joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ced8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
or eax, 0xed75
call 0x42cdf7
add byte [edi], bh
inc ebx
dec edi
cmp al, byte [ecx + 0x36]
add esp, 4
jmp fcn.0042ce03
add eax, 0xe16f
pop eax
push esi
push ecx
add esp, 4
jmp 0x42ce15
pop esi
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
push eax
add esp, 4
call 0x42ce54
add byte [ebp + edi + 0x4e], cl
inc esi
inc esp
inc edx
inc esp
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
leave
xchg esi, eax
add byte [eax], al
pop ecx
push ebx
push eax
add esp, 4
jmp 0x42ce6b
or ebx, 0xcbbe
pop ebx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
call 0x42ced8
add byte [esi + 0x3e], cl
dec edi
dec ebp
cmp dword [edi + 0x43], eax
add esp, 4
call 0x42ceea
add byte [esi], bh
dec ebx
inc edi
inc ecx
inc edx
dec edx
aaa
xor al, 0x83
les eax, [ecx + eax*4]
loope 0x42cf0c
push es
add dword [eax], eax
pop ecx
push eax
jmp 0x42cefa
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42cf18
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x42cf72
inc ebp
les ebp, [ebx]
ror byte [ecx - 0x155f6b], 1
invalid
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x42ce40
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x42ce40
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x42cf5c
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x42cf66
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x42cfbb
push edx
jmp 0x42cf83
jmp 0x42cf8c
xor edx, 0x10dc8
pop edx
push ebx
and ebx, 0x10e89
pop ebx
push eax
push ebx
add esp, 4
and eax, 0x1889
xor eax, 0x14e41
pop eax
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp fcn.0042d023
push eax
or eax, 0x5fd8
pop eax
push edx
xor edx, 0x15
sub edx, 0x39cc
pop edx
push edx
or edx, 0x8044
jmp 0x42cfe0
pop edx
push edi
push eax
add esp, 4
add edi, 0x16dc0
pop edi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x42d019
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x42cde4
mov dword [ebp - 0x710], 0
Function at 0x42ceea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
or eax, 0xed75
call 0x42cdf7
add byte [edi], bh
inc ebx
dec edi
cmp al, byte [ecx + 0x36]
add esp, 4
jmp fcn.0042ce03
add eax, 0xe16f
pop eax
push esi
push ecx
add esp, 4
jmp 0x42ce15
pop esi
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
push eax
add esp, 4
call 0x42ce54
add byte [ebp + edi + 0x4e], cl
inc esi
inc esp
inc edx
inc esp
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
leave
xchg esi, eax
add byte [eax], al
pop ecx
push ebx
push eax
add esp, 4
jmp 0x42ce6b
or ebx, 0xcbbe
pop ebx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
call 0x42ced8
add byte [esi + 0x3e], cl
dec edi
dec ebp
cmp dword [edi + 0x43], eax
add esp, 4
call 0x42ceea
add byte [esi], bh
dec ebx
inc edi
inc ecx
inc edx
dec edx
aaa
xor al, 0x83
les eax, [ecx + eax*4]
loope 0x42cf0c
push es
add dword [eax], eax
pop ecx
push eax
jmp 0x42cefa
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42cf18
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x42cf72
inc ebp
les ebp, [ebx]
ror byte [ecx - 0x155f6b], 1
invalid
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x42ce40
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x42ce40
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x42cf5c
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x42cf66
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x42cfbb
push edx
jmp 0x42cf83
jmp 0x42cf8c
xor edx, 0x10dc8
pop edx
push ebx
and ebx, 0x10e89
pop ebx
push eax
push ebx
add esp, 4
and eax, 0x1889
xor eax, 0x14e41
pop eax
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp fcn.0042d023
push eax
or eax, 0x5fd8
pop eax
push edx
xor edx, 0x15
sub edx, 0x39cc
pop edx
push edx
or edx, 0x8044
jmp 0x42cfe0
pop edx
push edi
push eax
add esp, 4
add edi, 0x16dc0
pop edi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x42d019
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x42cde4
mov dword [ebp - 0x710], 0
Function at 0x42d54b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
push ebx
push eax
add esp, 4
xor ebx, 0x501f
add ebx, 0xd57c
sub ebx, 0x1019a
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push eax
push ebx
add esp, 4
call 0x42d54b
add byte [esi + 0x44], al
cmp byte [ecx], bh
cmp esi, dword [0x39414644]
add esp, 4
pop eax
push esi
or esi, 0xf82b
add esi, 0x15b67
sub esi, 0x2657
jmp 0x42d567
pop esi
cmp dword [ebp - 0x1574], 0
jne 0x42d580
mov dword [ebp - 0x2a8], 0
jmp 0x42d827
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push ebx
add ebx, 0xa4e
jmp 0x42d59f
add ebx, 0x9f18
pop ebx
push ecx
push ebx
add esp, 4
and ecx, 0x1a00
xor ecx, 0x11095
and ecx, 0x18192
add ecx, 0x62ed
pop ecx
cmp dword [ebp - 0xc68], 0
jne 0x42d5dc
mov dword [ebp - 0x2a8], 0
jmp 0x42d827
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
Function at 0x42d66c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
add esp, 4
sub edx, 0x13266
pop edx
push edi
push esi
add esp, 4
and edi, 0xe350
sub edi, 0x165ad
or edi, 0x167de
pop edi
push edx
add edx, 0x2abb
sub edx, 0xbbc7
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push eax
add esp, 4
or ecx, 0x16871
pop ecx
push edx
jmp 0x42d657
sub edx, 0xa2c0
call 0x42d66c
add byte [ecx], bh
dec edx
dec eax
cmp byte [ebp + 0x4c], cl
inc edi
inc esi
cmp eax, dword [ebx - 0x157efb3c]
sub eax, 0x5a000159
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edx
push ebx
add esp, 4
add edx, 0xc20
call 0x42d6e7
add byte [edx], bh
dec esp
xor esi, dword [edi]
dec esp
inc esp
xor al, 0x35
cmp byte [ebx + 0x535a04c4], al
push esi
add esp, 4
jmp fcn.0042d6f9
jmp 0x42d6fe
pop ebx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x42d71c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x42d776
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x42d644
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x42d644
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x42d760
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x42d76a
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x42d7bf
push edx
push edx
add esp, 4
or edx, 0x14612
sub edx, 0x89f5
pop edx
push esi
push eax
add esp, 4
or esi, 0xf087
sub esi, 0x15573
add esi, 0x142e0
jmp fcn.0042d7b0
push eax
call 0x42d7cd
add byte [eax], bh
dec edi
inc edx
inc ecx
dec ebx
xor al, 0x32
add esp, 4
add eax, 0xf9c4
add eax, 0x93f2
pop eax
push edx
sub edx, 0xc7f4
sub edx, 0x15b33
and edx, 0xf373
pop edx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x42d81d
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x42d5e8
mov dword [ebp - 0x2a8], 0
Function at 0x42d6e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
add esp, 4
sub edx, 0x13266
pop edx
push edi
push esi
add esp, 4
and edi, 0xe350
sub edi, 0x165ad
or edi, 0x167de
pop edi
push edx
add edx, 0x2abb
sub edx, 0xbbc7
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push eax
add esp, 4
or ecx, 0x16871
pop ecx
push edx
jmp 0x42d657
sub edx, 0xa2c0
call 0x42d66c
add byte [ecx], bh
dec edx
dec eax
cmp byte [ebp + 0x4c], cl
inc edi
inc esi
cmp eax, dword [ebx - 0x157efb3c]
sub eax, 0x5a000159
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edx
push ebx
add esp, 4
add edx, 0xc20
call 0x42d6e7
add byte [edx], bh
dec esp
xor esi, dword [edi]
dec esp
inc esp
xor al, 0x35
cmp byte [ebx + 0x535a04c4], al
push esi
add esp, 4
jmp fcn.0042d6f9
jmp 0x42d6fe
pop ebx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x42d71c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x42d776
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x42d644
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x42d644
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x42d760
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x42d76a
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x42d7bf
push edx
push edx
add esp, 4
or edx, 0x14612
sub edx, 0x89f5
pop edx
push esi
push eax
add esp, 4
or esi, 0xf087
sub esi, 0x15573
add esi, 0x142e0
jmp fcn.0042d7b0
push eax
call 0x42d7cd
add byte [eax], bh
dec edi
inc edx
inc ecx
dec ebx
xor al, 0x32
add esp, 4
add eax, 0xf9c4
add eax, 0x93f2
pop eax
push edx
sub edx, 0xc7f4
sub edx, 0x15b33
and edx, 0xf373
pop edx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x42d81d
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x42d5e8
mov dword [ebp - 0x2a8], 0
Function at 0x42d7cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
add esp, 4
sub edx, 0x13266
pop edx
push edi
push esi
add esp, 4
and edi, 0xe350
sub edi, 0x165ad
or edi, 0x167de
pop edi
push edx
add edx, 0x2abb
sub edx, 0xbbc7
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push eax
add esp, 4
or ecx, 0x16871
pop ecx
push edx
jmp 0x42d657
sub edx, 0xa2c0
call 0x42d66c
add byte [ecx], bh
dec edx
dec eax
cmp byte [ebp + 0x4c], cl
inc edi
inc esi
cmp eax, dword [ebx - 0x157efb3c]
sub eax, 0x5a000159
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edx
push ebx
add esp, 4
add edx, 0xc20
call 0x42d6e7
add byte [edx], bh
dec esp
xor esi, dword [edi]
dec esp
inc esp
xor al, 0x35
cmp byte [ebx + 0x535a04c4], al
push esi
add esp, 4
jmp fcn.0042d6f9
jmp 0x42d6fe
pop ebx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x42d71c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x42d776
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x42d644
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x42d644
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x42d760
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x42d76a
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x42d7bf
push edx
push edx
add esp, 4
or edx, 0x14612
sub edx, 0x89f5
pop edx
push esi
push eax
add esp, 4
or esi, 0xf087
sub esi, 0x15573
add esi, 0x142e0
jmp fcn.0042d7b0
push eax
call 0x42d7cd
add byte [eax], bh
dec edi
inc edx
inc ecx
dec ebx
xor al, 0x32
add esp, 4
add eax, 0xf9c4
add eax, 0x93f2
pop eax
push edx
sub edx, 0xc7f4
sub edx, 0x15b33
and edx, 0xf373
pop edx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x42d81d
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x42d5e8
mov dword [ebp - 0x2a8], 0
Function at 0x431d82
Capabilities:
Encode data using xor

Disassembly:
push 0xeade978b
add dword [ecx], eax
push ebp
push esp
test esi, eax
push es
sub ebp, 0xffffff83
add eax, dword es:[edx]
add eax, dword [edx]
xor ebp, 0xffffffb0
je 0x431d9b
add bl, byte [ebp + 0x53]
push ebx
sub ebx, 0x4c
daa
add al, byte [edx]
pop ebx
pop ecx
push ebx
test esi, eax
push es
or ecx, 0xffffff83
lds eax, [edx]
add ah, byte [ecx + 0x59]
pop ecx
test esi, eax
push es
xor ecx, 0xfffffff7
das
add eax, dword [edx]
popal
enter 0xffffffffffffa287, 0xfffffffffffffff9
add dword [ecx], eax
dec esi
xchg dword [edx + 0x4e0101f9], esp
enter 0xffffffffffffa387, 0xfffffffffffffff9
add dword [ecx], eax
jno 0x431d92
xchg dword [ecx + edi*8 - 0x379cfeff], esp
xchg dword [ebp + 0x660101f9], esp
enter 0xffffffffffffa687, 0xfffffffffffffff9
add dword [ecx], eax
dec esi
enter 0xffffffffffffa787, 0xfffffffffffffff9
add dword [ecx], eax
imul ecx, eax, 0xffffff87
test al, 0xf9
add dword [ecx], eax
enter 0xffffffffffffa987, 0xfffffffffffffff9
add dword [ecx], eax
je 0x431dbc
xchg dword [edx + 0x630101f9], ebp
enter 0xffffffffffffab87, 0xfffffffffffffff9
add dword [ecx], eax
je 0x431dca
xchg dword [ecx + edi*8 - 0x3784feff], ebp
xchg dword [ebp + 0x590101f9], ebp
enter 0xffffffffffffae87, 0xfffffffffffffff9
add dword [ecx], eax
add ah, byte [esi - 0x5d]
sbb al, byte [edx]
add al, byte [edx]
mov eax, dword [edi + 0x101e856]
lea ecx, [edi + 0x101e856]
lea edx, [ebx + 0x32]
mov edx, dword [edi + 0x101e852]
push edx
call 0x87d01f34
push edx
call 0x87ce1f3a
ljmp 0xf383
mov bl, 0x51
add eax, dword [edx]
ljmp 0x4f02

Function at 0x43896d
Capabilities:
Encode data using xor

Disassembly:
inc ebp
pop ebx
enter 0xffffffffffff9287, 0xfffffffffffffff6
add dword [ecx], eax
push esp
enter 0xffffffffffff9387, 0xfffffffffffffff6
add dword [ecx], eax
jbe 0x438946
xchg dword [esi + esi*8 - 0x3791feff], edx

Function at 0x445719
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x445735
mov eax, dword [esp + 0x10]
cmp byte [eax + 5], 1
jne 0x44578d
push 0
push 0
push 0xe
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x44574d
mov edi, 0x7fff
push ebp
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
mov esi, eax
push esi
push ebp
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov word [esi + edi*2], cx
pop ebp
test eax, eax
jg 0x445798
push esi
call fcn.004112ef
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov edi, dword [esp + 0x10]
cmp byte [edi + 0xc], 0
jne 0x4457b3
push esi
call fcn.004112d5
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [edi + 0x24]
push eax
push esi
call fcn.00413772
add esp, 8
push esi
test eax, eax
je 0x445785
mov byte [edi + 0xe8], 1
call fcn.004112ef
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x44b2e9
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
sub dword [0x49223c], 1
jne 0x44b2f8
call fcn.00443390
mov ecx, dword [0x4a72e4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a72e4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x44b341
fadd qword [0x48c528]
fmul qword [0x48c530]
pop ecx
ret

Function at 0x44b64f
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x30], 0
lea esi, [edi + 0x30]
je 0x44b6b7
mov eax, dword [edi + 0x34]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ebx, [edi + 0x34]
push eax
push ebx
call ebp
cmp eax, 0x1f6
je 0x44b6b5
add edi, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi]
push 0x1f6
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call fcn.004356cd
add esp, 4
push 0x1f6
push ebx
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
pop edi
pop esi
ret 4

Function at 0x44bbc9
Capabilities:
Move file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x438
push ebx
mov bl, byte [esp + 0x448]
lea eax, [esp + 0x230]
call fcn.0040ffb0
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x24]
call fcn.0040ffb0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44bc48
test bl, bl
je 0x44bc71
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x234]
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x44bc3e
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
pop ebx
add esp, 0x438
ret
lea eax, [esp + 0x230]
push eax
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc71
lea ecx, [esp + 0x24]
push ecx
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc7b
test bl, bl
jne 0x44bc9d
xor al, al
pop ebx
add esp, 0x438
ret
lea edx, [esp + 0x24]
push edx
call fcn.004366be
add esp, 4
test al, al
je 0x44bc71
lea eax, [esp + 0x24]
push eax
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc71
lea ecx, [esp + 0x230]
push 0x487240
push ecx
call fcn.00411663
lea edx, [esp + 0x238]
push edx
call fcn.004112d5
lea edx, [esp + 0x30]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x242], cx
call fcn.004112d5
xor ecx, ecx
mov word [esp + eax*2 + 0x36], cx
lea edx, [esp + 0x240]
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], edx
add esp, 0x10
mov dword [esp + 0x10], eax
xor eax, eax
lea edx, [esp + 4]
mov ecx, 0x614
push edx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x438
ret
Function at 0x10085070
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x10091040]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x1a4], 0x101
mov dword [ebp - 0x1a0], 0
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x1a4]
push ecx
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x100850c2
call sub.WS2_32.dll_WSACleanup
jmp 0x100850e5
movzx edx, word [ebp - 0x198]
movzx eax, word [ebp - 0x1a4]
cmp edx, eax
je 0x100850db
call sub.WS2_32.dll_WSACleanup
jmp 0x100850e5
mov dword [ebp - 0x1a0], 1
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008f0a6
mov esp, ebp
pop ebp
ret
Function at 0x10086cf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10086d5e
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14