joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100517b4
Capabilities:
Delete service
Modify service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
mov byte [ebp - 1], cl
mov ebx, edx
mov esi, eax
xor eax, eax
mov dword [ebp - 8], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10051914
push 0xf01ff
mov eax, esi
call fcn.10004a00
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10051914
xor eax, eax
push ebp
push 0x1005190d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je case.default.0x10051835
cmp dword [ebp - 0xc], 0
je case.default.0x10051835
xor eax, eax
mov al, bl
cmp eax, 4
ja case.default.0x10051835
jmp dword [eax*4 + 0x1005183c]
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_StartServiceA
mov dword [ebp - 8], eax
jmp case.default.0x10051835
lea eax, [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
mov dword [ebp - 8], eax
jmp case.default.0x10051835
lea eax, [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x100518a7
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
jmp case.default.0x10051835
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_StartServiceA
mov dword [ebp - 8], eax
jmp case.default.0x10051835
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DeleteService
mov dword [ebp - 8], eax
jmp case.default.0x10051835
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
xor eax, eax
mov al, byte [ebp - 1]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ChangeServiceConfigA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10051914
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10051988
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x108], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x10051a6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.10004524
lea eax, [ebp - 4]
push eax
mov eax, edi
call fcn.10004a00
push eax
push esi
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x10051a51
xor eax, eax
push ebp
push 0x10051a4a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov esi, pe_nt_image_headers32
jmp 0x10051a1d
push dword [ebx]
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.10004794
push dword [ebp - 0x108]
push 0x10051a80
mov eax, ebx
mov edx, 3
call fcn.100048c0
mov esi, pe_nt_image_headers32
inc edi
push esi
lea eax, [ebp - 0x104]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x100519e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10051a51
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10051a71
lea eax, [ebp - 0x108]
call fcn.10004524
ret
Function at 0x1005211c
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x2001b
push 0
mov eax, esi
call fcn.10004a00
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x10052204
xor eax, eax
push ebp
push 0x100521fd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.10004a00
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x100521e6
mov eax, dword [ebp - 0x10]
call fcn.10002a8c
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x100521dc
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp + 8]
call fcn.10004a00
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x100521dc
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete al
neg al
sbb eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.10002abc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10052204
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10052260
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push esp
mov eax, esi
call fcn.10004a00
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x1005229a
mov eax, edi
call fcn.10004a00
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete al
neg al
sbb eax, eax
jmp 0x1005229c
xor eax, eax
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x100522a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.100049f0
mov eax, dword [ebp - 8]
call fcn.100049f0
xor eax, eax
push ebp
push 0x10052384
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.10004524
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.10004a00
push eax
push esi
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x10052369
xor eax, eax
push ebp
push 0x10052362
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.10004a00
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x1005234b
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, pe_nt_image_headers32
call fcn.10004794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10052369
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1005238b
lea eax, [ebp - 8]
mov edx, 2
call fcn.10004548
ret
Function at 0x100528f0
Capabilities:
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x100529e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x1005c5e0]
cmp dword [eax], 0
je 0x10052923
mov edx, dword [0x1005c3d0]
mov edx, dword [edx]
mov eax, dword [0x1005c49c]
mov eax, dword [eax]
call fcn.10052240
jmp 0x10052933
mov eax, dword [0x1005c5c0]
mov eax, dword [eax]
mov cl, 2
mov dl, 3
call fcn.100517b4
mov edx, dword [0x1005c5dc]
mov edx, dword [edx]
mov eax, dword [0x1005c6c4]
mov eax, dword [eax]
call fcn.10052240
mov ecx, dword [0x1005c624]
mov ecx, dword [ecx]
mov edx, 0x100529f8
mov eax, 0x80000002
call fcn.10052260
mov ecx, dword [0x1005c624]
mov ecx, dword [ecx]
mov edx, 0x10052a34
mov eax, 0x80000002
call fcn.10052260
call fcn.1004f8c8
lea eax, [ebp - 4]
call fcn.1004f724
mov eax, dword [ebp - 4]
call fcn.10004a00
push eax
call sub.kernel32.dll_DeleteFileA
call fcn.1004ec2c
mov edx, dword [0x1005c5f4]
mov edx, dword [edx]
mov eax, dword [0x1005c40c]
mov eax, dword [eax]
call fcn.1004b600
test eax, eax
je 0x100529b4
call fcn.1004f364
jmp 0x100529c6
mov eax, dword [0x1005c5f4]
mov eax, dword [eax]
call fcn.10004a00
push eax
call sub.kernel32.dll_DeleteFileA
push 0
call sub.kernel32.dll_ExitProcess_1

Function at 0x10052c2c
Capabilities:
Create thread

Disassembly:
push ebx
push esi
test dl, dl
je 0x10052c3a
add esp, 0xfffffff0
call fcn.10003998
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x1004d3a8]
call fcn.1004d414
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x20]
push eax
push 0
push esi
push 0x10052c1c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, esi
test bl, bl
je 0x10052c77
call fcn.100039f0
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x10056d38
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov edi, 0x10063694
mov ebp, 0x100636e0
push 0
call sub.user32.dll_GetDC
mov dword [0x100636b8], eax
mov eax, dword [0x100636b8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov ebx, eax
mov eax, dword [ebp]
push eax
mov eax, dword [0x100636d8]
push eax
mov eax, dword [0x100636b8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov esi, eax
push esi
push ebx
call sub.gdi32.dll_SelectObject
mov eax, dword [0x10063688]
push eax
push 0
push 0
mov eax, dword [0x100636b8]
push eax
mov eax, dword [ebp]
push eax
mov eax, dword [0x100636d8]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
test eax, eax
jne 0x10056dca
mov byte [esp], 0
push ebx
call sub.gdi32.dll_DeleteDC
push esi
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x100636b8]
push eax
push 0
call sub.user32.dll_ReleaseDC
jmp 0x10056ec2
push 0
mov eax, dword [0x100636bc]
push eax
mov eax, dword [0x100636c4]
push eax
mov eax, dword [ebp]
push eax
push 0
push esi
push ebx
call sub.gdi32.dll_GetDIBits
push ebx
call sub.gdi32.dll_DeleteDC
push esi
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x100636b8]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp]
push eax
mov eax, dword [0x100636d8]
push eax
push 0
push 0
lea eax, [esp + 0x11]
push eax
call sub.user32.dll_SetRect
cmp dword [edi], 0
je 0x10056e23
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GlobalFree
cmp dword [0x100636a0], 0
je 0x10056e37
mov eax, dword [0x100636a0]
push eax
call sub.kernel32.dll_GlobalFree
mov eax, dword [ebp]
imul dword [0x100636dc]
add eax, dword [0x100636d4]
mov dword [edi + 8], eax
mov ebx, eax
shl ebx, 2
mov dword [edi + 4], ebx
push ebx
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [edi], eax
mov ebx, dword [edi + 8]
shl ebx, 2
mov dword [0x100636a4], ebx
push ebx
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [0x100636a0], eax
mov edx, dword [edi]
mov eax, dword [0x100636bc]
mov ecx, dword [0x100636d4]
call fcn.10002cd0
mov eax, dword [edi]
xor edx, edx
push edx
push eax
mov eax, dword [0x100636d4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, eax
mov ecx, dword [ebp]
imul ecx, dword [0x100636dc]
mov eax, dword [0x100636c4]
call fcn.10002cd0
mov al, 1
call fcn.10056b14
xor eax, eax
mov dword [edi + 8], eax
mov byte [esp], 1
mov al, byte [esp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10057710
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x1005c2f4], 0
je 0x10057774
cmp dword [0x10063690], 0
je 0x1005773e
mov eax, dword [0x10063690]
cmp dword [eax + 0x18], 0
je 0x10057737
mov eax, dword [0x10063690]
call fcn.1004d518
xor eax, eax
mov dword [0x10063690], eax
push 0x3e8
mov eax, dword [0x100636b4]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x10057762
push 0
mov eax, dword [0x1005c2f4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x1005c2f4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [0x1005c2f4], eax
ret

Function at 0x10057f90
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
cmp dword [esp + 8], 0x4000000
setb al
add esp, 0x20
ret

Function at 0x10057fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
xor edx, edx
mov dword [ebp - 4], edx
test ebx, ebx
je 0x100580cb
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x100580cb
xor eax, eax
push ebp
push 0x100580c4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x100000
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 0x99
mov edx, 0x100000
call fcn.10003054
xor eax, eax
push ebp
push 0x100580a6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, dword [ebp - 4]
jbe 0x1005808f
push 2
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
mov esi, ebx
sub esi, dword [ebp - 4]
cmp esi, 0x100000
jae 0x10058061
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x1005808f
jmp 0x1005807d
push 0
lea eax, [ebp - 0xc]
push eax
push 0x100000
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x1005808f
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
push 1
call sub.kernel32.dll_Sleep_1
cmp ebx, dword [ebp - 4]
ja 0x1005802b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100580ad
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalFree
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10058410
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1005c45c]
cmp dword [eax], 0
je 0x10058454
mov eax, dword [0x1005c5e0]
cmp dword [eax], 0
je 0x1005843c
mov eax, dword [0x1005c4f8]
push eax
push 0
push 0
push 0x100581c4
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, dword [0x1005c4f8]
push eax
push 0
push 0
push 0x10058210
push 0
push 0
call sub.kernel32.dll_CreateThread_1
call fcn.1004f7cc
call fcn.1004b7d0
call fcn.1004e78c
call fcn.1004bf08
mov dl, 1
mov eax, dword [0x10052848]
call fcn.10052c2c
ret
Function at 0x14f4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14f41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x14f407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x14f406a
add dl, dl
jne 0x14f4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x14f40dc
xor eax, eax
add dl, dl
jne 0x14f4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x14f417d
add dl, dl
jne 0x14f40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14f40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14f40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14f40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x14f40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x14f4075
mov eax, 1
add dl, dl
jne 0x14f40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14f40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x14f40e1
sub eax, ebx
mov ebx, 1
jne 0x14f4128
mov ecx, 1
add dl, dl
jne 0x14f410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14f4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x14f4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x14f4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14f413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14f414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x14f4136
cmp eax, 0x7d00
jae 0x14f416d
cmp eax, 0x500
jb 0x14f4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x14f4075
cmp eax, 0x7f
ja 0x14f4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x14f4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x14f419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x14f4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x408950
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
sub edx, edi
sub edx, edi
call fcn.00408970
inc edi
xor dword [esi], ecx
inc esi
or edx, edx
cmp esi, ebx
jne fcn.00408950
ret
Function at 0x40607d
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x44a200], 2
jl 0x4060a2
movaps xmm0, xmmword [0x4347f0]
movaps xmmword [0x441040], xmm0
movaps xmm0, xmmword [0x4347e0]
movaps xmmword [0x441050], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.0040642a
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x4347b8]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x4060b0
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x406793
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x4067bd
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x441060]
inc edi
sub esi, 1
jne 0x4067a5
pop edi
mov eax, edx
pop esi
ret 0xc

Function at 0x4069aa
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
xor ebp, ebp
cmp dword [edi], 2
lea esi, [edi + 4]
jne 0x406a00
mov eax, dword [esi]
push ebx
push ebp
push ebp
push ebp
push ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x20
push dword [esp + 0x5c]
call fcn.00407094
mov edx, ebp
mov ebx, ebp
movzx eax, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor eax, ebx
inc edx
mov ebx, eax
cmp edx, 0x20
jb 0x4069e4
mov dword [esi], eax
pop ebx
cmp dword [edi], 3
jne 0x406a2c
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
push 0x20
push esi
push 0x20
push dword [esp + 0x58]
call fcn.00407094
push 0x20
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00422dc0
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x24
ret 8
Function at 0x406def
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x864
push ebp
mov ebp, dword [esp + 0x880]
mov eax, ecx
mov dword [esp + 4], eax
cmp ebp, 0x18
ja 0x406fcd
push ebx
push esi
xor ebx, ebx
lea esi, [eax + 0xf4]
push edi
mov edi, ebx
push dword [esp + 0x87c]
mov ecx, esi
call fcn.00410560
test al, al
je 0x406e4d
lea eax, [esi + 0x10]
cmp dword [eax + 0x30], ebp
jne 0x406e4d
push 0x10
push dword [esp + 0x888]
push eax
call fcn.00421742
add esp, 0xc
test eax, eax
je 0x406fd7
inc edi
add esi, 0x84
cmp edi, 4
jb 0x406e19
mov esi, 0x800
lea eax, [esp + 0x74]
push esi
push eax
push dword [esp + 0x888]
call fcn.00413170
xor eax, eax
mov ecx, ebp
inc eax
shl eax, cl
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
push dword [esp + 0x898]
lea eax, [esp + 0x8c]
push eax
call fcn.00427350
pop ecx
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0040729f
push esi
lea eax, [esp + 0x78]
push eax
call fcn.0041078b
mov edx, dword [esp + 0x10]
push dword [esp + 0x87c]
mov ecx, dword [edx + 0x304]
lea edi, [edx + 0xf4]
mov eax, ecx
and eax, 3
imul eax, eax, 0x84
add edi, eax
lea eax, [ecx + 1]
mov dword [edx + 0x304], eax
mov ecx, edi
mov dword [edi + 0x40], ebp
call fcn.00406980
push 0x10
push dword [esp + 0x888]
lea eax, [edi + 0x10]
push eax
call fcn.00422dc0
push 0x20
pop ebp
push ebp
lea eax, [esp + 0x24]
push eax
lea esi, [edi + 0x20]
push esi
call fcn.00422dc0
push ebp
lea eax, [esp + 0x50]
push eax
lea eax, [edi + 0x44]
push eax
call fcn.00422dc0
push ebp
lea eax, [esp + 0x7c]
push eax
lea eax, [edi + 0x64]
push eax
call fcn.00422dc0
add esp, 0x30
push ebx
push 1
push ebp
push esi
call fcn.0041069c
cmp dword [esp + 0x890], ebx
je 0x406f5b
push ebp
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x898]
call fcn.00422dc0
add esp, 0xc
mov esi, dword [esp + 0x894]
test esi, esi
je 0x406f8e
push 8
push ebx
push esi
call fcn.004211b0
add esp, 0xc
mov al, byte [esp + ebx + 0x34]
mov ecx, ebx
and ecx, 7
xor byte [ecx + esi], al
inc ebx
cmp ebx, ebp
jb 0x406f72
push ebp
lea eax, [esp + 0x38]
push eax
call fcn.0041078b
cmp dword [esp + 0x888], 0
pop edi
pop esi
pop ebx
je 0x406fc2
push dword [esp + 0x87c]
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 0x100
push eax
push dword [esp + 0x878]
add ecx, 0x30c
call fcn.0040fbb0
push ebp
lea eax, [esp + 0xc]
push eax
call fcn.0041078b
pop ebp
add esp, 0x864
ret 0x20
push 0x20
pop ebp
push ebp
lea eax, [esi + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00422dc0
add esp, 0xc
lea eax, [esp + 0x14]
push ebx
push ebx
push ebp
push eax
call fcn.0041069c
push ebp
lea eax, [esi + 0x44]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00422dc0
push ebp
lea eax, [esi + 0x64]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00422dc0
add esp, 0x18
jmp 0x406f3d