joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027c30
Capabilities:
Delete registry value
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
push 0
pop esi
mov byte [esp + 0xc], cl
mov edi, edx
mov dword [esp + 0x10], 0x38d5
cmp dword [esp + 0x10], 0x3c12
push 1
mov dword [esp + 0x18], edi
pop ebx
jle 0x10027cbe
push esi
push 0x25c6
push 0x236f
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x18]
and eax, esi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10027c8b
mov eax, dword [eax]
push eax
call fcn.1003fffd
pop ecx
push 0
push ebx
lea ecx, [esp + 0x20]
call fcn.10004e55
inc edi
cmp edi, 0x3564
jl 0x10027c71
inc esi
cmp esi, 0x894
jl 0x10027c6f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x10], 0x3513
jge 0x10027cd3
push str.uklo_gjtwqkqyb_csfbpgb_kujpqta_mdav_kqmv_ognommekq_goqske_chzebpsu_zpb_mwsv_qnwgwqfa_hdrvjay_ukcxm
call fcn.1003fffd
pop ecx
cmp byte [esp + 0xc], 0
je 0x10027d28
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
cmp dword [eax + ecx*4], 0
jne 0x10027d09
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [edx]
mov eax, dword [edx]
mov eax, dword [edi]
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx]
jl 0x10027d13
cmp dword [edi], 0
je 0x10027d13
mov ecx, dword [edx]
mov eax, dword [esi]
cmp dword [eax + ecx*4], 0
jne 0x10027d15
xor ebx, ebx
lea eax, [ebx - 1]
cmp eax, 0xf9acf257
mov eax, dword [ebp + 0xc]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
jmp 0x10027d38
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10027d38
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028752
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov eax, 0x1005934c
call fcn.100580f4
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0x24], 0x58af
xor esi, esi
cmp dword [ebp - 0x24], 0x5af3
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
jle 0x100287df
push esi
push 0x1a43
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], 0xe93
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x22ca
mov edi, esi
mov esi, dword [ebp - 0x14]
mov eax, esi
mov ecx, 0x10071a98
xor eax, edi
cdq
push edx
push eax
call fcn.100046a4
inc edi
cmp edi, 0x20fd
jl 0x100287a3
dec esi
dec dword [ebp - 0x18]
push 0
mov dword [ebp - 0x14], esi
pop esi
jne 0x1002879e
mov edi, dword [ebp - 0x20]
add ebx, edi
dec dword [ebp - 0x1c]
jne 0x10028794
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x4106
jl 0x1002878b
cmp byte [ebp + 0x10], 0
je 0x10028881
mov dword [ebp - 0x18], 0xd59
cmp dword [ebp - 0x18], 0xf77
jle 0x10028862
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], 0x76c3
mov ebx, esi
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028832
mov eax, dword [eax]
push eax
call fcn.1003fffd
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.10004e55
inc ebx
cmp ebx, 0x5b8c
jl 0x10028817
dec edi
dec dword [ebp - 0x20]
jne 0x10028815
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x538a
jl 0x1002880b
mov eax, dword [ebp - 0x28]
mov dword [eax], 1
cmp dword [ebp - 0x18], 0x991
jge 0x10028894
push str.hicverpb_ceskmm_kefvzlxh_ncra_ltusm_ovkwpeybv_rjrtkwd_zbgkzjz_rjhw_bxfkag_xbtc_zyfonzvq_vgsv_lvknsycan
call fcn.1003fffd
pop ecx
jmp 0x10028894
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10028894
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x5772
jge 0x100288b3
mov edx, str.mlxbs_wzotisorg_fylyw_ahca_vdgmpcse_twzjpcq_occryrul_vkj_lqijzgchx_zkb_pvzlhcnrz_tghtrb
mov ecx, 0x10071a98
call fcn.10006c80
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029373
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1005942c
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
test dl, dl
je 0x10029523
cmp byte [ebp + 0x10], 0
je 0x1002950a
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x24]
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.10028abd
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], esi
call fcn.10028abd
xor ebx, ebx
inc ebx
mov byte [esp + 0x3c], bl
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
sub ecx, dword [esp + 0x18]
sar eax, 2
sar ecx, 2
cmp eax, ecx
mov dword [esp + 0x10], esi
lea eax, [esp + 0x10]
jbe 0x10029429
push ebx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.10028d7a
add esp, 0xc
lea eax, [esp + 0x18]
mov edx, 0x43d5
push 0x5d56
push ecx
push eax
lea eax, [esp + 0x18]
mov ecx, 0x1c5d
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.10028db1
add esp, 0x18
jmp 0x10029485
push 0x1600
push 0x55b8
push eax
push ebx
push 0x2418
push ebx
push 0x63ee
push ebx
push 0xd77
mov edx, 0x5886
lea ecx, [esp + 0x3c]
call fcn.10028e5c
add esp, 0x24
lea eax, [esp + 0x24]
xor dl, dl
lea ecx, [esp + 0xc]
push 0x4af0
push 0x4a1b
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0x4f14
push ebx
push 0x7507
call fcn.1002a901
add esp, 0x20
cmp dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
jle 0x100294ed
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x100294f1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
push ebx
push 0x371a
push ecx
push ecx
lea eax, [esp + 0x24]
push eax
push 0x52e5
push ecx
lea ecx, [esp + 0x38]
call fcn.10028fa1
add esp, 0x24
lea eax, [esp + 0x24]
lea edx, [esp + 0x14]
push ebx
push eax
push ecx
lea eax, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x2c]
call fcn.100290f7
mov eax, dword [esp + 0x20]
add esp, 0x14
inc eax
mov dword [esp + 0xc], eax
cmp eax, dword [esp + 0x10]
jl 0x10029490
mov ecx, dword [esp + 0x14]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
lea ecx, [esp + 0x18]
call fcn.1002c327
lea ecx, [esp + 0x24]
call fcn.1002c327
jmp 0x10029546
push 0x1fd
push 0x5b7
push 0
push 0x2191
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x10029546
test cl, cl
je 0x1002953c
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10029546
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10029546
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [esp + 0x34]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b067
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005951b
call fcn.100580f4
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002b12d
mov dword [ebp - 0x1c], 0x4588
cmp dword [ebp - 0x1c], 0x47f1
jle 0x1002b0df
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, 0x10071a98
xor eax, ebx
cdq
push edx
push eax
call fcn.100046a4
inc ebx
cmp ebx, 0x1eb0
jl 0x1002b0aa
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x7b51
jl 0x1002b0a1
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x2dad
jl 0x1002b09f
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x42ac
jge 0x1002b11a
mov edx, str.rtxcvsk_kekovt_slxyos_qzqmoa_wkipcyit_ulkbmd_haxvespql_fdl_nyyae_encefixpl_blm_ltxuxvmsq_klli
mov ecx, 0x10071a98
call fcn.10006c80
jmp 0x1002b11a
or dword [ebp - 4], 0xffffffff
movzx eax, word [ebx]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.10018a36
jmp 0x1002b135
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f65d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002f6b7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
push dword [ebp - 0x10]
push 0x1cbe
push dword [ebp - 0x14]
push 0x1f4b
push dword [ebp - 0x18]
call fcn.10035df5
add esp, 0x24
jmp 0x1002f6e3
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002f6d5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1002f6e3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esp, ebp
pop ebp
ret

Function at 0x1002fa11
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002fa35
push 0x638a
push 0x147f
push 1
call fcn.1002fa70
add esp, 0xc
jmp 0x1002fa6c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002fa64
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1002fa6c
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret
Function at 0x1003265a
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003269a
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10032688
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x10032698
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x100326bb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x5723
push 0
call fcn.10030b9f
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10032777
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058874
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100327df
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100327be
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x100327da
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100327da
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x100328b2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003288b
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x10032827
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jg 0x10032889
mov dword [ebp - 0x50], 0x34e6d4f2
push 2
lea ecx, [ebp - 0x5c]
call fcn.100048ce
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0xb972
mov dword [ebp - 0x14], 0
jmp 0x1003285b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10032874
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5c]
call fcn.1000496d
mov dword [eax], 0xe5664dc9
jmp 0x10032854
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.10004951
jmp 0x1003281c
jmp 0x100328b2
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, word [eax]
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.10022c48
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10032dbc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059857
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10032f58
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10032f46
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0x69b9
mov dword [ebp - 0x44], str.djmjhjswe_fpgj_drhucikm_uhsizmv_wzfgrgj_ltn_acb_yfi_kshu_tayozdc_sswudhlzl
cmp dword [ebp - 0x28], 0x6b63
jle 0x10032ed1
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
and dword [ebp - 0x24], 0
jmp 0x10032e52
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x399b
jge 0x10032ec9
and dword [ebp - 0x18], 0
jmp 0x10032e68
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6eef
jge 0x10032ec7
and dword [ebp - 0x1c], 0
jmp 0x10032e7e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4f59
jge 0x10032ec5
and dword [ebp - 0x20], 0
jmp 0x10032e94
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6e9d
jge 0x10032ec3
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0x10071a98
call fcn.100046a4
jmp 0x10032e8d
jmp 0x10032e77
jmp 0x10032e61
jmp 0x10032e4b
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10032ee7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x10032f04
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.1000496d
mov dword [eax], 0xe5664dc9
jmp 0x10032edc
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x68e6
jge 0x10032f1e
mov edx, dword [ebp - 0x44]
mov ecx, 0x10071a98
call fcn.10006c80
jmp 0x10032f3a
or dword [ebp - 4], 0xffffffff
jmp 0x10032f44
jmp 0x10032f56
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10032f80
lea eax, [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
push 0
push 0x2dd5
push dword [ebp - 0x48]
mov edx, 0x18ef
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
call fcn.1002ee71
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40146a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x41edd0
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x41eff3
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.USER32.dll_PhysicalToLogicalPoint]
nop dword [eax]
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
sub byte [edi + ebp], 0x50
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
xor byte [edi + ebp], 0x35
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
xor byte [edi + ebp], 0xa4
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x87
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x2a
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
xor byte [edi + ebp], 0xdb
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x95
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x8b
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x21
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add esp, 8
xor byte [edi + ebp], 0x8a
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x16
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0xb0
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0xee
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
xor byte [edi + ebp], 0x3a
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x27
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
xor byte [edi + ebp], 0x8f
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x32
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d7ee8
call fcn.004032b5
add byte [edi + ebp], 0x7e
add esp, 8
inc edi
cmp edi, ebx
jb 0x41edf0
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x403c8d
Capabilities:
Terminate process

Disassembly:
jmp 0x461e19
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x461e2a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.0040668b
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x403e18
Capabilities:
Query environment variable

Disassembly:
jmp 0x4ab65b
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4ab66c
pop esi
ret
push ebx
push edi
push esi
call fcn.004ab542
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004048a9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4ab694
push ebx
push esi
push edi
call fcn.00406424
add esp, 0xc
push 0
call fcn.004071bc
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x406500
Capabilities:
Parse pe header

Disassembly:
jmp 0x450b67
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x450ba6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x450ba6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x450ba6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x450ba6
cmp dword [ecx + 0x74], 0xe
jbe 0x450ba6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4075c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x41fc80
sub esp, 0x2c
mov eax, dword [0x5d3ff8]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, dword [esp + 0x34]
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
mov dword [esp + 0x10], 0
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
add edi, ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x41fd69
mov ebp, dword [esp + 0x44]
mov edx, dword [edi]
xorps xmm0, xmm0
add edx, ebx
mov dword [esp + 0x30], 0
mov eax, edx
mov dword [esp + 0x34], 0
movups xmmword [esp + 0x20], xmm0
lea ecx, [eax + 1]
mov dword [esp + 0x14], ecx
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fcf0
sub eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push edx
call fcn.00406172
test ebx, ebx
je 0x41fd29
cmp ebp, 3
jbe 0x41fd29
lea eax, [esp + 0x20]
push 0x14d
push eax
call fcn.00403201
add esp, 8
test eax, eax
je 0x41fd29
cmp eax, ebp
je 0x41fd82
mov ecx, dword [esp + 0x34]
add edi, 4
cmp ecx, 0x10
jb 0x41fd5e
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41fd54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fdd1
push ecx
push edx
call fcn.00401c12
add esp, 8
inc esi
cmp esi, dword [esp + 0x18]
jb 0x41fcc5
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
add eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004035ee
add esp, 0x2c
ret
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + ebx]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
jb 0x41fd69
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41fdc5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fdd1
push ecx
push edx
call fcn.00401c12
add esp, 8
jmp 0x41fd69
call fcn.004051c8
int3
Function at 0x4a2609
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00402027
mov eax, dword [0x5d3ff8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00406d02
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4a264b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4a27a7
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00406e8d
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5d9520]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403864
mov ecx, dword [esi*4 + 0x5d9520]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4a27a0
cmp eax, dword [edi + ecx + 0x24]
jne 0x4a27a0
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a27a0
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403864
add esp, 0x14
test edx, edx
jl 0x4a27a0
jg 0x4a2716
test eax, eax
jb 0x4a27a0
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4a27a0
jl 0x4a2730
cmp dword [ebp - 0x1008], eax
ja 0x4a27a0
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4a274e
test ebx, ebx
je 0x4a2787
cmp ecx, edi
jae 0x4a2787
mov al, byte [ecx]
cmp al, 0xd
jne 0x4a2768
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4a2774
cmp byte [ecx + 1], 0xa
jne 0x4a2774
inc ecx
jmp 0x4a2774
movzx eax, al
movsx eax, byte [eax + 0x5d4310]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4a274e
cmp edx, ebx
jne 0x4a274e
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4a27a5
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004035ee
leave
ret