joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425ee7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4391b8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x425f89
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x42608b
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x426039
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42608c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42602e
cmp dword [ebp - 0x24], 1
jne 0x42602e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x42ceb4
push eax
call fcn.00410596
add esp, 0xc
cmp eax, 1
jne 0x42602e
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42608c
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x42608c
lea ecx, [ebp - 0x18]
push ecx
push 0x425ed1
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x42608c
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x4260b2
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.00425e52
cmp eax, ebx
pop ecx
pop ecx
jne 0x4260b4
inc edi
cmp edi, esi
jl 0x42609b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00410d8f
leave
ret 4
Function at 0x4260c3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x438120
je 0x42617f
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x426167
mov esi, dword [ebx + 4]
jmp 0x426161
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x426151
cmp dword [ebp - 0xc], 4
jne 0x426151
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x426149
or dword [eax + 0x9c], ecx
jmp 0x426151
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x426115
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x4260f8
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x42656c
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x42a712
call fcn.00410da0
sub esp, 0x11c
mov eax, dword [0x4391b8]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x426665
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x426639
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00402d60
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0042656c
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004012c0
test bl, bl
jne 0x426639
or dword [ebp - 4], 0xffffffff
jmp 0x4265aa
cmp esi, 0x103
je 0x426649
cmp esi, 0x3f2
jne 0x426659
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00410d8f
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4278a2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4278d7
cmp edi, dword [esi + 0xc]
jge 0x4278d7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4278d7
cmp edi, dword [eax + 8]
jge 0x4278d7
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4278d9
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4279dd
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x427a11
jmp fcn.0041c19b
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x427a82
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x427b7b
cmp eax, dword [edi + 0xc]
jge 0x427b7b
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x427ad3
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x427b64
cmp dword [ebp + 0xc], ebx
je 0x427b64
jmp 0x427afd
push 0x10
call fcn.0042776e
cmp eax, ebx
je 0x427ae9
mov ecx, eax
call fcn.004279d4
mov esi, eax
jmp 0x427aeb
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x427b14
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x427b24
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x427b36
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041c19b
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00411230
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x427b76
cmp ecx, dword [esi + 8]
jge 0x427b76
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x427b7c
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x427c3b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x427c69
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x427c87
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00427ba5
jmp 0x427c87
mov eax, dword [esi + 0x14]
test eax, eax
je 0x427c87
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00427ba5
test edi, edi
mov eax, edi
jne 0x427c71
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x43be14]
test ecx, ecx
je 0x427d3a
jmp 0x427c3a
ret 8

Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push str.http:__desk.8090.so
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
ret
Function at 0x412a40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x412a60
test edi, edi
mov al, byte [ebp + 0x4bb680]
mov byte [esp + 0x10], al
je 0x412ae9
cmp byte [edi], 0
mov eax, edi
je 0x412a7d
add eax, 1
cmp byte [eax], 0
jne 0x412a75
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x188
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x412ad1
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x412ac7
movzx edi, byte [edx]
movzx edi, byte [edi + 0x4bb470]
lea ebp, [eax*8]
xor edi, ebp
sub esi, 1
xor eax, edi
add edx, 1
test esi, esi
jg 0x412aa0
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x412ad3
xor edx, edx
push edi
call fcn.004136f0
add esp, 4
test eax, eax
je 0x412ae5
mov eax, dword [eax + 8]
jmp 0x412af0
xor eax, eax
jmp 0x412af0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x412b00
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x412b23
add ebp, 1
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x412a60
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x4134f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x413521
push esi
push edi
jmp 0x413500
movzx esi, byte [edx]
movzx esi, byte [esi + 0x4bb470]
lea edi, [eax*8]
xor esi, edi
sub ecx, 1
xor eax, esi
add edx, 1
test ecx, ecx
jg 0x413500
pop edi
pop esi
ret
Function at 0x413590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x4135ad
mov esi, 0x80
cmp esi, dword [edi]
jne 0x4135ba
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x4d68cc]
test eax, eax
je 0x4135c5
call eax
lea ecx, [esi*8]
push ecx
call fcn.0040fd80
mov ebp, eax
mov eax, dword [0x4d68d0]
add esp, 4
test eax, eax
mov dword [esp + 0x10], ebp
je 0x4135e6
call eax
test ebp, ebp
je 0x4135b1
mov edx, dword [edi + 0xc]
push edx
call fcn.00410050
add esp, 4
push ebp
mov dword [edi + 0xc], ebp
call dword [0x4d34dc]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call fcn.00482a10
mov ecx, dword [edi + 8]
add esp, 0xc
test ecx, ecx
mov dword [edi + 8], 0
je 0x4136d5
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x413667
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x4bb470]
lea ebp, [eax*8]
xor ebx, ebp
sub edx, 1
xor eax, ebx
add esi, 1
test edx, edx
jg 0x413640
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x4136b0
mov esi, dword [eax]
test esi, esi
je 0x413684
mov edx, dword [eax + 4]
jmp 0x413686
xor edx, edx
add esi, 1
test edx, edx
mov dword [eax], esi
mov dword [eax + 4], ecx
je 0x4136b0
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x4136a8
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x4136c9
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x4136c9
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x4136bf
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x413633
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x425870
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
test ebp, ebp
mov eax, ebp
jne 0x425887
xor ebx, ebx
jmp 0x4258a1
cmp byte [ebp], 0
je 0x425898
lea ecx, [ecx]
add eax, 1
cmp byte [eax], 0
jne 0x425890
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
xor esi, esi
test eax, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jle 0x425964
jmp 0x4258c4
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x4258cc
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4258ec
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edx, dword [edx + eax]
call fcn.004107a0
test eax, eax
jne 0x42594f
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
shl esi, 4
mov ecx, dword [esi + edx + 0xc]
add ecx, 4
cmp dword [ecx + 0xc], 0
je 0x425939
xor eax, eax
test ebx, ebx
mov edi, ebx
mov edx, ebp
jle 0x425933
lea ecx, [ecx]
movzx esi, byte [edx]
movzx esi, byte [esi + 0x4bb470]
lea ebp, [eax*8]
xor esi, ebp
sub edi, 1
xor eax, esi
add edx, 1
test edi, edi
jg 0x425910
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x42593b
xor edx, edx
push ebp
call fcn.004136f0
add esp, 4
test eax, eax
je 0x42596e
mov edi, dword [eax + 8]
test edi, edi
jne 0x425964
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x4258c0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x42594f

Function at 0x425a20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
test edi, edi
mov eax, edi
jne 0x425a36
xor ebx, ebx
jmp 0x425a51
cmp byte [edi], 0
je 0x425a48
jmp 0x425a40
add eax, 1
cmp byte [eax], 0
jne 0x425a40
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 4]
xor eax, eax
test edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
jle 0x425b12
mov ecx, dword [ecx + 8]
push esi
mov dword [esp + 0x14], ecx
jmp 0x425a74
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x425a7c
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x425a9c
mov edx, dword [eax]
call fcn.004107a0
test eax, eax
jne 0x425aef
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x14]
je 0x425ad9
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x425ad3
nop
movzx edi, byte [edx]
movzx edi, byte [edi + 0x4bb470]
lea ebp, [eax*8]
xor edi, ebp
sub esi, 1
xor eax, edi
add edx, 1
test esi, esi
jg 0x425ab0
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x425adb
xor edx, edx
push edi
call fcn.004136f0
add esp, 4
test eax, eax
je 0x425b0e
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x425b04
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x425a70
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x425aef
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x448390
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push esi
push edi
jne 0x4483aa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, 0x44
call fcn.004102a0
mov edi, eax
test edi, edi
je 0x4483a1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
push eax
push ecx
push esi
call fcn.00447eb0
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebx + 8]
push edx
push eax
push esi
call fcn.00448030
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ecx
push eax
push esi
call fcn.00447c40
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edx
push eax
push esi
call fcn.00447eb0
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ecx
push eax
push esi
call fcn.00447c40
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call fcn.00447eb0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
add esp, 0x1c
mov byte [edi + 4], cl
mov eax, dword [ebx + 0x1c]
push edx
push eax
push esi
call fcn.00448390
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ecx
push eax
push esi
call fcn.00447c40
mov edx, dword [ebp + 0x10]
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push edx
push eax
push esi
call fcn.00447c40
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
add esp, 0x20
and cx, 0xfff7
mov word [edi + 6], cx
mov dword [edi + 0x24], eax
or eax, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453ce0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ebx
push ebp
xor ebp, ebp
test dword [ecx + 0xc], 0x400000
push esi
push edi
mov dword [esp + 0x14], ebp
je 0x453e36
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x24]
test edi, edi
je 0x453d4c
jmp 0x453d10
mov eax, dword [edi + 0x14]
test eax, eax
jle 0x453d3d
lea edx, [edi + 0x24]
mov esi, eax
lea esp, [esp]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x453d2c
or eax, 0xffffffff
jmp 0x453d33
mov eax, 1
shl eax, cl
or ebp, eax
add edx, 8
sub esi, 1
jne 0x453d20
mov edi, dword [edi + 4]
test edi, edi
jne 0x453d10
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x14], ebp
mov edi, dword [ecx + 4]
test edi, edi
mov eax, edi
jne 0x453d59
xor ebx, ebx
jmp 0x453d71
cmp byte [edi], 0
je 0x453d68
mov edi, edi
add eax, 1
cmp byte [eax], 0
jne 0x453d60
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov ecx, dword [ecx + 0x44]
add ecx, 0x34
cmp dword [ecx + 0xc], 0
mov dword [esp + 0x18], ecx
je 0x453dbd
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x453db7
jmp 0x453d90
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x4bb470]
lea ebp, [eax*8]
xor ecx, ebp
sub esi, 1
xor eax, ecx
add edx, 1
test esi, esi
jg 0x453d90
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
xor edx, edx
div dword [ecx]
jmp 0x453dbf
xor edx, edx
push edi
call fcn.004136f0
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x453e36
mov edi, dword [eax + 8]
cmp edi, ebx
je 0x453e36
jmp 0x453de0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push edi
push eax
push ecx
xor eax, eax
mov dword [esp + 0x24], ebx
call fcn.00452470
mov eax, dword [esp + 0x24]
add esp, 0x10
cmp eax, ebx
je 0x453e2f
mov ecx, dword [eax + 4]
cmp ecx, ebx
jle 0x453e2f
mov edx, dword [eax + 8]
mov esi, ecx
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x453e1e
or eax, 0xffffffff
jmp 0x453e25
mov eax, 1
shl eax, cl
or ebp, eax
add edx, 4
sub esi, 1
jne 0x453e12
mov edi, dword [edi + 0xc]
cmp edi, ebx
jne 0x453de0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x453e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
push esi
jne 0x453e72
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.004535b0
test eax, eax
jne 0x453e67
cmp dword [esi + 0x24], eax
jne 0x453e67
pop esi
pop ebx
add esp, 0x14
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [ebp + 0x24]
test edi, edi
je 0x453ebd
nop
mov esi, dword [edi + 0x14]
xor edx, edx
test esi, esi
jle 0x453eb6
lea ecx, [edi + 0x24]
lea esp, [esp]
mov eax, dword [ecx]
cmp dword [ebx + eax*4], 0
jge 0x454051
cmp eax, dword [ebp + 8]
jne 0x453eac
cmp dword [esp + 0x30], 0
jne 0x454051
add edx, 1
add ecx, 8
cmp edx, esi
jl 0x453e90
mov edi, dword [edi + 4]
test edi, edi
jne 0x453e80
mov edi, dword [ebp + 4]
test edi, edi
mov eax, edi
jne 0x453eca
xor ebx, ebx
jmp 0x453ee1
cmp byte [edi], 0
je 0x453ed8
nop
add eax, 1
cmp byte [eax], 0
jne 0x453ed0
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov ecx, dword [ebp + 0x44]
add ecx, 0x34
cmp dword [ecx + 0xc], 0
mov dword [esp + 0x18], ecx
je 0x453f2d
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x453f27
jmp 0x453f00
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x4bb470]
lea ebp, [eax*8]
xor ecx, ebp
sub esi, 1
xor eax, ecx
add edx, 1
test esi, esi
jg 0x453f00
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x28]
xor edx, edx
div dword [ecx]
jmp 0x453f2f
xor edx, edx
push edi
call fcn.004136f0
add esp, 4
test eax, eax
je 0x454047
mov edx, dword [eax + 8]
test edx, edx
mov dword [esp + 0x18], edx
je 0x454047
nop
mov eax, dword [edx + 0x14]
test eax, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
jle 0x454038
mov ecx, dword [ebp + 0xc]
lea esi, [edx + 0x28]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
mov ebp, dword [esi]
xor esi, esi
test ecx, ecx
jle 0x45401c
mov eax, dword [esp + 0x28]
mov edi, dword [eax + 0x10]
lea esp, [esp]
test ebp, ebp
je 0x453fe8
mov ecx, dword [edi]
mov al, byte [ecx]
test al, al
mov edx, ebp
je 0x453fc1
mov edi, edi
movzx ebx, byte [edx]
movzx eax, al
mov al, byte [eax + 0x4bb470]
cmp al, byte [ebx + 0x4bb470]
jne 0x453fc1
mov al, byte [ecx + 1]
add ecx, 1
add edx, 1
test al, al
jne 0x453fa0
movzx ecx, byte [ecx]
movzx edx, byte [edx]
movzx eax, byte [ecx + 0x4bb470]
movzx ecx, byte [edx + 0x4bb470]
mov edx, dword [esp + 0x18]
sub eax, ecx
mov ecx, dword [esp + 0x1c]
neg eax
sbb eax, eax
add eax, 1
jmp 0x453fec
movzx eax, byte [edi + 0x15]
test eax, eax
je 0x45400a
mov eax, dword [esp + 0x2c]
cmp dword [eax + esi*4], 0
jge 0x454051
mov eax, dword [esp + 0x28]
cmp esi, dword [eax + 8]
jne 0x45400a
cmp dword [esp + 0x30], 0
jne 0x454051
add esi, 1
add edi, 0x18
cmp esi, ecx
jl 0x453f90
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
add dword [esp + 0x10], 8
add esi, 1
cmp esi, eax
mov dword [esp + 0x14], esi
jl 0x453f75
mov ebp, dword [esp + 0x28]
mov edx, dword [edx + 0xc]
test edx, edx
mov dword [esp + 0x18], edx
jne 0x453f50
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret