joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458bc0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x458bd2
add esp, 0xfffffff0
call fcn.00403f44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041ac74
mov eax, dword [0x4912c8]
mov dword [eax + 4], ebx
mov dword [eax], 0x458f64
mov eax, dword [0x4912d4]
mov dword [eax + 4], ebx
mov dword [eax], 0x458f70
mov eax, ebx
call fcn.00458f7c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412814]
call fcn.00403bf0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412814]
call fcn.00403bf0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412814]
call fcn.00403bf0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412814]
call fcn.00403bf0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412814]
call fcn.00403bf0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45462c
push eax
push 0
push 0
mov eax, dword [0x491448]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x420888]
call fcn.00422134
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x420888]
call fcn.00422134
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x420888]
call fcn.00422134
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004593ac
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45927c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45927c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45927c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x458d0f
call fcn.00403f9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x459060
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45920b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4591ec
mov dl, 1
mov eax, dword [0x412c38]
call fcn.00403bf0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404a90
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4591db
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044b500
test al, al
je 0x4591ce
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45921c
lea eax, [ebp - 0x254]
call fcn.0040989c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4591ce
xor eax, eax
push ebp
push 0x4591c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x459254
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4591b0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d00
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4591b0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4591ce
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4590d1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00416a20
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459212
lea eax, [ebp - 0x260]
call fcn.00404a90
ret

Function at 0x459b84
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x496ccc]
cmp byte [eax + 0xad], 0
jne 0x459bf5
cmp dword [0x496ce8], 0
jne 0x459bb6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x459b40
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x496ce8], eax
cmp dword [0x496ce4], 0
jne 0x459bd1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x496ce4], eax
cmp dword [0x496cec], 0
jne 0x459bf5
push esp
push 0
push 0
push 0x459ae4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x496cec], eax
pop edx
ret
Function at 0x459dc8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x459ddf
add esp, 0xfffffff0
call fcn.00403f44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041ac74
mov eax, dword [0x491430]
cmp word [eax + 2], 0
jne 0x459e07
mov eax, dword [0x491430]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045ba20
mov eax, dword [0x4914f0]
cmp word [eax + 2], 0
jne 0x459e21
mov eax, dword [0x4914f0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045bc2c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412814]
call fcn.00403bf0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412814]
call fcn.00403bf0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x412814]
call fcn.00403bf0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x421398]
call fcn.0042919c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x459fd8
mov eax, dword [0x491340]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429570
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45c2f0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x491340]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d1a8
test eax, eax
je 0x459f28
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409254
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d1dc
test eax, eax
je 0x459f3c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404d00
mov byte [ebx + 0xd4], 0
push ebx
push 0x45b548
call fcn.0041bdf0
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4911fc]
cmp byte [eax], 0
jne 0x459f8d
mov eax, ebx
call fcn.0045a11c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045c4c8
mov eax, ebx
call fcn.0045d02c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459fcd
call fcn.00403f9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a39c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45a43b
cmp dword [ebx + 0x94], 0
jne 0x45a435
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45a324
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45a435
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45a3fb
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45a435
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414bec
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45a40a
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45a654
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x496ccc]
cmp dword [eax + 0x30], 0
je 0x45a7b1
test bl, bl
jne 0x45a702
cmp dword [esi + 0x9c], 0
jne 0x45a6f7
mov eax, esi
call fcn.0045cea8
push eax
push 0x45a580
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45a6c8
mov eax, dword [0x496ccc]
call fcn.0045d588
test al, al
je 0x45a6c8
mov eax, dword [0x496cf0]
call fcn.00405998
mov edi, eax
cmp edi, 0
jl 0x45a6c8
push 0
mov eax, dword [0x496cf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45a6b2
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45a6f7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414bec
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45a6d7
inc dword [esi + 0x9c]
jmp 0x45a7b1
cmp dword [esi + 0x9c], 0
jle 0x45a7b1
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45a7b1
cmp dword [esi + 0x44], 0
je 0x45a75d
mov eax, dword [0x496ccc]
call fcn.0045d588
test al, al
je 0x45a75d
mov eax, dword [0x496cf0]
call fcn.00405998
mov edi, eax
cmp edi, 0
jl 0x45a75d
push 5
mov eax, dword [0x496cf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45a747
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45a78c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414bec
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45a76c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x496cf0
mov ecx, 1
mov edx, dword [0x45a560]
call fcn.00405b4c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x45b244
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45b2ae
mov eax, ebx
call fcn.0045d588
test al, al
jne 0x45b2ae
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b80
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45b29b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45b2bb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404ae4
jmp 0x45b2bb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404ae4
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x45c6ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c71a
mov eax, esi
call fcn.00446278
test al, al
je 0x45c71a
mov eax, dword [ebx + 0x84]
call fcn.00445ef4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c71a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45c70e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445ef4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043de88
jmp 0x45c71a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045c4e8
pop esi
pop ebx
ret

Function at 0x45fb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004232c8
cmp ebx, dword [ebp - 8]
jge 0x45fbb3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004234f0
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004234f0
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042351c
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x45fb79
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x45fbbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004232c8
cmp ebx, dword [ebp - 8]
jge 0x45fc1f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004234f0
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004234f0
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042351c
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x45fbe5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x46a420
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00404d50
mov edx, eax
mov eax, ebp
call fcn.004051b0
mov eax, dword [esp]
call fcn.00404d50
mov edi, eax
test edi, edi
jle 0x46a485
mov ebx, 1
mov eax, ebp
call fcn.00404f80
mov edx, dword [esp]
movzx edx, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x46a450
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46a48c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.00404d50
mov edx, eax
mov eax, dword [esp]
call fcn.004051b0
mov eax, edi
call fcn.00404d50
mov ebp, eax
test ebp, ebp
jle 0x46a4eb
mov ebx, 1
mov eax, dword [esp]
call fcn.00404f80
movzx edx, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
movzx eax, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x46a4bb
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x479bd4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x479c02
mov eax, ebx
call fcn.0047a688
cmp dword [ebx + 0x40], 0
je 0x479bfb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x479c73
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x479c65
cmp dword [ebx + 8], 0
je 0x479c24
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x479c36
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x479c65
cmp dword [ebx + 8], 0
je 0x479c17
cmp eax, 3
je 0x479c49
dec eax
jne 0x479c17
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x479c17
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x479c17
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x479c91
cmp dword [ebx + 0x14], 0xcc
je 0x479c91
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00479c9c
pop ebx
ret
Function at 0x3115a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x31180d
jne 0x31180d
je 0x3111e6
jne 0x3112ed
add byte [eax], al
add byte [eax], al
Function at 0x313620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x23c
mov edi, dword [ebp + 0xc]
je 0x3137a8
jne 0x3137a8
Function at 0x314860
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
je 0x3148b6
jne 0x3148b6
jmp 0x3e9d83b2
inc ebp
cmp ebp, dword [esi + edi + 0x18]
jb 0x3148d7
xor eax, eax
jmp 0x314890
mov eax, dword [esp]
je 0x31487c
jne 0x31487c
jmp 0x683dff8f
movzx ecx, word [eax + ebp*2]
xor eax, eax
cmp dword [esi + edi + 0x14], ecx
jb 0x314890
mov eax, dword [esi + edi + 0x1c]
je 0x3148f9
jne 0x3148f9
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + edi + 0x24]
mov ebx, dword [esi + edi + 0x20]
xor ebp, ebp
je 0x31491b
jne 0x31491b
je 0x3124da
jne 0x31140a
push eax
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, dword [edx]
cmp dword [ecx + 0x7c], 0
je 0x314890
je 0x314938
jne 0x314938
je 0x31369f
jne 0x312cb7
je 0x1dc4d66
mov eax, dword [ebx + ebp*4]
add eax, esi
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x20]
call dword [eax + 0x24]
je 0x314907
invalid
jne 0x314907
je 0x31268a
jne 0x312922
jmp 0x3bf558a
lea ecx, [esi + ecx*4]
add esi, dword [eax + ecx]
mov eax, esi
je 0x314890
jne 0x314890
je 0x84410990
test eax, eax
je 0x314874
invalid
je 0x314869
jne 0x314869
add eax, esi
add ebx, esi
mov dword [esp], eax
nop word cs:[eax + eax]
nop dword [eax]
je 0x3148d7
jne 0x3148d7
add byte [eax], al
add byte [eax], al
mov esi, dword [edx + 4]
mov edi, dword [ecx + 0x78]
cmp dword [edi + esi + 0x18], 0
je 0x314890
cmp dword [esi + edi + 0x14], 0
je 0x314890
je 0x31489c
jne 0x31489c
push ebp
push ebx
je 0x314a05
jne 0x314a05
je 0x398a3b
mov dword [eax + 8], 0
mov dword [eax + 0x10], 0
mov ebx, ecx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
je 0x3149d8
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ecx + 0x2474ffcb], cl
and bh, bh
je 0x3149ab
and byte [eax + 0x74], dl
dec ebp
jne 0x3149d8
je 0x3113d2
jne 0x31363b
add byte [eax], al
add byte [eax], al
test edi, edi
je 0x3149fb
push 0x8000
push 0
push edi
call dword [ebx + 0xc]
je 0x3149fb
or al, 0x74
dec ebp
jne 0x3149fb
jmp 0x816da740
mov ebx, dword [ebp + 0x3c]
cmp dword [ebp + ebx], 0x4550
jne 0x3149fb
mov edi, dword [esp + 0x14]
add ebx, ebp
push 4
je 0x3149ca
jne 0x3149ca
push 0x3000
push 0x14
push 0
je 0x314a1c
jne 0x314a1c
jmp 0xec74322d
push ecx
call fcn.00313620
add esp, 0x10
test eax, eax
je 0x3149f0
mov esi, edi
mov dword [edi + 0x10], 1
jmp 0x3149fb
je 0x31499d
jne 0x31499d
pop ebx
pop ebp
ret
mov eax, esi
pop esi
pop edi
je 0x3149f4
jne 0x3149f4
je 0x6cbca060
push edi
push esi
mov ebp, dword [esp + 0x18]
and al, 0x18
xor esi, esi
movzx eax, word [ebp]
cmp eax, 0x5a4d
jne 0x3149fb
je 0x3149b1
jne 0x3149b1
call dword [edi]
mov ecx, edi
mov dword [eax + 4], ebp
mov dword [eax], ebx
mov edi, eax
mov dword [eax + 0xc], 0
je 0x314970
jne 0x314970
nop word [eax + eax]
ret
Function at 0x317f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1400
call fcn.00354b40
mov eax, dword [esp + 0x1418]
movdqa xmm4, xmmword [0x35a290]
movdqa xmm6, xmmword [0x35a2a0]
mov esi, 0xfffffc00
pxor xmm2, xmm2
nop
movdqa xmm3, xmm4
movdqa xmm7, xmmword [0x35a2c0]
movdqa xmm0, xmm4
movdqa xmm1, xmm4
movdqa xmm5, xmm4
pand xmm3, xmm6
psrld xmm0, 6
pand xmm1, xmmword [0x35a320]
pcmpeqd xmm3, xmm2
pand xmm3, xmmword [0x35a2b0]
pcmpeqd xmm1, xmm2
pand xmm1, xmmword [0x35a330]
pxor xmm0, xmm3
movdqa xmm3, xmm4
pand xmm3, xmm7
movdqa xmm7, xmmword [0x35a2e0]
pcmpeqd xmm3, xmm2
pand xmm3, xmmword [0x35a2d0]
pand xmm5, xmm7
movdqa xmm7, xmmword [0x35a350]
pcmpeqd xmm5, xmm2
pand xmm5, xmmword [0x35a2f0]
pxor xmm3, xmm0
pand xmm0, xmm6
pcmpeqd xmm0, xmm2
pxor xmm1, xmm5
movdqa xmm5, xmm4
pand xmm5, xmmword [0x35a340]
pcmpeqd xmm5, xmm2
pand xmm5, xmm7
pxor xmm5, xmm1
movdqa xmm1, xmm4
paddd xmm4, xmmword [0x35a2e0]
pand xmm1, xmmword [str._b_b_b_b]
pxor xmm5, xmm3
pand xmm3, xmmword [0x35a2c0]
pcmpeqd xmm1, xmm2
pcmpeqd xmm3, xmm2
pand xmm1, xmmword [0x35a310]
pand xmm3, xmm7
pxor xmm5, xmm1
movdqa xmm1, xmm0
pand xmm0, xmmword [0x35a370]
pandn xmm1, xmmword [0x35a360]
psrld xmm5, 2
por xmm0, xmm1
pxor xmm0, xmm5
pxor xmm0, xmm3
movdqu xmmword [esp + esi + 0x400], xmm0
add esi, 0x10
jne 0x317fb0
mov esi, eax
mov eax, 0xfffffc00
shr esi, 2
nop word [eax + eax]
mov ebx, dword [esp + eax + 0x400]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
movzx ecx, bl
shr ebx, 8
xor ebx, dword [esp + ecx*4]
mov dword [esp + eax + 0x800], ebx
add eax, 4
jne 0x3180d0
mov eax, dword [esp]
mov edi, dword [esp + 0x400]
xor ebp, ebp
mov ebx, eax
shr ebx, 8
nop
mov ecx, eax
xor ecx, ebp
movzx ecx, cl
mov ecx, dword [esp + ecx*4]
xor ecx, ebx
movzx edx, cl
shr ecx, 8
xor ecx, dword [esp + edx*4]
movzx edx, cl
shr ecx, 8
mov edx, dword [esp + edx*4]
xor edx, edi
xor edx, ecx
mov dword [esp + ebp*4 + 0x800], edx
inc ebp
cmp ebp, 0x100
jne 0x318110
movzx eax, al
Function at 0x319d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
je 0x319fb2
jne 0x319fb2
jmp 0x4be869b

Function at 0x31adf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
je 0x31b0ab
jne 0x31b0ab
je 0x3193c2
jne 0x31a2d9
add byte [eax], al
add byte [eax], al
push ebx
push edi
push esi
je 0x31b126
jne 0x31b126
add byte [eax], al
add byte [eax], al
Function at 0x342fc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push esi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov esi, dword [edx]
mov dword [eax + 0x10], esi
mov esi, dword [edx + 4]
mov dword [eax + 0x14], esi
mov esi, dword [edx + 8]
mov dword [eax + 0x18], esi
mov esi, dword [edx + 0xc]
mov dword [eax + 0x1c], esi
lea esi, [edx + 0x10]
cmp ecx, 0x100
cmovne esi, edx
mov ecx, str.expand_32_byte_kexpand_16_byte_k
mov edx, 0x35a690
cmove edx, ecx
mov ecx, dword [esi]
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 0x24], ecx
mov ecx, dword [esi + 8]
mov dword [eax + 0x28], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx]
mov esi, dword [edx + 4]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
pop esi
ret

Function at 0x3430f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov dword [esp + 0x78], ecx
mov eax, dword [edx]
mov dword [esp + 0x38], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0x44], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x4c], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0x50], eax
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x54], eax
mov eax, dword [edx + 0x20]
mov dword [esp + 0x58], eax
mov eax, dword [edx + 0x24]
mov dword [esp + 0x5c], eax
mov ebp, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
mov edi, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x74], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x68], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov ebp, dword [esp + 0x54]