joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022960
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100229f2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x100229e4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x100229dc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x100229a5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x10022d40
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x10022d56
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
ret
or eax, 0xffffffff
ret

Function at 0x10022d60
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x10022db1
mov ecx, dword [esp + 0x19c]
push ecx
call fcn.10022d40
add esp, 4
cmp eax, 0xffffffff
je 0x10022dac
push eax
call sub.WS2_32.dll_inet_ntoa
mov esi, eax
push esi
call dword [0x10040f8c]
push eax
push esi
call fcn.10024a50
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x190
ret
Function at 0x10022dd0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x10022e51
je 0x10022e42
cmp eax, 0x80000101
ja 0x10022e3b
je 0x10022e42
cmp eax, 0x80000004
je 0x10022e1c
cmp eax, 0x80000005
jne 0x10022e66
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x10022eb3
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x10022eb3
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call dword [0x10040f8c]
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x10022eb3
cmp eax, 0x80000201
jne 0x10022e66
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x10022eb3
cmp eax, 0x80000401
je 0x10022e9e
cmp eax, 0x80000501
je 0x10022e86
cmp eax, 0x80000601
je 0x10022e6e
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.1002d2fc
mov dword [esp + 0xc], eax
jmp 0x10022eaf
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.1002d2fc
mov dword [esp + 0xc], eax
jmp 0x10022eaf
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.100256a0
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call dword [0x10040f8c]
add esp, 8
test esi, esi
je 0x10022f8c
test eax, eax
je 0x10022f8c
inc eax
push edi
push eax
call fcn.1002d42e
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1002d720
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10022f2e
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10022f82
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10022f77
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.1002d43c
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10023110
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.1001fd90
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x10023167
push ebx
push edi
call fcn.1001fea0
push esi
mov ebx, esi
call fcn.1001fd90
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x1002313e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x10023170
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x100231f0
push edi
call dword [0x10040f8c]
add esp, 4
test eax, eax
jbe 0x100231f0
test esi, esi
je 0x100231ae
cmp esi, 0xffffffff
je 0x100231ae
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x10023232
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x100231dc
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x100231f0
jmp 0x100231eb
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x100231f0
mov ebp, 1
test esi, esi
je 0x10023232
cmp esi, 0xffffffff
je 0x10023232
test ebp, ebp
jne 0x10023269
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x1002323f
call edi
test eax, eax
je 0x10023232
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x10023269
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x1002321a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x10023232
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x10023269
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x1002324c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x10040f8c]
inc eax
push eax
call fcn.1001fde0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x100232d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.100256a0
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x10040f8c]
add esp, 8
test ebx, ebx
je 0x10023414
test eax, eax
je 0x10023414
inc eax
push eax
call fcn.1002d42e
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1002d720
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10023342
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10023401
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.1002d42e
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x100233ca
cmp eax, 0xea
jne 0x100233ed
push esi
call fcn.1002d43c
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1002d42e
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x10023395
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x100233d8
cmp eax, 2
jne 0x100233ed
push esi
call dword [0x10040f8c]
push eax
push esi
call fcn.10024a50
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.1002d43c
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.1002d43c
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x1002343d
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x10023449
mov esi, dword [esp + 0x40]
test esi, esi
je 0x10023449
push esi
call dword [0x10040f8c]
push eax
push esi
call fcn.10024a50
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10023fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10023fc1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1002401b
inc edi
cmp edi, esi
jl 0x10023fb5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10024050
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x1002400a
cmp byte [eax], bl
je 0x10024025
cmp byte [eax + 1], bl
je 0x1002402e
cmp byte [eax + 2], bl
je 0x10024038
cmp byte [eax + 3], bl
je 0x10024044
add eax, 4
cmp eax, edi
jb 0x10023fe1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x100243e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x10024412
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x10024472
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x10024449
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x10024520
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x100245bc
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x1002454b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret
Function at 0x1003573
Capabilities:
Check mutex on windows

Disassembly:
push 0x1c
push 0x10042c8
call fcn.01003a04
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push eax
push 0x64
call sub.BDEHDCFGLIB.dll_BdeCfgLoadResourceString
mov dword [ebp - 0x20], eax
cmp eax, ebx
jl 0x100364c
call sub.BDEHDCFGLIB.dll_BdeCfgLogInit
push 0x1001220
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x10035d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1003649
and eax, 0xffff
or eax, 0x80070000
jmp 0x1003649
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10035ee
mov dword [ebp - 0x20], 0x800700b7
jmp 0x100364c
push 0x590
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x1003606
mov ecx, eax
call fcn.01001d09
jmp 0x1003608
xor eax, eax
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, ebx
jne 0x100361a
mov dword [ebp - 0x20], 0x8007000e
jmp 0x100364c
mov ecx, esi
call fcn.01002445
mov dword [ebp - 0x20], eax
cmp eax, ebx
jl 0x100364c
mov ecx, esi
call fcn.01001e16
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jl 0x100364c
mov byte [ebp - 0x19], 1
mov ecx, esi
call fcn.010034ed
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.01003663
mov eax, dword [ebp - 0x20]
call fcn.01003a49
ret
Function at 0x10039f3
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x10042e8
call fcn.01003a04
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1006378
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10037aa
cmp eax, esi
jne 0x100379d
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10037ad
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003784
xor esi, esi
inc esi
mov eax, dword [0x1006374]
cmp eax, esi
jne 0x10037c0
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10037ef
mov eax, dword [0x1006374]
test eax, eax
jne 0x10037e9
mov dword [0x1006374], esi
push 0x10011f0
push 0x10011e4
call fcn.010036e9
pop ecx
pop ecx
test eax, eax
je 0x10037ef
jmp 0x1003917
mov dword [0x1006038], esi
mov eax, dword [0x1006374]
cmp eax, esi
jne 0x1003813
push 0x10011e0
push 0x10011d8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006374], 2
test ebx, ebx
jne 0x100381f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100637c], 0
je 0x1003843
push 0x100637c
call fcn.01003c09
pop ecx
test eax, eax
je 0x1003843
push 0
push 2
push 0
call dword [0x100637c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100389f
test al, al
je 0x100385d
cmp dword [ebp - 0x1c], 0
jne 0x100389f
mov al, byte [esi]
test al, al
je 0x100386d
cmp al, 0x20
ja 0x100386d
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100385d
test byte [ebp - 0x3c], 1
je 0x1003879
movzx eax, word [ebp - 0x38]
jmp 0x100387c
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1006034], eax
cmp dword [0x1006028], 0
jne 0x10038f3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10038ae
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10038c1
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100384a
cmp dword [0x1006038], 0
jne 0x1003902
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1006034]
jmp 0x1003923
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01003a49
ret
call fcn.01003d56
jmp 0x100374a
Function at 0x403870
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8f791c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403a40
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.0046ae40
jmp fcn.00403870
Function at 0x40d5d0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x8f791c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d79b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40d5f9
mov eax, 0x7000000
jmp 0x40d601
test eax, eax
je 0x40d776
mov dword [esp + 0x34], eax
mov ecx, dword [0x8f791c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call fcn.0046c1f0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x881a00]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40d78e
cmp edx, 0x21
jae 0x40d782
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.004641e0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004642b0
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x6f8938]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x6f8990]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40d751
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x6f89c8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.0046c2d0
mov eax, edx
mov ecx, 0x21
call fcn.0046c3b0
nop
call fcn.0046ae40
jmp fcn.0040d5d0
Function at 0x417c90
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x8f791c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x417e8e
sub esp, 0x18
mov eax, dword [0x8f7820]
test eax, eax
jne 0x417e77
nop
nop
lea eax, [0x8f7810]
mov dword [esp], eax
call fcn.0040b1b0
mov eax, dword [0x8f7814]
test eax, eax
je 0x417cd8
cmp dword [eax + 8], 0xcc
jne 0x417d4e
mov edx, dword [0x8f7818]
test edx, edx
jne 0x417d30
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x8fc3d0]
mov dword [esp + 8], eax
call fcn.0040d7b0
mov eax, dword [esp + 0xc]
mov dword [0x8f7818], eax
mov ecx, dword [0x8f781c]
mov dword [eax], ecx
mov eax, dword [0x8f7818]
mov dword [0x8f781c], eax
movzx eax, byte [0x8f7ee0]
test al, al
jne 0x417d30
xor eax, eax
jmp 0x417e48
mov edx, dword [0x8f7818]
mov ebx, dword [edx + 4]
mov dword [0x8f7818], ebx
mov ebx, dword [0x8f7814]
mov dword [edx + 4], ebx
mov dword [0x8f7814], edx
mov edx, dword [0x8f7814]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x417e27
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402f50
mov eax, dword [0x8f7a08]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x417da0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x417de0
call fcn.0046c2b0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x8f7810]
mov dword [esp], eax
call fcn.0040b3d0
nop
lea eax, [0x8f780c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004030d0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0046c2d0
lea edx, [0x87cb4c]
movzx ebx, byte [edx + eax]
lea ebp, [0x8f7ee0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x417d30
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x417e31
mov ecx, 5
call fcn.0046c2c0
lea eax, [0x6a32a1]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043a0c0
nop
call fcn.0046ae40
jmp fcn.00417c90