joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x35ab4b44
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x4e864e0f
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x409070
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
cmp dword [0x479424], 0x13f7
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [ebx]
mov dword [ebp - 8], 0xc6ef3720
mov dword [ebp - 0x14], eax
jne 0x4090b9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
cmp dword [0x479424], 0x60b
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], eax
jne 0x409102
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov dword [ebp - 0xc], 0x20
lea esp, [esp]
mov ecx, dword [ebp - 0x1c]
mov eax, edi
push ecx
shl eax, 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], eax
call fcn.00409010
mov eax, dword [ebp - 8]
lea ebx, [eax + edi]
mov eax, edi
shr eax, 5
add eax, dword [ebp - 0x10]
cmp dword [0x479424], 0x1b
mov dword [ebp + 0xc], eax
mov dword [0x45c884], 0xffcf03fc
jne 0x409178
push 0
push 0
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0x401330
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov eax, dword [ebp + 0xc]
xor eax, ebx
xor eax, dword [ebp - 4]
mov dword [0x45c884], 0
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
add dword [0x45c884], eax
sub esi, dword [ebp + 0xc]
mov dword [0x45c888], 0xc5e121b4
mov edx, esi
shr edx, 5
mov dword [0x45c88c], 0xffffffff
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x18]
add dword [ebp + 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x14]
add ecx, esi
xor eax, ecx
mov dword [ebp - 4], eax
push edx
lea eax, [ebp - 4]
push eax
call fcn.00408fe0
sub edi, dword [ebp - 4]
push 0x9e3779b9
lea ecx, [ebp - 8]
push ecx
call fcn.00408310
sub dword [ebp - 0xc], 1
jne 0x409110
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409210
Capabilities:
Copy file
Manipulate console buffer
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
cmp dword [0x479424], 0x516
jne 0x409265
push 0
lea eax, [ebp - 0xddc]
push eax
push 0
call sub.KERNEL32.dll_VerLanguageNameW
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor edx, edx
xor ecx, ecx
mov word [ebp - 2], dx
lea eax, [ebp - 8]
push eax
mov word [ebp - 4], cx
mov ecx, dword [ebp - 4]
push ecx
push edx
lea edx, [ebp - 0x5dc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [ebp + 0xc]
shr eax, 3
test eax, eax
jbe 0x409382
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], eax
cmp dword [0x479424], 0x29
jne 0x4092c4
lea edx, [ebp - 0x2c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
cmp dword [0x479424], 0xe1b
jne 0x4092e7
lea ecx, [ebp - 0x42c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x479424], 0x1c
jne 0x40933b
push 0
call esi
push 0
push 0
push 0
lea edx, [ebp - 0x1dc]
push edx
call edi
lea eax, [ebp - 0xc0]
push eax
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
call fcn.00409070
cmp dword [0x479424], 0x4fa
jne 0x409371
xor edx, edx
xor ecx, ecx
lea eax, [ebp - 0x10]
push eax
mov word [ebp + 8], cx
mov word [ebp + 0xa], dx
mov ecx, dword [ebp + 8]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
add dword [ebp + 0xc], 8
sub dword [ebp - 4], 1
jne 0x409291
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409390
Capabilities:
Check for unexpected memory writes
Connect pipe
Extract resource via kernel32 functions
Get disk information
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
cmp dword [0x479424], 0x37
jne 0x40946f
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
push ecx
push 0x401364
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push 0
lea eax, [ebp - 0x438]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
mov dword [ebp - 4], 0
mov eax, dword [0x479428]
add dword [ebp - 4], eax
mov eax, 0x38d6
add dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dl, byte [ecx + eax]
mov ecx, dword [0x45c880]
mov byte [ecx + eax], dl
mov esp, ebp
pop ebp
ret 4

Function at 0x4094d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, 0x65
mov cl, 0x6c
push 0x4521c8
mov byte [0x4521c9], al
mov byte [0x4521ca], 0x72
mov byte [0x4521d0], 0x2e
mov byte [0x4521d1], 0x64
mov byte [0x4521d2], cl
mov byte [0x4521d4], 0
mov byte [0x4521cc], al
mov byte [0x4521cd], cl
mov byte [0x4521ce], 0x33
mov byte [0x4521cf], 0x32
mov byte [0x4521d3], al
mov byte [0x4521cb], 0x6e
mov byte [0x4521c8], 0x6b
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x479424]
mov edx, dword [0x45c880]
mov dword [0x478abc], eax
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push edx
mov byte [0x4521d6], 0
mov byte [0x4521cf], 0x50
mov byte [0x4521cd], 0x61
mov byte [0x4521c8], 0x60
mov byte [0x4521d0], 0x7c
mov byte [0x4521d1], 0x6f
mov byte [0x4521d5], 0x74
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x4095b0
Capabilities:
Copy file
Get common file path
Read .ini file
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x918
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
xor edi, edi
lea ebx, [ebx]
push 0
call esi
cmp dword [0x479424], 0x16
jne 0x409605
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
call esi
cmp dword [0x479424], 0x9e
jne 0x40963a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
lea eax, [ebp - 0x918]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea ecx, [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp edi, 0x3775ee
jg 0x40964b
inc edi
cmp edi, 0x332beaf6
jl 0x4095d0
mov edx, dword [0x479424]
mov eax, dword [0x45c880]
push 0x427010
push edx
push eax
call fcn.00409210
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
xor esi, esi
cmp dword [0x479424], 0x10
jne 0x409691
push 0
call edi
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
call ebx
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnfix]
cmp esi, 0x1e673
jne 0x40969e
call fcn.004094b0
inc esi
cmp esi, 0x3e79e
jl 0x409670
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 4], 0xdd9a7
cmp dword [0x479424], 0xc01
jne 0x4096ff
push 0
push 0
call esi
call edi
push 0
push 0
push 0
push 0
call ebx
push 0
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
sub dword [ebp - 4], 1
jne 0x4096c0
mov cl, 0x6d
mov al, 0x6c
push 0x4521c8
mov byte [0x4521c8], cl
mov byte [0x4521c9], 0x73
mov byte [0x4521d2], al
mov byte [0x4521ce], 0x32
mov byte [0x4521ca], 0x69
mov byte [0x4521cd], 0x33
mov byte [0x4521d3], 0
mov byte [0x4521cc], 0x67
mov byte [0x4521d0], 0x64
mov byte [0x4521cb], cl
mov byte [0x4521d1], al
mov byte [0x4521cf], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x479424], 0x1144
pop edi
pop esi
pop ebx
jne 0x4097e1
push 0x401384
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0
push 0
lea edx, [ebp - 0x918]
push edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0
push 0
push 0x40139c
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFix]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40a6c0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x40a6e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40a6ea
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40a701
mov edx, dword [ebp - 4]
push edx
call fcn.004107f0
add esp, 4
or eax, 0xffffffff
jmp 0x40a703
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40a9e0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a9ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40aa06
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40aa1d
mov ecx, dword [ebp - 4]
push ecx
call fcn.004107f0
add esp, 4
or eax, 0xffffffff
jmp 0x40aa1f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x415510
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x451384]
jne 0x41551a
repz ret
jmp fcn.0041b5f0
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5cda7513
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x58a12115
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x2c6740da
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4dc7492d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x50b9421c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2ca53178
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x413430
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x413461
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x413450
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41d570
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x58f140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x41d5bc
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x41d5cf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052df19
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
mov dword [ebp - 0x134], 0
nop
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.0053dd27
add esp, 8
test eax, eax
je 0x41d604
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x41d5e0
jmp 0x41d60e
mov dword [ebp - 0x134], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x134]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0052df19
mov esp, ebp
pop ebp
ret
Function at 0x420770
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c0e0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x58f140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0052e124
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0052ffde
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00420710
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c8a5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x58f140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 4
push eax
lea eax, [ebp - 0x58]
mov ecx, 0x590638
push eax
call fcn.00415a30
mov esi, dword [ebp - 0x50]
cmp byte [esi + 0xd], 0
jne 0x4247c6
cmp dword [esi + 0x10], 4
jg 0x4247c6
mov ebx, dword [esi + 0x24]
add esi, 0x14
mov edi, esi
cmp dword [esi + 0x14], 0xf
jbe 0x424766
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x424782
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x424771
mov ebx, dword [ebp - 0x44]
lea eax, [ebp - 0x4c]
push edx
push esi
push eax
mov ecx, ebx
call fcn.004242c0
mov eax, dword [eax + 4]
test eax, eax
je 0x4247c2
cmp eax, dword [ebx + 4]
je 0x4247c2
cmp dword [ebx + 8], 1
jne 0x4247d0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052df19
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x4247a6
push str.invalid_map_K__T__key
call fcn.0052f5fd
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.00424820
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
push eax
call fcn.004212f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.004246b0
push 0x589914
lea eax, [ebp - 0x58]
push eax
call fcn.0053202b
int3
Function at 0x426000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c9dd
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58f140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0052e124
mov edi, eax
add esp, 4
test edi, edi
je 0x4260ad
push 1
mov dword [ebp - 4], 0
call fcn.0052ffde
add esp, 4
mov dword [edi + 4], eax
jmp 0x4260af
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.00420710
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
not ecx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and ecx, 1
mov dword [ebp - 4], 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
test bl, 4
cmove eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
cmp dword [ecx + 0x14], 0xf
mov ebx, dword [ecx + 0x10]
jbe 0x426108
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
cmp ebx, 0x7fffffff
ja 0x4261ce
test ebx, ebx
je 0x4261ae
and eax, 6
cmp al, 6
je 0x4261ab
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [esi + 0x40]
push eax
call fcn.0040ada0
push ebx
push dword [ebp + 8]
mov edi, eax
push edi
call fcn.00532150
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + edi]
mov dword [esi + 0x38], ecx
add esp, 0x14
mov ecx, eax
and ecx, 4
mov dword [ebp + 8], ecx
jne 0x42616b
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
test al, 2
jne 0x4261a6
mov edx, dword [esi + 0x38]
test al, 0x18
mov eax, dword [esi + 0x10]
mov ecx, edi
cmovne ecx, edx
sub edx, ecx
cmp dword [ebp + 8], 0
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
je 0x4261a3
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
or eax, 1
jmp 0x4261b5
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0052efcb
int3