joyce8/EMBER2024-capa huggingface dataset:
Function at 0x607808
Capabilities:
Encode data using xor

Disassembly:
sbb dl, byte [eax]
and eax, 0x6e2d7497
and dword [edx + 0x76c698ef], eax
mov dh, 0x1c
mov ch, 0x46
xchg edi, eax
and edi, ecx
fdivp st(4)
dec ebp
mov dword [0x622084b1], eax
lodsb al, byte [esi]
sahf
jo 0x60788b
ret 0xc402
xchg esi, eax
dec ecx
jl 0x60789b
arpl si, di
salc
ljmp 0x37ef
jne 0x6078f6
pop es
fdivr st(1), st(0)
pop ds
mov byte [0xce1d8854], al
mov ah, 0xc6
mov ebp, 0x5f361f21
jns 0x6078f8
push cs
fisub dword [ebx + 0x603f5337]
wait
into
xchg edx, eax
invalid
cmp al, 0x8c
in eax, dx
cld
push edi
test byte [ebp - 0xa], bl
lodsd eax, dword [esi]
push ecx
jp 0x607952
xor dword [esi + 0x4d], ebp
fist dword [esi - 0x6a21020a]
popfd
pop esp
mov byte [0x486a16d], al
int1
sbb al, 0x7a
fcom qword gs:[esi + 0x59]
xchg esi, eax
std
xor eax, 0x711d47cd
mov eax, dword [0x5256a957]
push 0x30
pop edx
push eax
imul ebp, dword [edi + 0x5ceb5c3a], 0x31
mov esp, ecx
jg 0x607960
outsd dx, dword [esi]
aaa
popfd
std
push 0x17
adc al, 0xbe
into
mov word [ecx + 0x7e41a4b8], ds
add eax, 0x6377f8b7
pop es
sub cl, al
push esi
dec eax
xchg esi, eax
fnsave dword [0x743d20a8]
in al, 0x17
cmp eax, 0x17e46574
imul dword [edi - 0x48]
dec eax
sahf
mov bh, 0x26
cmp ecx, dword [edi - 0x74]
mov bh, 6
add ch, byte [ebp + 0x35]
dec edi
inc edx
pop es
jl 0x6079dd
dec edi
invalid
jo 0x607905
nop
cmp esp, ebx
out dx, al
or al, dh
retf
dec edx
lds esp, [esi + 0x3d]
mov ecx, dword [ecx]
sbb eax, 0x6c66767d
sbb dword [eax - 0x4036524c], ecx
pop esp
invalid

Function at 0x63637c
Capabilities:
Encode data using xor

Disassembly:
fdiv qword [ecx + 0x24e6b659]
sbb bh, ah
cmp ah, byte [edx]
or eax, 0x7e7d1cc6
jne 0x6363b9
or cl, byte [edx - 0x26]
ret
mov al, byte [0x76dc3217]
out dx, al
inc esi
xor byte [esi - 0x7cd19de6], ah
stosb byte es:[edi], al
or dword [ebp + 0x14], edi
xor bh, byte [edi]
or al, 0xb3
stosd dword es:[edi], eax
xchg byte [eax - 0x4715e37a], al
add ch, byte [esi + 0x66]
inc edx
inc dx
aad 7
dec eax
push esi
sbb eax, 0xe7077a06
fmul qword [eax - 0x39]
pop esp
mov ecx, 0xf316be67
adc eax, 0x272cc8b4
mov eax, 0x9dc807b4
xchg byte [edi - 0x64f70291], cl
sbb eax, esi
mov dh, 0x4a
sub byte [esi + 0x5d4a1f64], dh
sub eax, 0xf769f63d
mov fs, word [0x96da399a]
movsb byte es:[edi], byte [esi]
jno 0x63639b
xchg ebx, eax
jge 0x63646f
add byte [esi], dh
out 0xb7, al
invalid
arpl word [0x54e2b466], cx
imul eax, dword [eax - 0x2b], 0x980b4e99
enter 0xffffffffffff8dc0, 0xffffffffffffff8b
cmp al, 0x38
call 0xd894b368
mov edx, 0x95d9cde8
push 0xffffffffffffff88
in eax, 0xda
int3

Function at 0x636902
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x5d64dd2a
nop
rol byte [edi + 0x75], cl
call 0x21a06b2c
xor eax, 0xcd36cdbb
neg byte [esi]
cmc
sal dword [eax + 0x4c], cl
outsd dx, dword [esi]
test dword [ecx - 0x4a], esp
dec edi
in al, 0xa2
mov eax, 0x5a47ceb8
salc
push edx
inc eax
dec esp
adc al, 0xe
in al, dx
adc dword [edi + esi*4], edi
inc esp
mov ebp, 0x1710d982
imul cl
invalid
Function at 0x6371ce
Capabilities:
Encode data using xor

Disassembly:
xor esi, ebx
dec ebp
cmp dword [ebp - 0x50], esi
mov esp, fs
add byte [esi + 0x4332481c], cl
xor ebx, ebp
or eax, 0xe4bd81ae
sbb dword [ecx + 0x59e6d39f], ebp
lahf
shl esi, cl
pop ecx
add byte [edx - 0x19], ch
inc ecx
shr dword [ebx + edx*2], cl
sub al, 0x53
sub al, 0x53
jo 0x6371ae
insd dword es:[edi], dx
fcomp qword [edi + edx*4 - 0x3d]
out 0xfc, al
jbe 0x6371c5
xor edx, 0x40
pop ss
push edi
inc esi
daa
mov dh, 0xd2
sbb dword [esi], esp
jb 0x637249
cmp byte [edi + 0x4f124716], al
and dword [ebx + 0x37], eax
push ebx
mov bl, ch
loop 0x637260
push cs
and ecx, ecx
or bl, cl
mov dl, 0x5a
xchg ebx, eax
cli
jae 0x6371c6
sbb ch, byte [0xf67159ed]
mov bl, 0xd6
dec ebp
inc esp
dec esp
neg dword [ecx - 0x78]
or al, 0x78
and dl, 0x81
sbb edx, dword [ebx]
sbb dl, byte [edx - 0x4234ef9b]
mov esp, 0x19f0dadc
inc ebx
cmp ebx, dword [esi]
cmp byte [ebx + 6], ah
push ds
out 0x62, al
je 0x63727e
mov dh, 0xbb
sbb eax, 0xe37236b1
push edx
dec byte [eax - 0x2ce56e45]
inc esp
retf
pop eax
imul byte [edx - 0x79cfc9a4]
ja 0x6371f7
pop ecx
dec eax
retf 0x9c18
in al, dx
xchg edi, eax
sub al, 6
cmp byte [edx - 0x54], dh
outsb dx, byte [esi]
jge 0x637281
cmp edx, dword [edi]
int 0x4c
insb byte es:[edi], dx
mov dword [edi + edx*8 - 0x18e8a511], esi
mov dl, ah
aam 0xb5
rcl byte [ebp - 0x5e3f4d28], 0x96
shl byte [ecx + 0x77fcfa96], 0x4c
cli
cld
ja 0x6372d1
popfd
imul edi, dword [edi + 0x1f], 0x780191d
and dword [esi], 0xffffffb4
not dword [0xd517b5ec]
daa
insd dword es:[edi], dx
xor eax, 0xfc338577
les eax, [edi - 0x48518d83]
mov word [ebp + 0x7b7f6583], ss
push edi
sbb byte [ebp + 0x34], ch
pop esi
ja 0x637310
sbb eax, 0xccb039ae
invalid
fnstcw word [esi + 0x6513bfe7]
out 0x13, eax
mov eax, dword [0xbe4c0fe4]
imul esi, dword [eax + 0xd], 0xffffffd9
jg 0x637362
or eax, 0x831eb647
xchg esi, eax
insd dword es:[edi], dx
xor al, 0x50
mov dh, 0xdf
mov ecx, 0x667104a9
test byte [ecx - 0x27], dl
cmpsd dword [esi], dword es:[edi]
mov byte [0x2fc74cb7], al
sbb dword [0x14d664b9], edi
sbb esi, edi
push edi
mov bl, 3
dec ebp
in eax, 0x47
cmc
insb byte es:[edi], dx
test eax, 0x83253ccd
idiv byte [ebp + 0x11b713b8]
mov bh, 0x11
push 0xae5c439e
or dword [ecx + 0x1c], 0x18
or byte [edi - 0x11], dl
mov word [esi + 0x30efc97], ds
pop ecx
jl 0x637319
test eax, 0x83234ff7
sbb eax, ebx
out dx, al
adc edi, dword [edi - 0x2a023b24]
sub eax, 0x24c67d44
push ecx
div dword [edi - 0x1d]
lds ebx, [si + 0x26]
adc edi, dword [ebp + 0x55]
dec eax
les eax, [0xbf15a447]
push ss
insd dword es:[edi], dx
invalid
btc dword [esi + eax*8 + 0x21], ecx
cmc
pop esi
test dword [ebx + 0x6407c044], eax
pop esp
xor byte [edx + 0x278cf781], 0xaa
or esp, esi
mov bl, 0xf0
cmpsb byte ds:[esi], byte es:[edi]
sub eax, 0xf570d219
test al, 0xf5
leave
mov dh, 0x7a
or esp, edx
mov esp, edi
inc ebx
xlatb
lodsb al, byte [esi]
shr byte [esi], 1
pushal
cld
xor eax, eax
mov edx, 0xc1039d54
add eax, 0x922497fc
sal dword [edi + 0x148656ff], 1
push cs
push esi
popfd
push ss
nop
sbb ebp, esp
mov bl, 0xcf
xor al, 0x51
push ebp
cld
mov al, 0xa1
aad 0x9f
les ecx, [esi]
invalid
Function at 0x417f2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x417f3d
pop dword [ebp - 0x34]
mov eax, 0x8f73b195
sub eax, 0x8f323258
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3b700
push 0
mov eax, 0x80e01178
sub eax, 0x809d814c
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x3a1669dd
sub ecx, 0x3a16184f
xor edi, edi
add edi, eax
mov esi, 0xc5c2ce6e
add esi, 0x3a809f92
add esi, dword [ebp - 0x34]
mov ebx, 0x4858b898
add ebx, 0x30debb5a
xor dword [ebp - 4], 0x1d6d77d5
mov edx, dword [esi]
sub dword [ebp - 4], ebx
sub edx, ebx
add dword [ebp - 0x24], ecx
mov dword [edi], edx
mov dword [ebp - 0x28], 0x456e6362
add edi, 0x301957f5
add edi, 0xcfe6a80f
add esi, 0x4bfc30db
add esi, 0xb403cf29
loop 0x417f9e
add eax, 0xb875e27f
sub eax, 0xb874a974
xor ebx, ebx
add ebx, eax
add eax, 0x7575889d
add eax, 0x8a8a7768
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x41e7e0
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x41e81d
push str.SetDefaultDllDirectories
push 0x429a14
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x41e81d
push 0xc00
call eax
test eax, eax
jne 0x41e8b6
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41e8b6
cmp eax, 0x104
ja 0x41e8b6
cmp word [esp + eax*2 + 6], 0x5c
je 0x41e84c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x41e8b6
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x41e88b
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x41e877
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x41e86c
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x4068ad
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bbca
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4b3074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0xcc]
call fcn.0042cb3a
push dword [esi + 0xc0]
call fcn.0042cb3a
push dword [esi + 0x9c]
call fcn.0042cb3a
push dword [esi + 0x90]
call fcn.0042cb3a
push dword [esi + 0x30]
call fcn.0042cb3a
push dword [esi + 0x24]
call fcn.0042cb3a
push dword [esi + 0x18]
call fcn.0042cb3a
add esp, 0x1c
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40692a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40693e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x406952
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi]
test ecx, ecx
je 0x406965
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0x40704e
Capabilities:
Hide graphical window

Disassembly:
push dword [esp + 4]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
setne al
ret 4

Function at 0x407c28
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x4b3074]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
push 0x208
xor ebp, ebp
lea eax, [esp + 0x18]
push ebp
push eax
mov edi, edx
mov ebx, ecx
call fcn.00433180
add esp, 0xc
lea eax, [esp + 0x14]
push 0x104
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407cba
mov edx, edi
mov ecx, esi
call fcn.0048af8b
push dword [edi]
mov dword [esp + 0x14], ebp
call fcn.0042cc59
pop ecx
push ebp
lea ecx, [esp + 0x14]
mov dword [ebx], eax
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042cb29
add esp, 0x210
ret
Function at 0x422f20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x4b3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
and eax, 0x1fffffff
mov dword [ebp - 0x94], 0x67452301
mov dword [ebp - 0x9c], eax
mov eax, esi
shr eax, 0x1d
mov dword [ebp - 0x90], 0xefcdab89
mov dword [ebp - 0x8c], 0x98badcfe
mov dword [ebp - 0x88], 0x10325476
mov dword [ebp - 0x98], eax
push edi
mov edi, dword [ebp + 0x10]
cmp esi, 0x40
jb 0x422f9e
mov eax, esi
and eax, 0xffffffc0
push eax
push ecx
lea eax, [ebp - 0x9c]
push eax
call fcn.00422540
add esp, 0xc
mov ecx, eax
and esi, 0x3f
push esi
push ecx
lea eax, [ebp - 0x84]
push eax
call fcn.00432c00
mov ecx, dword [ebp - 0x9c]
mov eax, 0x40
and ecx, 0x3f
add esp, 0xc
mov byte [ebp + ecx - 0x84], 0x80
inc ecx
sub eax, ecx
cmp eax, 8
jae 0x422ffd
push eax
lea eax, [ebp - 0x84]
add eax, ecx
push 0
push eax
call fcn.00433180
push 0x40
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00422540
add esp, 0x18
mov eax, 0x40
xor ecx, ecx
add eax, 0xfffffff8
push eax
lea eax, [ebp - 0x84]
add eax, ecx
push 0
push eax
call fcn.00433180
mov eax, dword [ebp - 0x9c]
push 0x40
lea ecx, [eax*8]
movzx eax, cl
mov byte [ebp - 0x4c], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x4b], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x4a], al
movzx eax, byte [ebp - 0x98]
mov dword [ebp - 0x9c], ecx
shr ecx, 0x18
mov byte [ebp - 0x48], al
mov byte [ebp - 0x49], cl
mov ecx, dword [ebp - 0x98]
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x47], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x46], al
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
shr ecx, 0x18
push eax
mov byte [ebp - 0x45], cl
call fcn.00422540
movzx eax, byte [ebp - 0x94]
add esp, 0x18
mov ecx, dword [ebp - 0x94]
mov byte [edi], al
mov eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 2], al
movzx eax, byte [ebp - 0x90]
mov byte [edi + 4], al
shr ecx, 0x18
mov byte [edi + 3], cl
mov ecx, dword [ebp - 0x90]
mov eax, ecx
shr eax, 8
mov byte [edi + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 6], al
movzx eax, byte [ebp - 0x8c]
mov byte [edi + 8], al
shr ecx, 0x18
mov byte [edi + 7], cl
mov ecx, dword [ebp - 0x8c]
mov eax, ecx
shr eax, 8
mov byte [edi + 9], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 0xa], al
movzx eax, byte [ebp - 0x88]
shr ecx, 0x18
mov byte [edi + 0xc], al
mov byte [edi + 0xb], cl
mov ecx, dword [ebp - 0x88]
mov eax, ecx
shr eax, 8
mov byte [edi + 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 0xe], al
shr ecx, 0x18
mov byte [edi + 0xf], cl
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042cb29
mov esp, ebp
pop ebp
ret
Function at 0x423470
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c988
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b3074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
cmp edi, 4
jae 0x4234c9
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi + edi*2]
mov dword [ebp - 0x14], 0
shr eax, 2
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4234eb
push eax
call fcn.00421350
add esp, 4
jmp 0x4234ed
xor eax, eax
mov dword [ebp - 0x10], eax
mov esi, eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
lea ebx, [eax + edi]
lea edi, [eax + 8]
cmp edi, ebx
ja 0x423580
nop word [eax + eax]
movzx ecx, byte [eax]
movsx edx, byte [ecx + 0x491850]
movzx ecx, byte [eax + 1]
shl edx, 6
movsx ecx, byte [ecx + 0x491850]
or edx, ecx
movzx ecx, byte [eax + 2]
shl edx, 6
movsx ecx, byte [ecx + 0x491850]
or edx, ecx
movzx ecx, byte [eax + 3]
shl edx, 6
movsx ecx, byte [ecx + 0x491850]
or edx, ecx
jl 0x4235d0
mov ecx, edx
mov byte [esi + 2], dl
sar ecx, 0x10
add eax, 4
mov byte [esi], cl
add edi, 4
mov ecx, edx
sar ecx, 8
mov byte [esi + 1], cl
add esi, 3
cmp byte [eax], 0xd
jne 0x42357c
cmp byte [eax + 1], 0xa
jne 0x4235d0
add eax, 2
add edi, 2
cmp edi, ebx
jbe 0x423510
mov ecx, ebx
sub ecx, eax
sub ecx, 4
je 0x42359a
sub ecx, 2
jne 0x4235d0
cmp byte [ebx - 2], 0xd
je 0x42359a
cmp byte [ebx - 1], 0xa
jne 0x4235d0
movzx ecx, byte [eax]
movsx edx, byte [ecx + 0x491850]
movzx ecx, byte [eax + 1]
shl edx, 6
movsx ecx, byte [ecx + 0x491850]
or edx, ecx
shl edx, 0xc
test edx, edx
js 0x4235d0
mov ecx, edx
sar ecx, 0x10
mov byte [esi], cl
inc esi
mov cl, byte [eax + 2]
cmp cl, 0x3d
jne 0x423615
cmp byte [eax + 3], cl
je 0x423646
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
test eax, eax
je 0x423601
push dword [ebp + 0x10]
push eax
call fcn.00421670
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, cl
movsx ecx, byte [ecx + 0x491850]
shl ecx, 6
or edx, ecx
jl 0x4235d0
mov ecx, edx
sar ecx, 8
mov byte [esi], cl
inc esi
mov al, byte [eax + 3]
cmp al, 0x3d
je 0x423646
movzx eax, al
movsx eax, byte [eax + 0x491850]
or edx, eax
jl 0x4235d0
mov byte [esi], dl
inc esi
sub esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
push esi
call fcn.0041ae40
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0041b1b0
lea ecx, [ebp - 0x18]
call fcn.0041b270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48cb7e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4b3074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x100
call fcn.00428d60
lea esi, [edi + 4]
mov dword [ebp - 4], 0
push 0x100
mov dword [ebp - 0x14], esi
mov dword [esi], 0x100
mov dword [esi + 4], 0
call fcn.00421350
mov dword [esi + 8], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0x100
mov dword [ebp - 0x14], esi
mov dword [esi], 0x100
mov dword [esi + 4], 0
call fcn.00421350
mov dword [esi + 8], eax
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 2
push 8
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00421350
mov dword [esi], eax
add esp, 0xc
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov eax, edi
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48cbfa
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4b3074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x80
push 0
push esi
call fcn.00433180
push 2
push esi
call fcn.00430543
mov dword [esi + 0x30], 0
add esp, 0x14
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
push 0x4259b0
push 0x4251e0
push 8
add esi, 0x100
mov dword [ebp - 4], 0
push 0x80
push esi
mov dword [ebp - 0x14], esi
call fcn.0042cc62
push 0x425540
push fcn.00424690
push 8
push 0x20
lea eax, [esi + 0x400]
mov byte [ebp - 4], 1
push eax
call fcn.0042cc62
lea edi, [esi + 0x500]
mov byte [ebp - 4], 2
lea esi, [edi + 4]
mov dword [ebp - 0x18], edi
push 0
mov dword [edi], 0
mov ecx, esi
push 0
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00425f60
mov dword [esi], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push 8
mov ecx, edi
mov byte [ebp - 4], 4
mov dword [edi], 0x3f800000
call fcn.00426550
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x644], 0
mov dword [esi + 0x648], 0
push 0
push 1
lea ecx, [esi + 0x680]
mov byte [ebp - 4], 5
call fcn.00429ee0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x684], ecx
mov dword [esi + 0x688], eax
mov dword [esi + 0x68c], 0xfffffffe
movups xmm0, xmmword [ecx + 0xac]
movups xmmword [esi + 0x3c], xmm0
movq xmm0, qword [ecx + 0xbc]
movq qword [esi + 0x4c], xmm0
mov eax, dword [ecx]
mov dword [esi + 0x90], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x94], eax
mov eax, ecx
movups xmm0, xmmword [ecx + 0xac]
movups xmmword [esi + 0x150], xmm0
movq xmm0, qword [ecx + 0xbc]
movq qword [esi + 0x160], xmm0
movups xmm0, xmmword [eax + 0xac]
movups xmmword [esi + 0x1d0], xmm0
movq xmm0, qword [eax + 0xbc]
movq qword [esi + 0x1e0], xmm0
movups xmm0, xmmword [eax + 0xac]
movups xmmword [esi + 0x250], xmm0
movq xmm0, qword [eax + 0xbc]
movq qword [esi + 0x260], xmm0
movups xmm0, xmmword [eax + 0xac]
movups xmmword [esi + 0x2d0], xmm0
movq xmm0, qword [eax + 0xbc]
movq qword [esi + 0x2e0], xmm0
movups xmm0, xmmword [eax + 0xac]
movups xmmword [esi + 0x350], xmm0
movq xmm0, qword [eax + 0xbc]
movq qword [esi + 0x360], xmm0
movups xmm0, xmmword [eax + 0xac]
movups xmmword [esi + 0x3d0], xmm0
movq xmm0, qword [eax + 0xbc]
movq qword [esi + 0x3e0], xmm0
movups xmm0, xmmword [eax + 0xac]
movups xmmword [esi + 0x450], xmm0
movq xmm0, qword [eax + 0xbc]
movq qword [esi + 0x460], xmm0
movups xmm0, xmmword [eax + 0xac]
movups xmmword [esi + 0x4d0], xmm0
movq xmm0, qword [eax + 0xbc]
mov eax, esi
movq qword [esi + 0x4e0], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x428490
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, edx
xor esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp edx, 4
jb 0x4284d7
push ebx
mov ebx, edx
shr ebx, 2
nop dword [eax + eax]
imul ecx, dword [edi], 0x5bd1e995
sub edx, 4
imul esi, esi, 0x5bd1e995
add edi, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor esi, ecx
sub ebx, 1
jne 0x4284b0
pop ebx
sub edx, 1
je 0x4284f8
sub edx, 1
je 0x4284ef
sub edx, 1
jne 0x428503
movzx eax, byte [edi + 2]
shl eax, 0x10
xor esi, eax
movzx eax, byte [edi + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [edi]
xor eax, esi
imul esi, eax, 0x5bd1e995
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e995
pop edi
pop esi
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop ebp
ret
Function at 0x429210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00429980
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x429290
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
jne 0x4292b4
push dword [ebp + 8]
call fcn.00429980
add esp, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
pop ebp
ret
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2f
push edi
call fcn.00433ab0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4292f5
push 0x5c
push edi
call fcn.00433ab0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4292f5
push edi
call fcn.00429980
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
pop edi
setne al
pop esi
pop ebp
ret
push ebx
mov bl, byte [esi]
push edi
mov byte [esi], 0
call fcn.00429980
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42932e
mov byte [esi], bl
push edi
call fcn.00429980
add esp, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop ebx
test eax, eax
pop edi
setne al
pop esi
pop ebp
ret
push 1
push edi
call fcn.00429290
add esp, 8
mov byte [esi], bl
test al, al
jne 0x429312
pop ebx
pop edi
pop esi
pop ebp
ret