joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4756d0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x4756f7
cmp ecx, 0xffffffff
cmovne eax, ecx
ret

Function at 0x477160
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, 0x2b
test edi, edi
je 0x47720b
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ebx, 4
lea eax, [esp + 0x1c]
push 4
push eax
cmp edi, ebx
push ebp
cmovb ebx, edi
call fcn.00458640
add esp, 0xc
cmp eax, 4
jne 0x4771c6
cmp byte [0x4c5278], 0
jne 0x4771d2
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x47720d
mov eax, dword [esp + 0x1c]
jmp 0x4771ef
imul eax, dword [0x4c5274], 0x41c64e6d
add eax, 0x3039
mov dword [0x4c5274], eax
rol eax, 0x10
xor ecx, ecx
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x477203
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x4771f3
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x477180
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x477220
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
sub ebx, 1
je 0x477298
mov esi, dword [esp + 0x14]
mov ebp, 0x3e
nop word [eax + eax]
push 4
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00458640
add esp, 0xc
cmp eax, 4
jne 0x477279
cmp byte [0x4c5278], 0
jne 0x4772a2
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x4772bf
test eax, eax
jne 0x47729d
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffffc
jae 0x477240
xor edx, edx
div ebp
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x477240
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
imul eax, dword [0x4c5274], 0x41c64e6d
add eax, 0x3039
mov dword [0x4c5274], eax
rol eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x477281
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret

Function at 0x4772d0
Capabilities:
Generate random numbers via winapi

Disassembly:
push dword [esp + 8]
push 0
push dword [esp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
ret
Function at 0x47acd0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
push edi
lea esi, [ebp + 1]
push esi
push ebp
call dword [0x4c3028]
mov edi, eax
add esp, 8
test edi, edi
je 0x47ad27
nop word [eax + eax]
push esi
push edi
push dword [esp + 0x1c]
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x47ad3f
cmp esi, ebx
je 0x47ad3f
cmp esi, 0x8000
ja 0x47ad3f
cmp esi, ebx
jb 0x47ad38
push esi
push edi
call dword [0x4c3028]
mov edi, eax
add esp, 8
test edi, edi
jne 0x47acf0
push ebp
call dword [0x4c3024]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x4c3024]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x47c520
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0
mov byte [esp + 0x12], cl
lea ecx, [esp + 0x10]
push 3
mov eax, dword [esi + 0x18]
push ecx
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], bl
push dword [eax + 0x1a0]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x47c56c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0045f1f0
add esp, 0xc
push dword [esp + 0x14]
push ebx
push str.SENT
push esi
call fcn.0047c140
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x47c6d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [ebx + 0x18]
mov ebp, dword [ebx + 0x120]
mov dword [esp + 8], eax
jne 0x47c823
push esi
lea ecx, [ebp + 0x1cc4]
push edi
lea edi, [ebp + 0x1ec4]
mov eax, ecx
mov dword [edi], ecx
cmp ecx, edi
jae 0x47c70d
lea eax, [ecx + 1]
mov byte [ecx], 0xff
mov dword [edi], eax
cmp eax, edi
jae 0x47c721
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c721
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x18], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x18]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x47c78b
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c78b
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c78b
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c78b
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c78b
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c78b
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebp + 0x1ec8], eax
lea esi, [ebp + 0x1cc4]
sub eax, esi
mov dword [edi], esi
sub eax, 2
push eax
lea eax, [ebp + 0x1cc6]
push eax
push 0x3e
push ebx
call fcn.0047c240
mov eax, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push esi
push dword [eax + 0x1a0]
call edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x47c7e3
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0045f1f0
add esp, 0xc
push 4
lea eax, [ebp + 0x1cc7]
push eax
push ebx
call fcn.0047c590
add esp, 0xc
lea eax, [ebp + 0x1ccb]
push 0
push 2
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x1a0]
call edi
test eax, eax
jns 0x47c821
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0045f1f0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x47dc00
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4c3014]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
xor ebx, ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [eax + 0x430]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], ebx
jne 0x47dc86
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [edi + 0xb0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov esi, dword [edi + 0x134]
cmp esi, 4
jge 0x47dcc1
push str.Received_too_short_packet
push ebp
call fcn.0045f1f0
add esp, 8
mov dword [edi + 0xc], 7
mov eax, ebx
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044632d
add esp, 0x8c
ret
mov edx, dword [edi + 0x148]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x47dce0.1
jmp dword [ecx*4 + 0x47ddcc]
cmp esi, 4
jle case.0x47dce0.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x47dce0.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebp
call fcn.00460450
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x47dce0.4
push 5
push edi
call fcn.0047e6e0
add esp, 8
jmp 0x47dca6
movzx ecx, byte [edx + 2]
lea eax, [edx + 4]
mov dword [esp + 0x14], eax
add esi, 0xfffffffc
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [edx + 4]
push esi
push eax
mov dword [edi + 8], ecx
call fcn.0047e750
add esp, 8
cmp eax, esi
jae case.0x47dce0.4
push dword [esp + 0x14]
push str.TFTP_error:__s
push ebp
call fcn.0045f2c0
jmp 0x47dda1
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.0047d9b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x47dce0.4
jmp 0x47dca6
push str.Internal_error:_Unexpected_packet
push 0x4a91c0
push ebp
call fcn.0045f1f0
add esp, 0xc
push ebp
call fcn.00472990
add esp, 4
test eax, eax
je 0x47dca6
push 5
push edi
call fcn.0047e6e0
add esp, 8
mov eax, 0x2a
jmp 0x47dca8
Function at 0x49a5b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x4c3014]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x49a630
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044b090
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.0045f1f0
push esi
call dword [0x4c3024]
add esp, 0x20
lea eax, [ebx + 0x4d]
jmp 0x49a790
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x49a68a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044b090
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.0045f1f0
push 0
mov esi, 0x4d
call dword [0x4c3024]
add esp, 0x20
jmp 0x49a781
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x49a6ca
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044b090
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.0045f1f0
add esp, 0x1c
mov esi, 0x4d
jmp 0x49a76d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x49a6f8
jg 0x49a6de
cmp edi, 0x100000
jbe 0x49a6f8
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.0045f1f0
add esp, 0xc
mov esi, 0x4d
jmp 0x49a76d
lea eax, [edi + 1]
push eax
call dword [0x4c3020]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x49a710
lea esi, [eax + 0x1b]
jmp 0x49a76d
test edi, edi
je 0x49a754
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49a7ad
mov eax, dword [esp + 0x10]
test eax, eax
je 0x49a7a9
add esi, eax
cmp esi, edi
jb 0x49a720
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.0049a3b0
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x4c3024]
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044632d
add esp, 0x120
ret
mov edi, esi
jmp 0x49a754
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044b090
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.0045f1f0
add esp, 0x1c
mov esi, 0x4d
jmp 0x49a76d
Function at 0x4a0a40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.00462750
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x4c3020]
mov esi, eax
add esp, 8
test esi, esi
je 0x4a0bc2
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x4a0ac2
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4a0b33
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4a0af0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x4a0b65
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x4b691d
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x4b691e
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x4a0b40
push dword [esp + 0x30]
call fcn.00462750
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x4a0b90
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x4c3024]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x4a0cb0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4a0cd6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4a0d0e
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.00462750
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x4a0d65
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x4a0d74
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4a0d85
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret

Function at 0x4a19c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x4a1a0c
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x4a19d1
pop ebx
pop edi
pop esi
ret
Function at 0x402970
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4029ae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4029a6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4029b0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x402996
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x402a80
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x402a96
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x402ab1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x7ffe5330
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
push eax
pop eax
xor eax, ecx
xor eax, ecx
add al, 0
add al, 4
sub al, 4
add al, 0
xor eax, ecx
xor eax, ecx
and al, 0xff
add al, 4
sub al, 4
push es
pop ds
add al, 4
sub al, 4
inc esi
dec esi
xor eax, ecx
xor eax, ecx
inc esi
dec esi
not eax
not eax
inc esi
dec esi
not eax
not eax
add al, 0
xor eax, ecx
xor eax, ecx
add al, 0
not eax
not eax
inc esi
dec esi
not eax
not eax
inc esi
dec esi
not eax
not eax
add al, 0
not eax
not eax
add al, 0
pushf
popf
add al, 0
push bx
inc esp
inc esp
push es
pop ds
pushf
popf
push es
pop ds
push bx
inc esp
inc esp
add al, 0
not eax
not eax
add al, 0
push bx
inc esp
inc esp
inc esi
dec esi
add al, 4
sub al, 4
inc esi
dec esi
pushf
popf
push es
pop ds
add al, 4
sub al, 4
add al, 0
xor eax, ecx
xor eax, ecx
inc esi
dec esi
not eax
not eax
push es
pop ds
not eax
not eax
push es
pop ds
push bx
inc esp
inc esp
inc esi
dec esi
add al, 4
sub al, 4
inc esi
dec esi
not eax
not eax
cld
call 0x7ffe53e4
pop edx
xor eax, ecx
xor eax, ecx
and al, 0xff
and al, 0xff
xor dx, dx
inc esi
dec esi
xor eax, ecx
xor eax, ecx
push eax
pop eax
cld
add edx, 0xd5e0
push es
pop ds
xor eax, ecx
xor eax, ecx
push es
pop ds
pushf
popf
xor ecx, ecx
inc esi
dec esi
xor eax, ecx
xor eax, ecx
inc esi
dec esi
lea esp, [esp]
mov cl, 0x1e
add al, 0
add al, 4
sub al, 4
xor byte [ecx + edx], 0xc3
loop 0x7ffe5420
push eax
pop eax
push bx
inc esp
inc esp
push es
pop ds
pushf
popf
cld
push dword fs:[0x24]
xor eax, ecx
xor eax, ecx
add al, 0
inc esi
dec esi
pop dword [edx + 0xa]
inc esi
dec esi
pushf
popf
cld
mov cl, 0xff
pushf
popf
push es
pop ds
push eax
pop eax
push edx
loop 0x7ffe5456
add al, 0
pushf
popf
push edx
cdq
pop edx
mov dword [edx + 0x11], 0xffffacbb
pushf
popf
and al, 0xff
push eax
pop eax
mov ecx, dword [eax + 0x2c]
inc esi
dec esi
clc
push es
pop ds
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
add al, 4
sub al, 4
nop
mov dword [eax + 0x2c], esp
add al, 4
sub al, 4
and al, 0xff
pushf
popf
and al, 0xff
push 0
stc
push 0
add al, 0
push eax
pop eax
push 0
add al, 0
add al, 0
nop
push 0
add al, 4
sub al, 4
push 0x30
and al, 0xff
pushf
popf
and al, 0xff
and al, 0xff
nop
push 0x20
add al, 0
push 0
push es
pop ds
push bx
inc esp
inc esp
clc
push 0
pushf
popf
push es
pop ds
add edx, 0xffff7f39
push bx
inc esp
inc esp
nop
push edx
pushf
popf
push edx
and al, 0xff
xor eax, ecx
xor eax, ecx
and al, 0xff
xor eax, ecx
xor eax, ecx
cld
push 0
pushf
popf
call dword [edx + 0x820a]
push eax
pop eax
nop
add esp, 0x3f8
push es
pop ds
inc esi
dec esi
xor eax, eax
and al, 0xff
push bx
inc esp
inc esp
add al, 0
pushf
popf
nop
inc eax
ret 0xc
Function at 0x7ffe8354
Capabilities:
Encode data using xor

Disassembly:
stc
inc esi
dec esi
pop eax
push es
pop ds
add eax, 0x15
xor eax, ecx
xor eax, ecx
cld
mov byte [eax], 5
add al, 4
sub al, 4
call 0x7ffe8354
and al, 0xff
add al, 0xe8
dec edi
add byte [eax], al
add byte [edi + edi*8], ah
add al, 4
sub al, 4
nop
add al, 0x90
add eax, 5
xor eax, ecx
xor eax, ecx
add al, 0
mov ecx, eax
cld
call 0x7ffe831d
pop eax
cld
inc esi
dec esi
add eax, 0x11
inc esi
dec esi
mov byte [eax], 5
add al, 4
sub al, 4
stc
call fcn.7ffe84d6
xor eax, ecx
xor eax, ecx
add eax, 5
add al, 0
xor eax, ecx
xor eax, ecx
stc
xchg ecx, eax
pushf
popf
and al, 0xff
sub ecx, eax
stc
xor byte [eax + ecx], 0x62
loop 0x7ffe834b
stc
push es
pop ds
pop ecx
mov ah, byte [edx + 0x62]
bound esp, qword [edx + 0x3a]
loope 0x7ffe82ff
movsb byte es:[edi], byte gs:[esi]
bound esp, qword [edi - 0x76]
xlatb
bound esp, qword [edx + 0x62]
loope 0x7ffe830a
jmp 0x7ffe8392
jmp 0x7ffe8392
jmp 0x7ffe8369
out 0x8e, eax
xchg ebx, eax
popfd
popfd
cmp dh, byte [edx]
mov ah, byte [edx + 0x62]
bound esp, qword [edx + 0x3a]
movsb byte es:[edi], byte [esi]
and ah, byte [edi + 0x67]
mov bl, byte [edx + 0x2c]
bound esp, qword [edx - 0x1f]
mov byte [0x32e7eb68], al
xchg esp, eax
popfd
popfd
cmp dh, byte [edx]
mov ah, byte [edx + 0x62]
bound esp, qword [edx + 0x3a]
movsb byte es:[edi], byte [esi]
and ah, byte [edi + 0x67]
mov ch, byte [esi + ecx]
bound esp, qword [edx - 0x1f]
mov byte [0x3ee7eb68], al
xchg esp, eax
popfd
popfd
cmp dh, byte [edx]
mov ah, byte [edx + 0x62]
bound esp, qword [edx + 0x3a]
movsb byte es:[edi], byte [esi]
and ah, byte [edi + 0x67]
mov ah, byte [esi]
lodsd eax, dword [esi]
popfd
popfd
loope 0x7ffe8380
push 0x3a8627eb
fnclex
bound esp, qword [edx + 0x62]
jmp 0x5fee0a04
Function at 0x4047f4
Capabilities:
Identify system language via api

Disassembly:
push ebp
push ebx
call fcn.00490160
call fcn.00405401
push 0x5a
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 0
push 0x59
call fcn.00470370
push 0x17
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 1
push 0x59
call fcn.00470370
push 8
call fcn.0048873d
push eax
mov eax, 0x54a03e
push eax
push 2
push 0x59
call fcn.00470370
call sub.KERNEL32.dll_GetUserDefaultLangID
mov ebx, eax
and ebx, 0x3ff
push ebx
mov ebx, 4
cmp ebx, dword [esp]
je 0x40488c
mov ebx, 4
cmp ebx, dword [esp]
je 0x40488c
mov ebx, 0x7c04
cmp ebx, dword [esp]
jne 0x4048ce
mov ebp, dword [0x637d00]
mov edx, 0x55ef70
lea ecx, [ebp]
call fcn.00446008
mov eax, 0x55ef70
push eax
call fcn.0040d23f
push 2
push 0x59
call fcn.004703d5
mov eax, 0x55ef70
push eax
push 0x59
call fcn.0047040d
jmp 0x404954
mov ebx, 9
cmp ebx, dword [esp]
jne 0x404917
mov ebp, dword [0x637d00]
mov edx, str.English
lea ecx, [ebp]
call fcn.00446008
mov eax, str.English
push eax
call fcn.0040d23f
push 1
push 0x59
call fcn.004703d5
mov eax, str.English
push eax
push 0x59
call fcn.0047040d
jmp 0x404954
mov ebp, dword [0x637d00]
mov edx, 0x54b72a
lea ecx, [ebp]
call fcn.00446008
mov eax, 0x54b72a
push eax
call fcn.0040d23f
push 0
push 0x59
call fcn.004703d5
mov eax, 0x54b72a
push eax
push 0x59
call fcn.0047040d
pop eax
call fcn.00404966
call fcn.0042d8d4
jmp 0x40495a