0xffffffff
je 0x55b5c1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x55c170
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
test ebx, ebx
jne 0x55c1a8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0053c15d
add esp, 0x20c
ret
push esi
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00544310
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x55c273
mov ecx, ebx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x55c1e0
sub ecx, esi
sar ecx, 1
mov edx, 0x103
sub edx, ecx
cmp eax, edx
jae 0x55c273
push edi
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x55c202
mov eax, dword [0x58a630]
mov dword [edi], eax
mov eax, ebx
mov edx, ebx
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x55c220
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x55c234
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0053c15d
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0053c15d
add esp, 0x20c
ret
Function at 0x55c8f0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.005563f0
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x55ca5b
cmp dword [esp + 0x2c20], edi
je 0x55ca5b
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.004d0d60
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x55ca34
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.00544310
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x55ca27
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.00544310
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.0055e200
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.00421260
test eax, eax
jne 0x55ca27
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], edi
jne 0x55ca3e
inc ebx
cmp ebx, 0x10
jl 0x55c940
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.0053c15d
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0053c15d
add esp, 0x2c14
ret
Function at 0x55cd00
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x55cf01
cmp dword [esp + 0x2f8], 0
je 0x55cf01
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00544310
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push 0x57f500
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x55cec8
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x55cebb
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x55ce89
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x55ce7e
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.00544310
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.0055cbf0
add esp, 0x14
test eax, eax
je 0x55ce7e
cmp byte [esp + 0x24], 0
je 0x55ce42
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x55ce7e
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x55ce71
mov cl, byte [esi + eax]
test cl, cl
je 0x55ce71
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x55ce56
jmp 0x55ce75
test edx, edx
jne 0x55ce76
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x55cda0
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x55cf01
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.00421260
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.0053c15d
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0053c15d
add esp, 0x2ec
ret
Function at 0x55d2a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x55d41d
cmp ebp, 0x20
jb 0x55d41d
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.00544310
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x58b364
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x55d41d
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x55d330
sub eax, edx
cmp eax, 0x40
jne 0x55d41d
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x55d36e
mov cl, byte [esi + eax]
test cl, cl
je 0x55d36e
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x55d356
jmp 0x55d372
test edx, edx
jne 0x55d373
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x55d3ab
mov cl, byte [edx + eax]
test cl, cl
je 0x55d3ab
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x55d390
jmp 0x55d3af
test esi, esi
jne 0x55d3b0
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.00544310
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.0055c370
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x55d41d
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.00421260
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.0053c15d
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0053c15d
add esp, 0x50c
ret
Function at 0x55d440
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x290
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00544310
push 0x80
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.0055c370
lea eax, [esp + 0x1a0]
mov edx, edi
mov ecx, eax
add esp, 0x10
mov esi, 0x104
sub edx, ecx
lea esp, [esp]
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x55d4ab
mov cl, byte [edx + eax]
test cl, cl
je 0x55d4ab
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x55d490
jmp 0x55d4af
test esi, esi
jne 0x55d4b0
dec eax
lea edx, [esp + 0x10]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x198]
push eax
call fcn.0055c2e0
push 0xff
lea ecx, [esp + 0x95]
push 0
push ecx
mov dword [esp + 0x18], 1
mov byte [esp + 0x9c], 0
call fcn.00544310
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x58b364
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x100
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x55d58b
mov ecx, edi
lea eax, [esp + 0x90]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x55d553
test dl, dl
je 0x55d54f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x55d553
add eax, 2
add ecx, 2
test dl, dl
jne 0x55d533
xor eax, eax
jmp 0x55d558
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x55d58b
lea eax, [esp + 0x90]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x55d566
sub eax, edx
push eax
lea edx, [esp + 0x94]
push edx
push 1
push str.mid_old
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x55d595
sub eax, edx
push eax
lea eax, [esp + 0x194]
push eax
push 1
push 0x58b364
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x294]
pop esi
pop ebx
xor ecx, esp
call fcn.0053c15d
add esp, 0x290
ret

Function at 0x567a35
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x4258356b
mov esi, 0x5f5e100
mov dword [ebp - 0x18], 0x34727175
push esi
push ebx
mov dword [ebp - 0x14], 0x73424066
mov dword [ebp - 0x10], 0x484e5472
mov dword [ebp - 0xc], 0x6a4b7556
mov word [ebp - 8], 0x6f6b
mov byte [ebp - 6], bl
mov dword [ebp - 4], ecx
call eax
mov edi, eax
mov ecx, ebx
mov byte [ecx + edi], cl
inc ecx
cmp ecx, esi
jb 0x567a87
movzx eax, byte [edi + 0x64]
imul esi, eax, 0xa
add esi, 0x562f3c
xor edx, edx
mov eax, ebx
push 0x17
pop ecx
div ecx
mov al, byte [ebp + edx - 0x1c]
xor byte [ebx + 0x563324], al
inc ebx
cmp ebx, 0x7d0
jb 0x567a9c
push edi
call dword [ebp - 4]
push resource.7
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x567a52
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x4258356b
mov esi, 0x5f5e100
mov dword [ebp - 0x18], 0x34727175
push esi
push ebx
mov dword [ebp - 0x14], 0x73424066
mov dword [ebp - 0x10], 0x484e5472
mov dword [ebp - 0xc], 0x6a4b7556
mov word [ebp - 8], 0x6f6b
mov byte [ebp - 6], bl
mov dword [ebp - 4], ecx
call eax
mov edi, eax
mov ecx, ebx
mov byte [ecx + edi], cl
inc ecx
cmp ecx, esi
jb 0x567a87
movzx eax, byte [edi + 0x64]
imul esi, eax, 0xa
add esi, 0x562f3c
xor edx, edx
mov eax, ebx
push 0x17
pop ecx
div ecx
mov al, byte [ebp + edx - 0x1c]
xor byte [ebx + 0x563324], al
inc ebx
cmp ebx, 0x7d0
jb 0x567a9c
push edi
call dword [ebp - 4]
push resource.7
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x567a78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x4258356b
mov esi, 0x5f5e100
mov dword [ebp - 0x18], 0x34727175
push esi
push ebx
mov dword [ebp - 0x14], 0x73424066
mov dword [ebp - 0x10], 0x484e5472
mov dword [ebp - 0xc], 0x6a4b7556
mov word [ebp - 8], 0x6f6b
mov byte [ebp - 6], bl
mov dword [ebp - 4], ecx
call eax
mov edi, eax
mov ecx, ebx
mov byte [ecx + edi], cl
inc ecx
cmp ecx, esi
jb 0x567a87
movzx eax, byte [edi + 0x64]
imul esi, eax, 0xa
add esi, 0x562f3c
xor edx, edx
mov eax, ebx
push 0x17
pop ecx
div ecx
mov al, byte [ebp + edx - 0x1c]
xor byte [ebx + 0x563324], al
inc ebx
cmp ebx, 0x7d0
jb 0x567a9c
push edi
call dword [ebp - 4]
push resource.7
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100137df
Capabilities:
Generate random numbers via winapi

Disassembly:
call fcn.100b0a27
sub byte [eax], al
add byte [eax - 0x64846fe], al
sub esp, dword [ebx + 0x14]
xchg esp, eax
or esi, dword [ebp + 0xd508a03]
sbb eax, 0x6e64b0a0
dec ebx
jae 0x1001385c
dec edi
lds esi, [edx - 0x7b1f398d]
out dx, al
out dx, eax
ljmp 0xfdb3
mov ebp, esp
push esi
xor esi, esi
cmp dword [0x10120740], 1
je 0x10013871
mov esi, 0x8000ffff
jmp 0x10013899
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [0x10120730]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x100138be
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.100ae1cc
mov esi, eax
test esi, esi
jge 0x100138be
mov eax, dword [0x1011faf4]
cmp eax, 0x1011faf4
je 0x100138be
test byte [eax + 0x3c], 2
je 0x100138be
push esi
push 0x100034d8
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.100ae1cc
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x100ae1cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100ae1db
pop dword [ebp - 0x10]
mov eax, 0x7d2ac212
sub eax, 0x6d1fe037
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x59772
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xb5fd381d
add ecx, 0x4a031569
xor edx, edx
add edx, eax
mov esi, 0x9aadf1f9
add esi, 0x75658607
add esi, dword [ebp - 0x10]
mov ebx, 0xe82d3c7b
add ebx, 0xda0eedff
xor dword [ebp - 0xc], 0xb952ec1b
mov edi, dword [esi]
add dword [ebp - 0xc], 0x1854aa2e
xor edi, ebx
add dword [ebp - 4], esi
mov dword [edx], edi
mov dword [ebp - 0xc], 0x1197bc39
add edx, 0xbc1f232b
sub edx, 0xbc1f2327
add esi, 0x4727218
add esi, 0xfb8d8dec
loop 0x100ae237
add eax, 0x128eb
xor ebx, ebx
add ebx, eax
add eax, 0x9d106976
add eax, 0x62ef968f
mov ecx, 0xa42abb5c
sub ecx, 0x942abb5c
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x438ca5
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
or ecx, ecx
call fcn.00438ce9
inc ecx
and ecx, edx
add edx, 0x4417fa89
xor dword [edi], ebx
sub esp, 4
mov dword [esp], 0xdd52c933
mov edx, dword [esp]
add esp, 4
inc edx
and edx, edx
add edi, 1
mov edx, ecx
dec ecx
add edx, edx
cmp edi, esi
jne fcn.00438ca5
and edx, ecx
dec edx
mov ecx, 0x8484e63e
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1002aaee
pop dword [ebp - 0x40]
mov eax, 0x1002aaee
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x4053e733
sub dword [ebp - 0x50], 0xf201a1e8
mov dword [ebp - 0x4c], 0x48fadb86
add dword [ebp - 0x4c], 0xe93870bf
mov dword [ebp - 0x48], 0x8b0756d
add dword [ebp - 0x48], 0x439bcec1
mov dword [ebp - 0x44], 0x6889bf92
sub dword [ebp - 0x44], 0x6889bf92
lea eax, [ebp - 0x50]
push eax
mov eax, 0xf37aed1b
sub eax, 0xe3782ce3
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf6bc83d0
add dword [ebp - 0x50], 0x7db5e586
mov dword [ebp - 0x4c], 0xd7439b4c
add dword [ebp - 0x4c], 0x6a28c629
mov dword [ebp - 0x48], 0x643f9cc0
add dword [ebp - 0x48], 0xff2fcfac
mov dword [ebp - 0x44], 0x7c8e30c7
sub dword [ebp - 0x44], 0x7c8e30c7
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x9cb30eaf
add eax, 0x734fb179
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x37bb0
push 0
call eax
mov ecx, 0xc159f55e
sub ecx, 0xc159a851
mov ebx, eax
mov edi, 0x75e57bf8
sub edi, 0x65e1e5f8
add edi, dword [ebp - 0x40]
mov edx, 0x623e2892
add edx, 0x6b4e184e
xor dword [ebp - 0x34], 0x8a8091ef
mov esi, dword [edi]
sub dword [ebp - 0x38], edi
add esi, edx
sub dword [ebp - 4], esi
mov dword [ebx], esi
mov dword [ebp - 8], 0xf3281721
add ebx, 0x911c0a0b
sub ebx, 0x911c0a07
add edi, 4
loop 0x1002ac0b
add eax, 0xaa91b2f8
sub eax, 0xaa908bf1
mov ebx, eax
add eax, 0xbe890783
add eax, 0x4176f882
mov ecx, 0xbc22d008
add ecx, 0x53dd2ff8
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x42c570
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
jo 0x42c5c2
retf 0x5379
xchg ecx, eax
stc
push edi
adc dx, word [ecx]
pop edx
pop edi
adc esi, dword [edx]
div dl
xchg esp, eax
invalid
xchg ecx, eax
rcr dword [edx], 0xde
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
xchg byte [eax], bh
in eax, dx
mov byte [ebp + 0x77], al
and esp, edx
xchg ebp, esp
mov byte [esi - 0x3d], ch
jb 0x42c576
retf 0x67bc

Function at 0x42f670
Capabilities:
Encode data using xor

Disassembly:
inc edi
lds esp, [eax]
push ds
inc byte [bx + si - 0x5a]
dec esp
inc edi
stosb byte es:[edi], al
mov esp, ecx
dec ecx
scasb al, byte es:[edi]
dec edx
add dl, byte ds:[ebx - 0x2732ed15]
adc al, ch
push edi
adc byte [eax - 0x6f68d3b8], cl
std
ja 0x42f68a
lds eax, [esp + edx + 0x48]
out dx, al
wait
or eax, 0xf347932b
pop esi
or dword [edi], ebx
mov ch, 0x84
loop 0x42f6b5
sahf
stc
jno 0x42f666
lds edi, [esi + 0x1fb568]
shr edx, 1
mov dl, 0x89
invalid
fnstcw word [ecx]
arpl dx, di
sbb eax, 0x28c4bec0
mov dl, 0x2e
inc edi
mov byte [0x451c0cfc], al
insb byte es:[edi], dx
idiv byte [ebx]
test eax, 0xe88013f2
pop ecx
ja 0x7ba21c9e
adc eax, dword [eax - 0x78f0a618]
leave
and eax, 0x3c457b5f
adc eax, 0xa7994557
inc ebp
cmp al, 0x15
push edi
inc ebp
cdq
cmpsd dword [esi], dword es:[edi]
pop dword [ebx]
inc edi
push ebp
fcmovbe st(0), st(1)
mov ah, 0x55
shl byte [edx - 0x56], cl
sahf
or al, byte [eax]
xor al, byte [edi + 0x6fd6fe7d]
xor esi, edx
jbe 0x42f6cb
dec eax
mov dword fs:[0xa99b28db], eax
outsb dx, byte [esi]
cmp dword [edx], eax
cmp eax, 0x8231d78e
push ds
shl dword [edi], cl
out dx, al
push dword [ebx]
mov esi, 0x66abb573
stosd dword es:[edi], eax
dec di
xor al, 0xb6
cmp edx, ebx
jno 0x42f72e
cmp byte [eax + 0x330f0f17], 0x75
xor eax, 0xf6fe7301
invalid
and byte [ecx], cl
sub eax, 0x28955caf
stosb byte es:[edi], al
dec edx
clc
xor dl, bl
cdq
and esp, dword [edi + 0x50]
inc ebx
cmp cl, ch
dec ecx
bnd jmp 0xd2b27f86

Function at 0x436220
Capabilities:
Encode data using xor

Disassembly:
xor bh, byte [esi - 0x555b7fed]
or dword [ebp + 0x936dd0b], edi
sub al, 0x71
inc ecx
salc
invalid
Function at 0x4061b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
je 0x406235
cmp eax, 0x40
jbe 0x4061dc
lea eax, [esi + 0x40]
push eax
push esi
call fcn.00407cb0
add esp, 8
mov dword [esi + 0x9c], 0x14
mov edx, dword [esi + 0x9c]
mov ecx, 0x40
push edi
sub ecx, edx
lea edi, [edx + esi]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, esi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x36363636
dec ecx
mov dword [eax - 4], edx
jne 0x406204
lea edi, [esi + 0x40]
push edi
call fcn.00407ba0
push edi
push 0x40
push esi
call fcn.00407be0
add esp, 0x10
mov dword [esi + 0x9c], 0xffffffff
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40624f
add esi, 0x40
push esi
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.00407be0
add esp, 0xc
pop esi
ret

Function at 0x406260
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x28]
cmp dword [edi + 0x9c], 0xffffffff
je 0x40627f
push edi
push 0
push 0
call fcn.004061b0
add esp, 0xc
lea esi, [edi + 0x40]
lea eax, [esp + 8]
push esi
push eax
call fcn.00407cb0
add esp, 8
mov eax, edi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edx
jne 0x406297
push esi
call fcn.00407ba0
push esi
push 0x40
push edi
call fcn.00407be0
push esi
lea ecx, [esp + 0x1c]
push 0x14
push ecx
call fcn.00407be0
lea edx, [esp + 0x24]
push esi
push edx
call fcn.00407cb0
mov ecx, dword [esp + 0x48]
add esp, 0x24
test ecx, ecx
jbe 0x4062f0
mov edi, dword [esp + 0x20]
mov eax, ecx
lea esi, [esp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x14
ret

Function at 0x407ba0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x40ccc0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, ecx
push 0x448738
call fcn.00427f30
add esp, 4
mov dword [esi + 0x5670], eax
test eax, eax
jne 0x40ccf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4486e8
call fcn.00424580
add esp, 8
xor eax, eax
pop edi
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4486d4
push eax
call edi
test eax, eax
mov dword [esi + 0x5664], eax
jne 0x40cd1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x448670
jmp 0x40cd64
mov eax, dword [esi + 0x5670]
push 0x448658
push eax
call edi
test eax, eax
mov dword [esi + 0x5660], eax
jne 0x40cd40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4485f0
jmp 0x40cd64
mov ecx, dword [esi + 0x5670]
push 0x4485dc
push ecx
call edi
test eax, eax
mov dword [esi + 0x565c], eax
jne 0x40cd8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x448578
call fcn.00424580
mov eax, dword [esi + 0x5670]
add esp, 8
test eax, eax
je 0x40cd87
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x5670], 0
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x5670]
push ebp
push 0x44856c
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x5668], eax
test eax, eax
jne 0x40cdbb
call ebp
push eax
push 0x448514
call fcn.00424580
add esp, 8
mov eax, dword [esi + 0x5670]
push 0x448508
push eax
call edi
test eax, eax
mov dword [esi + 0x566c], eax
jne 0x40cde3
call ebp
push eax
push 0x4484ac
call fcn.00424580
add esp, 8
pop ebp
pop edi
mov eax, 1
pop esi
ret