joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4592a4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45944f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x459430
mov dl, 1
mov eax, dword [0x419ac0]
call fcn.00403264
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404090
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45941f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004472b0
test al, al
je 0x459412
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x459460
lea eax, [ebp - 0x254]
call fcn.004092ec
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x459412
xor eax, eax
push ebp
push 0x45940b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x459498
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4593f4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404300
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4593f4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404300
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459412
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x459315
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041e288
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459456
lea eax, [ebp - 0x260]
call fcn.00404090
ret

Function at 0x459d84
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x491bb8]
cmp byte [eax + 0xa5], 0
jne 0x459df5
cmp dword [0x491bd0], 0
jne 0x459db6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x459d40
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x491bd0], eax
cmp dword [0x491bcc], 0
jne 0x459dd1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x491bcc], eax
cmp dword [0x491bd4], 0
jne 0x459df5
push esp
push 0
push 0
push 0x459ce4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x491bd4], eax
pop edx
ret
Function at 0x459eec
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x459f03
add esp, 0xfffffff0
call fcn.004035e0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424824
mov eax, dword [0x490ad4]
cmp word [eax + 2], 0
jne 0x459f2b
mov eax, dword [0x490ad4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b5c4
mov eax, dword [0x490c20]
cmp word [eax + 2], 0
jne 0x459f45
mov eax, dword [0x490c20]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b7bc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41945c]
call fcn.00403264
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41945c]
call fcn.00403264
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4269f8]
call fcn.0042c640
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45a0cc
mov eax, dword [0x490920]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042ca10
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45bd5c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x490920]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d10c
test eax, eax
je 0x45a03a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408ccc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d134
test eax, eax
je 0x45a04e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404300
mov eax, dword [0x49071c]
cmp byte [eax], 0
jne 0x45a082
mov eax, ebx
call fcn.0045a1f4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045bf38
mov eax, ebx
call fcn.0045c8fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45a0c2
call fcn.00403638
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a474
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x491bb8]
cmp dword [eax + 0x30], 0
je 0x45a51e
cmp dword [ebx + 0x94], 0
jne 0x45a518
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45a404
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45a518
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45a4de
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45a518
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bd74
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45a4ed
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45b080
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45b0b5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404180
jmp 0x45b0c2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004040e4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c114
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c155
mov eax, esi
call fcn.004428dc
test al, al
je 0x45c155
mov eax, dword [ebx + 0x84]
call fcn.004425d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c155
push 0
mov eax, dword [ebx + 0x84]
call fcn.004425d8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x2580359d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.25802c3f
mov esi, eax
pop ecx
lea eax, [esi + 2]
cdq
push 3
pop ecx
idiv ecx
mov ecx, dword [ebp + 0x10]
shl eax, 2
cmp eax, dword [ecx]
jle 0x258035c9
or dword [ecx], 0xffffffff
jmp 0x2580364b
add esi, edi
mov dword [ecx], eax
mov dword [ebp + 0x10], esi
xor cl, cl
xor esi, esi
test eax, eax
jle 0x2580364b
push ebx
cmp edi, dword [ebp + 0x10]
jae 0x2580363e
mov edx, esi
and edx, 0x80000003
jns 0x258035ed
dec edx
or edx, 0xfffffffc
inc edx
sub edx, 0
je 0x25803625
dec edx
je 0x25803613
dec edx
je 0x25803603
dec edx
jne 0x2580362a
mov cl, byte [edi]
and cl, 0x3f
inc edi
jmp 0x2580362a
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
inc edi
mov dl, byte [edi]
shr dl, 6
jmp 0x25803621
mov cl, byte [edi]
and cl, 3
shl cl, 4
inc edi
mov dl, byte [edi]
shr dl, 4
or cl, dl
jmp 0x2580362a
mov cl, byte [edi]
shr cl, 2
mov ebx, dword [0x258120c4]
movsx edx, cl
mov dl, byte [edx + ebx]
mov ebx, dword [ebp + 0xc]
mov byte [esi + ebx], dl
jmp 0x25803645
mov edx, dword [ebp + 0xc]
mov byte [esi + edx], 0x3d
inc esi
cmp esi, eax
jl 0x258035d9
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40596d
pop dword [ebp - 0x28]
mov eax, 0x5d380dc0
sub eax, 0x5cf7b453
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xd7eac4ac
sub dword [ebp - 0x38], 0x89987f61
mov dword [ebp - 0x34], 0xdd5339bd
add dword [ebp - 0x34], 0x54e01288
mov dword [ebp - 0x30], 0xcc6cea9f
sub dword [ebp - 0x30], 0x8020a671
mov dword [ebp - 0x2c], 0xe7deb768
sub dword [ebp - 0x2c], 0xe7deb768
lea eax, [ebp - 0x38]
push eax
mov eax, 0x1c108f58
sub eax, 0x1bd01ef8
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xf7ce9cdc
sub dword [ebp - 0x38], 0x835c3386
mov dword [ebp - 0x34], 0x1b5df7a3
sub dword [ebp - 0x34], 0xd9f1962e
mov dword [ebp - 0x30], 0x144e48e8
sub dword [ebp - 0x30], 0xb0dedc7c
mov dword [ebp - 0x2c], 0x8d8bebda
sub dword [ebp - 0x2c], 0x8d8bebda
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xd8e3935b
sub eax, 0xd8a3225b
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3433f
push 0
call eax
mov ecx, 0x9d85345b
sub ecx, 0x9d84f669
mov edx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x28]
mov ebx, 0x1e94591f
add ebx, 0xb3cf2edd
mov dword [ebp - 4], 0xbfe3236c
mov edi, dword [esi]
sub dword [ebp - 0x14], 0xdc9ac1ff
xor edi, ebx
sub dword [ebp - 0x20], edi
mov dword [edx], edi
sub dword [ebp - 8], 0x5cd6a5a8
add edx, 4
add esi, 4
loop 0x405a89
add eax, 0xf05a4b4
sub eax, 0xf04ba19
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb18b2c82
add ecx, 0x4eb4d37e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x402c9f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402cbd
mov eax, 0x51cc99
push eax
push 1
mov ebx, 0x45cba0
call fcn.0045c77f
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402ce7
mov eax, 0
jmp 0x402d5b
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x402d48
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x402d31
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x402d20
xor ecx, eax
xor edx, ebx
dec edi
jne 0x402d11
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x41441d
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x41444b
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
mov dword [ebp - 4], 0
nop
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, VariantClear
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
nop
imul esi, esi, 0x88
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
imul edx, edx, 6
add esi, edx
nop
nop
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
push ebx
push ecx
push edx
mov eax, VariantClear
cpuid
shr ecx, 0x10
imul ecx, ecx, 9
add esi, ecx
pop edx
pop ecx
pop ebx
nop
nop
nop
xor esi, 0x124254
mov dword [ebp - 4], esi
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
nop
nop
nop
mov eax, dword [ebp - 4]
jmp 0x41457a
mov esp, ebp
pop ebp
ret

Function at 0x4163f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x416411
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, 0x45250a1f
xor ecx, 0x167ed194
xor ecx, 0x2b1c1373
xor ecx, 0xa6891e8
xor ecx, 0x20a6d81b
xor ecx, 0x28fbb339
xor ecx, 0x2fc9d340
xor ecx, 0x10b5d6d5
xor ecx, 0x1fe6dd39
xor ecx, 0x65fd844e
xor ecx, 0x2d6f59b
xor ecx, 0x1fd1a9a8
xor ecx, 0x72ed126e
xor ecx, 0x6d432268
xor ecx, 0x376d3525
xor ecx, 0x7c099302
xor ecx, 0x152a1003
xor ecx, 0x10bdc728
xor ecx, 0x754b09cc
xor ecx, 0x3f5deeac
xor ecx, 0x71143137
xor ecx, 0x908f963
xor ecx, 0x117b2ec
xor ecx, 0x531e073e
xor ecx, 0x70fb6571
xor ecx, 0x3307845a
xor ecx, 0x16672bac
xor ecx, 0x49751227
xor ecx, 0x24dca69a
nop
nop
nop
nop
nop
nop
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x416477
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x41657d
nop
nop
nop
mov esp, ebp
pop ebp
ret 8
Function at 0x419435
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
jmp 0x419456
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push esi
xor esi, esi
nop
mov eax, VariantClear
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0xb5bbf183
mov eax, VariantClear
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0xc51f87cc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b3ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x41b3cc
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, 0x4094cb37
xor ecx, 0x459afc32
xor ecx, 0x5ccff2d5
xor ecx, 0x41fe719b
xor ecx, 0x6fd7a7c2
xor ecx, 0x24d8287c
xor ecx, 0x3ce46e8
xor ecx, 0x2fc3a8df
xor ecx, 0x1eebe81c
xor ecx, 0x1fab23ed
xor ecx, 0x29033900
xor ecx, 0x13b71852
xor ecx, 0xd83006d
xor ecx, 0x210cc550
xor ecx, 0x10cc217c
xor ecx, 0x7fbffcef
xor ecx, 0x3b6bc20f
xor ecx, 0x6be43f2e
xor ecx, 0x6a49773c
xor ecx, 0x26215f0c
xor ecx, 0x5d2314c6
xor ecx, 0x69ff01c8
xor ecx, 0x233112f0
xor ecx, 0x3e6f5d1f
xor ecx, 0x545a6491
xor ecx, 0x24dca69a
xor ecx, 0x49751227
xor ecx, 0x16672bac
xor ecx, 0x3307845a
nop
nop
nop
nop
nop
nop
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x41b432
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x41b538
nop
nop
nop
mov esp, ebp
pop ebp
ret 8
Function at 0x423c26
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x423e73
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x423d70
cmp byte [edx + edi], 0xd
jne 0x423d70
cmp byte [edx + edi + 1], 0xa
je 0x423da9
mov al, byte [edx + edi]
cmp al, 0xa
je 0x423da9
cmp al, 0x3d
jne 0x423d85
inc ecx
cmp ecx, 2
ja 0x423e81
cmp al, 0x7f
ja 0x423e81
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x423e81
cmp al, 0x40
jae 0x423da8
test ecx, ecx
jne 0x423e81
inc esi
inc edx
cmp edx, ebx
jb 0x423d5a
test esi, esi
je 0x423e73
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x423e92
cmp dword [ecx], eax
jb 0x423e92
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x423e62
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x423e5e
cmp al, 0xa
je 0x423e5e
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x423e5e
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x423e49
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x423e56
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x423e5e
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x423dfa
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x428300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x428323
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x428323
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x42832d
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x42836f
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4283d1
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4283cc
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4283b7
test dl, dl
je 0x4283b3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4283b7
add ecx, 2
add eax, 2
test dl, dl
jne 0x428397
xor eax, eax
jmp 0x4283bc
sbb eax, eax
or eax, 1
test eax, eax
je 0x4283dd
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x428384
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x428462
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x428485
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x428485
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x42848f
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4284d1
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x428533
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x42852e
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x428519
test dl, dl
je 0x428515
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x428519
add ecx, 2
add eax, 2
test dl, dl
jne 0x4284f9
xor eax, eax
jmp 0x42851e
sbb eax, eax
or eax, 1
test eax, eax
je 0x42853f
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4284e6
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8