joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b663d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4e71c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x10], 0
jne 0x42c7aa
xor al, al
jmp 0x42c95c
lea eax, [ebp - 0x58]
push eax
call fcn.00472470
add esp, 4
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [0x4d7cd8]
movq xmm0, qword [str._VUQUT8]
mov dword [ebp - 0x64], eax
mov ax, word [0x4d7cdc]
movq qword [ebp - 0x6c], xmm0
mov word [ebp - 0x60], ax
nop
mov eax, 0x8d3dcb09
mov ecx, esi
mul esi
shr edx, 5
imul eax, edx, 0x3a
sub ecx, eax
add ecx, 0x32
xor word [ebp + esi*2 - 0x6c], cx
inc esi
cmp esi, 7
jl 0x42c7e0
mov edx, dword [edi + 0x10]
lea ecx, [ebp - 0x6c]
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c810
sub ecx, esi
mov eax, SysReAllocString
sar ecx, 1
sub eax, edx
cmp eax, ecx
jb 0x42c978
cmp dword [edi + 0x14], 7
mov eax, edi
jbe 0x42c838
mov eax, dword [edi]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push edx
push eax
push edi
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004021c0
push 0
push 1
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push 1
push eax
call fcn.004721f0
add esp, 0x10
push 0
sub esp, 8
mov byte [ebp - 4], 2
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.0042c3b0
add esp, 0xc
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
mov bl, al
push 0
sub esp, 8
call fcn.0042c3b0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
cmp ecx, 7
jbe 0x42c8c6
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42c8bc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42c97d
push ecx
push edx
call fcn.0045c945
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 7
jbe 0x42c910
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42c906
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42c97d
push ecx
push edx
call fcn.0045c945
add esp, 8
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp ecx, 7
jbe 0x42c95a
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42c950
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42c97d
push ecx
push edx
call fcn.0045c945
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045c4df
mov esp, ebp
pop ebp
ret
call fcn.00401840
call fcn.00483c3a
int3
Function at 0x42da10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e71c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0042e600
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp edx, 7
jbe 0x42da38
test ecx, ecx
je 0x42da65
cmp edx, 7
lea eax, [ebp - 0x1c]
cmova eax, ecx
cmp word [eax], 0
je 0x42da65
cmp edx, 7
lea eax, [ebp - 0x1c]
cmova eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x42da65
mov bl, 1
jmp 0x42da67
xor bl, bl
cmp edx, 7
jbe 0x42da97
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42da8d
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42daa8
push edx
push ecx
call fcn.0045c945
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0045c4df
mov esp, ebp
pop ebp
ret
call fcn.00483c3a
int3

Function at 0x42dab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e71c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0042ea20
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp edx, 7
jbe 0x42dad8
test ecx, ecx
je 0x42db05
cmp edx, 7
lea eax, [ebp - 0x1c]
cmova eax, ecx
cmp word [eax], 0
je 0x42db05
cmp edx, 7
lea eax, [ebp - 0x1c]
cmova eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x42db05
mov bl, 1
jmp 0x42db07
xor bl, bl
cmp edx, 7
jbe 0x42db37
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42db2d
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42db48
push edx
push ecx
call fcn.0045c945
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0045c4df
mov esp, ebp
pop ebp
ret
call fcn.00483c3a
int3

Function at 0x42e150
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
mov edx, esi
push edi
lea edi, [esi + 0x14]
cmp ecx, 7
jbe 0x42e168
mov edx, dword [esi]
lea eax, [esi + 0x14]
jmp 0x42e16a
mov eax, edi
test edx, edx
je 0x42e19e
push ebx
mov ebx, esi
cmp ecx, 7
jbe 0x42e17d
mov ebx, dword [esi]
lea edx, [esi + 0x14]
jmp 0x42e17f
mov edx, eax
cmp word [ebx], 0
mov edi, eax
pop ebx
je 0x42e19e
mov eax, esi
cmp ecx, 7
jbe 0x42e191
mov eax, dword [esi]
push eax
mov edi, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42e1d7
cmp dword [edi], 7
mov eax, esi
jbe 0x42e1a7
mov eax, dword [esi]
push 0
push 0
push 1
push eax
call fcn.004617d0
add esp, 0x10
cmp eax, 0xffffffff
je 0x42e1d7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi], 7
jbe 0x42e1c9
mov esi, dword [esi]
push esi
call fcn.00461bc0
test eax, eax
pop edi
setne al
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x42f290
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b687d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x54
mov eax, dword [0x4e71c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x493e0
push 0
call fcn.00472bb0
test eax, eax
jne 0x42f429
mov eax, dword [0x4d7cfc]
xor esi, esi
movups xmm0, xmmword [str.QGRXYY]
mov dword [ebp - 0x38], eax
mov ax, word [0x4d7d00]
movups xmmword [ebp - 0x48], xmm0
mov word [ebp - 0x34], ax
mov eax, 0x2f684bdb
mov ecx, esi
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x36
sub ecx, eax
add ecx, 0x32
xor word [ebp + esi*2 - 0x48], cx
inc esi
cmp esi, 0xb
jl 0x42f302
lea eax, [ebp - 0x48]
push eax
push 0x493e0
push 0
call fcn.00472bb0
test eax, eax
jne 0x42f429
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push 0x1fffff
push eax
push 0
call fcn.0045ea70
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x42f394
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
push 0x3a98
push 0
call fcn.00472bb0
test eax, eax
je 0x42f394
mov byte [ebp - 0x2d], 1
jmp 0x42f3ee
mov eax, dword [0x4d7d14]
xor esi, esi
movups xmm0, xmmword [str.q_Gr]
mov dword [ebp - 0x50], eax
mov ax, word [0x4d7d18]
movups xmmword [ebp - 0x60], xmm0
mov word [ebp - 0x4c], ax
mov eax, 0x2f684bdb
mov ecx, esi
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x36
sub ecx, eax
add ecx, 0x32
xor word [ebp + esi*2 - 0x60], cx
inc esi
cmp esi, 0xb
jl 0x42f3b3
lea eax, [ebp - 0x60]
push eax
push 0x493e0
push 0
call fcn.00472bb0
mov byte [ebp - 0x2d], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x42f424
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42f41a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42f448
push ecx
push edx
call fcn.0045c945
add esp, 8
mov al, byte [ebp - 0x2d]
jmp 0x42f42b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045c4df
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00483c3a
int3
Function at 0x436880
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b72b0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4e71c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x28]
call fcn.0042e3f0
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp esi, 7
jbe 0x4368c7
test edx, edx
je 0x436a46
cmp esi, 7
lea eax, [ebp - 0x28]
cmova eax, edx
cmp word [eax], 0
je 0x436a46
cmp esi, 7
lea eax, [ebp - 0x28]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmova eax, edx
push eax
call esi
test eax, eax
je 0x436a40
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x43692e
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x436924
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436a9b
push ecx
push edx
call fcn.0045c945
add esp, 8
lea ecx, [ebp - 0x28]
call fcn.0042e810
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp edx, 7
jbe 0x436949
test ecx, ecx
je 0x436a16
cmp edx, 7
lea eax, [ebp - 0x28]
cmova eax, ecx
cmp word [eax], 0
je 0x436a16
cmp edx, 7
lea eax, [ebp - 0x28]
cmova eax, ecx
push eax
call esi
test eax, eax
je 0x436a10
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x4369aa
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4369a0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436a96
push ecx
push edx
call fcn.0045c945
add esp, 8
call fcn.0041db40
mov edx, 1
mov esi, eax
call fcn.0042cdb0
test eax, eax
jg 0x4369e9
mov edx, 3
call fcn.0042cdb0
mov dword [ebp - 0x2c], eax
test eax, eax
jg 0x4369e9
sub esp, 0xc
lea eax, [ebp - 0x2c]
mov ecx, esi
push 0
push eax
push 0
call fcn.004302e0
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x436a0c
cmp edi, eax
jle 0x436a0c
call fcn.0041db40
push 1
mov ecx, edi
call fcn.0042cc80
add esp, 4
mov ecx, edi
push 3
call fcn.0042cc80
add esp, 4
jmp 0x436a76
xor al, al
jmp 0x436a7b
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp edx, 7
jbe 0x436a76
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436a3c
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436a96
push edx
push ecx
jmp 0x436a6e
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp esi, 7
jbe 0x436a76
lea esi, [esi*2 + 2]
mov eax, edx
cmp esi, 0x1000
jb 0x436a6c
mov edx, dword [eax - 4]
add esi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436a9b
push esi
push edx
call fcn.0045c945
add esp, 8
call fcn.0042b6d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045c4df
mov esp, ebp
pop ebp
ret
call fcn.00483c3a
call fcn.00483c3a
int3
Function at 0x44f530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4ec0d8], 0
jne 0x44f53e
call fcn.00454570
cmp byte [0x4ec0e2], 0
je 0x44f55c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00457da0
add esp, 0x10
ret
jmp fcn.0044d890
Function at 0x452450
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
cmp eax, 4
jb 0x452484
mov esi, eax
shr esi, 2
nop dword [eax]
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x452470
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
test eax, eax
je 0x452564
mov ebx, edi
sub ebx, edx
cmp eax, 8
jb 0x452543
mov ecx, eax
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
mov dword [esp + 0x1c], ecx
lea ecx, [edx + 4]
nop dword [eax]
movd xmm2, dword [edi + ebp]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 0xc]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add ebp, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [ecx - 8]
orps xmm4, xmm2
movd xmm2, dword [ebx + ecx - 8]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp ebp, dword [esp + 0x1c]
jb 0x4524d0
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x452564
lea edi, [edx + ebp]
sub eax, ebp
nop dword [eax + eax]
movzx edx, byte [ebx + edi]
lea edi, [edi + 1]
movzx ecx, byte [edi - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x452550
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
ret
Function at 0x452570
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x24
test eax, eax
je 0x452718
mov edx, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x30]
push edi
cmp eax, 4
jb 0x4525b3
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor ecx, dword [ebx]
add edx, 4
mov dword [esi], ecx
add ebx, 4
add esi, 4
sub edi, 1
jne 0x452598
mov dword [esp + 0x40], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ebx
test eax, eax
je 0x452714
cmp eax, 8
jb 0x4526f9
lea ecx, [ebx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x4525e9
cmp edi, ebx
jae 0x4526f9
lea ecx, [edx - 1]
add ecx, eax
cmp esi, ecx
ja 0x4525fa
cmp edi, edx
jae 0x4526f9
cmp eax, 0x40
jb 0x4526ae
mov edi, eax
mov ecx, eax
mov eax, edx
and edi, 0x3f
sub eax, ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], eax
sub ecx, edi
mov eax, esi
mov dword [esp + 0x2c], ecx
sub eax, ebx
lea edi, [esi + 0x20]
mov dword [esp + 0x20], eax
lea ecx, [ebx + 0x10]
mov ebx, dword [esp + 0x20]
mov eax, edx
sub eax, esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
lea eax, [edx + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x24]
lea ecx, [ecx + 0x40]
movups xmm0, xmmword [ecx - 0x50]
lea edi, [edi + 0x40]
xorps xmm1, xmm0
movups xmmword [edi - 0x60], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [esi + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ebx + ecx - 0x40], xmm1
movups xmm1, xmmword [edx + edi - 0x40]
mov edx, dword [esp + 0x28]
movups xmm0, xmmword [ecx - 0x30]
xorps xmm1, xmm0
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x10]
add ebp, 0x40
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ebp, dword [esp + 0x2c]
jb 0x452645
cmp dword [esp + 0x30], 8
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
jb 0x4526f5
and eax, 0xfffffff8
lea ecx, [ebx + ebp]
mov dword [esp + 0x30], eax
sub edx, ebx
mov edi, dword [esp + 0x30]
mov eax, esi
sub eax, ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov eax, edx
mov edx, dword [esp + 0x28]
movq xmm1, qword [ecx + eax]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebp, 8
xorps xmm1, xmm0
movq qword [edx + ecx - 8], xmm1
cmp ebp, edi
jb 0x4526d0
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
cmp ebp, eax
jae 0x452714
sub edx, ebx
lea edi, [ebx + ebp]
sub esi, ebx
sub eax, ebp
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [esi + edi - 1], cl
sub eax, 1
jne 0x452702
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x458510
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
movaps xmm5, xmmword [0x4bff40]
push esi
mov esi, dword [esp + 0xc]
movups xmm4, xmmword [eax]
pshufb xmm4, xmmword [0x4bff30]
mov eax, dword [esp + 0x10]
movaps xmm3, xmm4
add eax, 0xffffffe0
je 0x45864b
dec eax
lea ecx, [esi + 8]
shr eax, 5
inc eax
mov edx, eax
shl edx, 5
nop dword [eax + eax]
movq qword [ecx - 8], xmm3
movaps xmm2, xmm3
lea ecx, [ecx + 0x20]
movaps xmm0, xmm3
movaps xmm1, xmm3
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm0, xmm4, 1
pclmulqdq xmm2, xmm4, 0x10
xorps xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm2, xmm0
movaps xmm0, xmm1
psrldq xmm1, 8
pclmulqdq xmm0, xmm5, 0x10
xorps xmm2, xmm0
movaps xmm0, xmm3
xorps xmm1, xmm2
psllq xmm1, 1
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm1, xmm5, 0
xorps xmm1, xmm0
movaps xmm0, xmm2
psrldq xmm0, 8
xorps xmm1, xmm0
punpcklqdq xmm2, xmm1
psllq xmm1, 1
psrlq xmm2, 0x3f
xorps xmm2, xmm1
movaps xmm0, xmm2
movaps xmm1, xmm2
movups xmmword [ecx - 0x18], xmm2
movups xmmword [ecx - 0x20], xmm3
movq qword [ecx - 0x20], xmm2
movaps xmm3, xmm2
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm0, xmm4, 1
pclmulqdq xmm3, xmm4, 0x10
xorps xmm3, xmm0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm3, xmm0
movaps xmm0, xmm1
psrldq xmm1, 8
pclmulqdq xmm0, xmm5, 0x10
xorps xmm3, xmm0
xorps xmm1, xmm3
movaps xmm0, xmm3
psllq xmm1, 1
psrldq xmm0, 8
pclmulqdq xmm1, xmm5, 0
pclmulqdq xmm2, xmm4, 0x11
xorps xmm1, xmm2
xorps xmm1, xmm0
punpcklqdq xmm3, xmm1
psrlq xmm3, 0x3f
psllq xmm1, 1
xorps xmm3, xmm1
sub eax, 1
jne 0x458550
movaps xmm2, xmm3
movq qword [edx + esi], xmm3
pclmulqdq xmm2, xmm4, 0x10
movaps xmm0, xmm3
movaps xmm1, xmm3
pclmulqdq xmm0, xmm4, 1
xorps xmm2, xmm0
pclmulqdq xmm1, xmm4, 0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm2, xmm0
movaps xmm0, xmm1
pclmulqdq xmm0, xmm5, 0x10
xorps xmm2, xmm0
psrldq xmm1, 8
xorps xmm1, xmm2
movaps xmm0, xmm3
psllq xmm1, 1
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm1, xmm5, 0
xorps xmm1, xmm0
movaps xmm0, xmm2
psrldq xmm0, 8
xorps xmm1, xmm0
punpcklqdq xmm2, xmm1
psrlq xmm2, 0x3f
psllq xmm1, 1
xorps xmm2, xmm1
movups xmmword [edx + esi + 0x10], xmm2
movups xmmword [edx + esi + 8], xmm3
movq qword [edx + esi + 8], xmm2
pop esi
ret

Function at 0x458950
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x458977
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x45897a
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0045892c
pop esi
leave
ret 8
Function at 0x45c6f5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x45c72a
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x45c727
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x45c733
add edx, 0x28
cmp edx, esi
jne 0x45c715
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x45c730

Function at 0x45d81f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45d85e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45d85e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45d85e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45d85e
cmp dword [ecx + 0x74], 0xe
jbe 0x45d85e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x45e0c0
Capabilities:
Check if file exists
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x45e0f1
cmp dword [ebp + 0xc], 0
je 0x45e0f1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
test ecx, ecx
je 0x45e0f1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45e0f8
xor eax, eax
jmp 0x45e1e4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x45e121
xor eax, eax
jmp 0x45e1e4
lea edx, [ebp - 8]
push edx
push 1
push 1
push 0
push 0x2000000
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x45e1e1
push 0x44
push 0
lea ecx, [ebp - 0x60]
push ecx
call fcn.0047a2a0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x58], str.winsta0default
mov dword [ebp - 0x34], 1
mov dx, word [ebp + 0x18]
mov word [ebp - 0x30], dx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x45e1e1
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x14], 0
je 0x45e1bf
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x18], 0
je 0x45e1d0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [ebp - 0x1c], 0
je 0x45e1e1
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x45e2d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], 0
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.0047a2a0
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov ecx, dword [ebp - 0x2c]
or ecx, 1
mov dword [ebp - 0x2c], ecx
mov dx, word [ebp + 0x10]
mov word [ebp - 0x28], dx
mov dword [ebp - 0x50], str.WinSta0default
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x45e34d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
xor eax, eax
jmp 0x45e384
cmp dword [ebp - 0x10], 0
je 0x45e35e
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [ebp - 0x14], 0
je 0x45e37f
cmp dword [ebp + 0x14], 0
je 0x45e374
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x45e37f
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
mov esp, ebp
pop ebp
ret