joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
jmp 0x49b21e
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x33d6
xor cx, word [eax*2 + 0x5de218]
inc eax
mov word [ebp + eax*2 - 0x10a], cx
cmp eax, 0xc
jl 0x49b225
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x5ec5
xor dx, word [eax*2 + 0x5de234]
inc eax
mov word [ebp + eax*2 - 0x20a], dx
jmp 0x4d7080
cmp eax, 5
jl 0x49b24a
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
push 0x3000
push ebx
push 0
push edi
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00580ad2
mov esp, ebp
pop ebp
ret

Function at 0x43db26
Capabilities:
Encode data using xor

Disassembly:
xor dx, word [eax*2 + 0x5de284]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 5
jl 0x53bc75
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6eba98], eax
push 0x4f3bfa
ret
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
test byte [0x6eba9c], cl
jne 0x4f3bfa
or dword [0x6eba9c], ecx
xor eax, eax
jmp 0x53bc4a
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push edx
push esi
push eax
call dword [0x6eba98]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00580ad2
mov esp, ebp
pop ebp
ret
jmp 0x53bc4f
lea edx, [eax + 1]
imul edx, edx, 0x3417
xor dx, word [eax*2 + 0x5de268]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xd
jl 0x53bc4f
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x1ea7
jmp 0x41472a

Function at 0x44068e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov edi, edi
lea edx, [eax + 1]
imul edx, edx, 0x22de
xor dx, word [eax*2 + 0x5de6c0]
inc eax
mov word [ebp + eax*2 - 0x436], dx
cmp eax, 8
jl 0x437000
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.msvcrt.dll_sprintf]
push ebx
lea eax, [ebp - 0x434]
push eax
push ecx
call esi
add esp, 0xc
xor eax, eax
jmp 0x437041
lea ecx, [eax + 1]
imul ecx, ecx, 0x76b6
xor cx, word [eax*2 + 0x5de6d4]
inc eax
mov word [ebp + eax*2 - 0x436], cx
push 0x5a5554
ret
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x538], ecx
jmp 0x436ffc
Function at 0x46a5d6
Capabilities:
Encode data using xor

Disassembly:
push ecx
call ebx
add esp, 0xc
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x5c2e
xor dx, word [eax*2 + 0x5de644]
inc eax
mov word [ebp + eax*2 - 0x20a], dx
cmp eax, 2
jl 0x4260d6
push edi
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x108]
jmp 0x5ae490
je 0x553295
jmp 0x44c537
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x10d3
xor cx, word [eax*2 + 0x5de628]
inc eax
mov word [ebp + eax*2 - 0x20a], cx
cmp eax, 0xc
jl 0x44c539
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll_strstr]
add esp, 8
test eax, eax
je 0x5ae49a
push esi
lea ecx, [ebp - 0x108]
push 0x100
jmp 0x4260ce
push ebp
mov ebp, esp
sub esp, 0x308
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [edi], eax
jmp 0x4c6fce
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push ebx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push esi
lea edx, [ebp - 0x308]
mov dword [edi + 0x18], eax
push edx
mov eax, 0x72
push ecx
mov dword [edi + 0xc], 0xbb8
mov word [ebp - 0x308], ax
call dword [sym.imp.msvcrt.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x55329f
mov ebx, dword [sym.imp.msvcrt.dll_fgets]
push esi
lea eax, [ebp - 0x108]
push 0x100
push eax
call ebx
add esp, 0xc
test eax, eax
jmp 0x44c52c
push 0x100
push edx
call ebx
add esp, 0xc
xor eax, eax
mov edi, edi
lea ecx, [eax + 1]
imul ecx, ecx, 0x4350
xor cx, word [eax*2 + 0x5de65c]
inc eax
mov word [ebp + eax*2 - 0x20a], cx
cmp eax, 2
jl 0x53a02f
lea edx, [edi + 4]
push edx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.msvcrt.dll_sscanf]
add esp, 0xc
xor eax, eax
lea esp, [esp]
jmp dword [0x53a07c]
push esi
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00580ad2
mov esp, ebp
pop ebp
ret
push ecx
call dword [sym.imp.msvcrt.dll_sscanf]
add esp, 0xc
xor eax, eax
lea esp, [esp]
lea edx, [eax + 1]
imul edx, edx, 0xb19
xor dx, word [eax*2 + 0x5de64c]
inc eax
mov word [ebp + eax*2 - 0x20a], dx
cmp eax, 6
jl 0x5ae4a3
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.msvcrt.dll_strstr]
add esp, 8
test eax, eax
je 0x53a06d
push esi
lea edx, [ebp - 0x108]
jmp 0x53a020
Function at 0x4adceb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x33d0
call fcn.00573a70
mov eax, dword [section..data]
xor eax, ebp
jmp 0x4b19d0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x33bc], eax
mov dword [ebp - 0x33c4], edi
xor eax, eax
lea ecx, [ecx]
lea ecx, [eax + 1]
imul ecx, ecx, 0x7a6c
xor cx, word [eax*2 + 0x5de794]
inc eax
mov word [ebp + eax*2 - 0x318e], cx
cmp eax, 0xe
jl 0x4b19ec
lea edx, [ebp - 0x33b4]
push edx
push 1
push 0
lea eax, [ebp - 0x318c]
jmp 0x550bd8
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x550c23
xor ecx, ecx
lea edx, [ecx + 1]
imul edx, edx, 0x1991
xor dx, word [ecx*2 + 0x5de7b4]
inc ecx
mov word [ebp + ecx*2 - 0x318e], dx
cmp ecx, 6
jl 0x550bee
push eax
lea eax, [ebp - 0x318c]
push eax
push edi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
mov dword [ebp - 0x33b0], 0x3e8
push 0x4abc78
ret

Function at 0x4cd498
Capabilities:
Terminate process

Disassembly:
cmp dword [ebp - 0x1c], ebx
jne 0x414809
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x8b56e0], ebx
je 0x414832
push 0x8b56e0
call fcn.005905f4
pop ecx
test eax, eax
je 0x414832
push ebx
push 2
push ebx
call dword [0x8b56e0]
push dword [0x6a2054]
push dword [0x6a2058]
jmp 0x44927a
mov dword [0x6a206c], esi
mov eax, dword [0x8b56d8]
cmp eax, esi
jne 0x4147f8
push 0x5de164
push 0x5de15c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x8b56d8], 2
jmp dword [0x417d54]
push dword [0x6a2050]
call fcn.0057b656
add esp, 0xc
mov dword [0x6a2068], eax
cmp dword [0x6a205c], ebx
jne 0x488e2e
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
jmp 0x488e04
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x6a206c], ebx
jne 0x5b6624
jmp 0x5b661e
push 0x40100a
call fcn.00401000
call fcn.0041c9c3
jmp 0x553c2f
push 0x10
push 0x5dec68
call fcn.0058b4b2
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x8b56dc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x597673
cmp eax, esi
jne 0x553c75
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x597676
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x59766e
ret
xor esi, esi
inc esi
mov eax, dword [0x8b56d8]
cmp eax, esi
jne 0x597690
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x417d24
mov eax, dword [0x8b56d8]
test eax, eax
jne 0x417d1e
mov dword [0x8b56d8], esi
push 0x5de174
push 0x5de168
call fcn.00580ae6
pop ecx
pop ecx
test eax, eax
je 0x417d24
mov dword [ebp - 4], 0xfffffffe
jmp dword [0x5976cb]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x6a2068]
call fcn.0047f6f5
ret
Function at 0x4d70c0
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x6ebaa0], eax
push 0
push 0
push ebx
push edi
push 0
push 0
push esi
call dword [0x6ebaa0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00580ad2
mov esp, ebp
pop ebp
ret
jne 0x43db07
or dword [0x6ebaa4], ecx
xor eax, eax
jmp 0x45f56b
lea edx, [eax + 1]
imul edx, edx, 0x1d8b
xor dx, word [eax*2 + 0x5de240]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xa
jl 0x45f56b
xor eax, eax
jmp 0x57c7ec
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
test byte [0x6ebaa4], cl
jmp 0x45f558
lea edx, [eax + 1]
imul edx, edx, 0x4c32
xor dx, word [eax*2 + 0x5de258]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 7
jl 0x57c7ec
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x43db02

Function at 0x514d91
Capabilities:
Create tcp socket
Create udp socket
Encode data using xor

Disassembly:
xor eax, eax
lea esp, [esp]
lea ecx, [eax + 1]
imul ecx, ecx, 0x973
xor cx, word [eax*2 + 0x5deabc]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 5
jl 0x403dbc
lea edx, [ebp - 0x118]
push edx
call fcn.005532af
jmp 0x583a30
xor eax, eax
nop
lea ecx, [eax + 1]
imul ecx, ecx, 0x3295
xor cx, word [eax*2 + 0x5deaa8]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 9
jl 0x4865cb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea edx, [ebp - 0x118]
push edx
push 0x6a23c8
call dword [sym.imp.msvcrt.dll_sprintf]
push 0x6a23c8
call fcn.005532af
jmp dword [0x48661b]
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x6e753c], eax
cmp eax, 0xffffffff
jne 0x403db3
jmp 0x4865c8
xor eax, eax
mov ecx, esi
xor ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, 2
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
xor esi, dword [ebp + 8]
push 0x10
lea edx, [ebp - 0x14]
mov word [ebp - 0x12], ax
jmp dword [0x583a6b]
Function at 0x5242e6
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, ecx
and eax, 0x80000001
jns 0x431858
dec eax
or eax, 0xfffffffe
inc eax
je 0x431869
mov al, dl
not al
imul cl
jmp 0x431876
mov al, cl
imul dl
mov bl, al
add bl, bl
add al, bl
mov bl, byte [ebp + 0xc]
xor byte [ebp + ecx - 0x52], al
inc ecx
cmp ecx, 0x4a
jl 0x431846
test esi, esi
je 0x44067d
mov dl, bl
call fcn.005cc4ff
mov ecx, dword [ebp - 0x5c]
push 0
push edi
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x440676
mov dl, bl
call fcn.005cc4ff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00580ad2
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
mov eax, dword [0x6e753c]
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x5c], eax
je 0x431884
call dword [sym.imp.msvcrt.dll_rand]
mov ecx, 0xbb8
cdq
idiv ecx
jmp 0x594fce
inc eax
je 0x58702c
mov al, bl
not al
imul cl
jmp 0x587036
mov al, cl
imul bl
mov dl, al
add dl, dl
add al, dl
xor byte [ebp + ecx - 0x52], al
inc ecx
cmp ecx, 0x4a
jl 0x594ff4
mov ecx, dword [ebp - 0x5c]
push 0
push 0x50
lea eax, [ebp - 0x58]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp byte [ebp - 0x54], 0
je 0x431884
mov dl, byte [ebp - 0x53]
xor ecx, ecx
lea esp, [esp]
jmp 0x431846
mov dword [ebp - 0x50], 0xc
mov dword [ebp - 0xc], edi
mov byte [ebp - 0x54], 1
mov byte [ebp - 0x53], bl
mov word [ebp - 0x58], dx
mov edx, ecx
sub edx, dword [ebp - 0x58]
xor ecx, ecx
mov word [ebp - 0x56], dx
lea ebx, [ebx]
mov eax, ecx
and eax, 0x80000001
jns 0x58701b
dec eax
or eax, 0xfffffffe
jmp 0x58701a

Function at 0x54b354
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
test edi, edi
jle 0x54b386
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, eax
sub esi, eax
lea ebx, [ecx + 1]
imul ebx, dword [ebp + 8]
xor bx, word [esi + edx]
inc ecx
mov word [edx], bx
add edx, 2
cmp ecx, edi
jl 0x54b36a
pop esi
pop ebx
pop ebp
ret 8

Function at 0x54b38a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e7650], 0
jne 0x5abf8c
push 0x1000
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov dword [0x6e740c], eax
mov byte [0x6e7650], 1
jmp 0x5abf8c
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x6e740c]
lea edx, [ecx + eax*2]
xor eax, eax
mov dword [esi], edx
test edi, edi
jle 0x5abfc5
lea ebx, [ebx]
mov edx, dword [esi]
lea ecx, [eax + 1]
imul ecx, dword [ebp + 8]
xor cx, word [ebx + eax*2]
inc eax
mov word [edx + eax*2 - 2], cx
cmp eax, edi
jl 0x5abfaa
mov eax, esi
pop ebp
ret 8
Function at 0x5a146a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
test byte [0x6eba8c], cl
jne 0x5037f2
or dword [0x6eba8c], ecx
xor eax, eax
jmp 0x45a29e
lea edx, [eax + 1]
imul edx, edx, 0xe1e
xor dx, word [eax*2 + 0x5de598]
mov word [ebp + eax*2 - 0x108], dx
jmp 0x4d6136
add eax, ecx
cmp eax, 0xd
jl 0x45a29e
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x5f04
xor dx, word [eax*2 + 0x5de5b4]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 5
jl 0x4d6143
lea eax, [ebp - 0x108]
jmp dword [0x4d6175]
push 0
push 0x18
push edi
push 0
push esi
call dword [0x6eba88]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00580ad2
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x208
jmp 0x45a276

Function at 0x5abfcb
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [eax + 1]
imul ecx, ecx, 0x6279
xor cx, word [eax*2 + 0x5de180]
inc eax
mov word [ebp + eax*2 - 0x10a], cx
cmp eax, 7
jl 0x434fcc
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x4593
xor dx, word [eax*2 + 0x5de190]
inc eax
mov word [ebp + eax*2 - 0x20a], dx
cmp eax, 5
jl 0x434ff1
lea eax, [ebp - 0x108]
jmp 0x4e41b8
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4e41e3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00580ad2
mov esp, ebp
pop ebp
ret
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00580ad2
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
jmp 0x434fcc
Function at 0x401050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x35c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
mov eax, dword [esp + 0x40]
add esp, 8
add eax, 0x76c
cmp eax, 0x7e9
jl 0x4010bf
push 0x10
push 0x403160
push str.The_Duel_Evolution_Offline_mod_alpha_test_has_expired._Please_update_to_newest_version.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.TitanEngine.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x4010e8
push 0x10
push 0x403160
push str.Failed_to_load_TitanEngine.dll
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40122a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitDebug
push edi
call esi
push str.AttachDebugger
push edi
mov dword [esp + 0x18], eax
call esi
push str.DebugLoop
push edi
mov dword [esp + 0x20], eax
call esi
push str.SetCustomHandler
push edi
mov ebx, eax
call esi
cmp dword [esp + 0x10], 0
mov esi, eax
je 0x40120f
cmp dword [esp + 0x18], 0
je 0x40120f
test ebx, ebx
je 0x40120f
test esi, esi
je 0x40120f
push 0x104
lea eax, [esp + 0x154]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401171
push 0x10
push str.Error
push str.Failed_to_get_the_module_file_name
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401223
lea eax, [esp + 0x150]
push eax
lea eax, [esp + 0x4c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
lea eax, [esp + 0x48]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
mov byte [eax], 0
lea eax, [esp + 0x50]
push eax
push str._syo2.exe
lea eax, [esp + 0x268]
push 0x104
push eax
call fcn.00401010
lea eax, [esp + 0x60]
mov byte [esp + 0x2f], 0
push eax
lea eax, [esp + 0x33]
push eax
lea eax, [esp + 0x278]
push eax
call dword [esp + 0x34]
add esp, 0x24
test eax, eax
jne 0x4011ef
push 0x10
push str.Error
push str.Failed_to_initialize_debugging_with_TitanEngine
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401223
push 0
call esi
add esp, 4
push 0
call ebx
add esp, 4
test eax, eax
jne 0x401223
push 0x10
push 0x403160
push str.Failed_to_start_debug_loop_with_TitanEngine
jmp 0x40121b
push 0x10
push 0x403160
push str.Failed_to_get_function_addresses_from_TitanEngine.dll
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401250
mov ecx, dword [esp + 0x364]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040151a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401896
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x4018cb
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x4018c8
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x4018d4
add edx, 0x28
cmp edx, esi
jne 0x4018b6
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x4018d1

Function at 0x401d43
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401d82
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401d82
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401d82
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401d82
cmp dword [ecx + 0x74], 0xe
jbe 0x401d82
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402c63
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x453673
call fcn.0043d272
lea ecx, [ebp - 0x1c]
call fcn.0042d9b2
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
call fcn.00402e8f
or dword [ebp - 4], 0xffffffff
call fcn.0042d9c8
and dword [ebp - 0x18], 0
push 0x21
push 1
mov edi, 0x400000
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x402d66
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x402d5d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x402d66
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x402d66
mov dword [ebp - 4], 3
shr esi, 1
lea edi, [eax + esi*2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, edi
je 0x402d29
cmp word [esi], bx
jne 0x402d25
cmp dword [ebp - 0x20], ebx
je 0x402d1f
push dword [ebp - 0x20]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
call fcn.00402df9
lea eax, [esi + 2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
jmp 0x402d25
lea eax, [esi + 2]
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x402cf5
or dword [ebp - 4], 0xffffffff
jmp 0x402d64
mov dword [ebp - 0x18], 1
jmp 0x402d6e
call fcn.00403451
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x402d91
call fcn.0043d317
ret 4
Function at 0x406761
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4067c4
cmp dword [ebp + 0xc], 1
je 0x40679d
cmp dword [ebp + 0xc], 2
je 0x40679d
push 0xd
pop eax
jmp 0x4067c4
test edi, edi
mov eax, dword [ebp - 4]
je 0x4067be
test eax, eax
je 0x4067ba
test al, 1
jne 0x406798
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4067be
jmp 0x406798
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x40a347
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x45514b
call fcn.0043d23f
mov eax, dword [esi + 0xa0]
cmp eax, 1
jge 0x40a37d
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.004047a7
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x474b18
jmp fcn.0040f39b
lea edi, [esi + 0x98]
dec eax
mov ecx, edi
call fcn.004099a5
mov ebx, str.CFinishedPage
push ebx
mov ecx, eax
call fcn.00401ed3
test eax, eax
je 0x40a3a7
push ebx
push dword [edi + 8]
mov ecx, edi
call fcn.004328e5
mov eax, dword [esi + 0xa0]
dec eax
lea ecx, [esi + 0x90]
cmp dword [ecx], eax
je 0x40a3da
mov dword [ecx], eax
mov ecx, edi
call fcn.004099a5
push dword [eax]
call fcn.004387b4
pop ecx
push eax
push 0
push 0x8002
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043d317
ret

Function at 0x40a3e0
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x45514b
call fcn.0043d23f
lea esi, [edi + 0xa0]
mov eax, dword [esi]
cmp eax, 1
jne 0x40a408
cmp dword [edi + 0x90], 0
jne 0x40a408
push edi
call fcn.0040a555
mov esi, dword [esi]
cmp esi, 1
jge 0x40a42e
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.004047a7
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x474b18
jmp fcn.0040f39b
dec esi
cmp dword [edi + 0x90], esi
je 0x40a449
push 0
push 0
push 0x8002
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0043d317
ret
Function at 0x40da24
Capabilities:
Move file

Disassembly:
push 0x24
mov eax, 0x455018
call fcn.0043d272
lea ecx, [ebp - 0x30]
call fcn.0042d9b2
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004061e7
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.004097da
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
push 0x45e738
lea ecx, [ebp - 0x14]
call fcn.00414b45
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
test eax, eax
jge 0x40daa0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.00415e8b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401b5e
or dword [ebp - 4], 0xffffffff
call fcn.0042d9c8
mov eax, dword [ebp - 0x1c]
call fcn.0043d317
ret 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
call fcn.0041a7a0
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x40da73
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40dac9
and dword [ebp - 0x14], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x18]
push eax
mov esi, dword [ebp + 0x18]
mov ecx, esi
call fcn.00401ae9
push str..exe
mov ecx, esi
call fcn.00409b0f
push dword [esi]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40da73
call fcn.00403451
mov dword [ebp - 0x1c], eax
jmp 0x40da73