joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x44b008], 0x8088405
inc edx
mov dword [ebx + 0x44b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d330
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d361
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d349
add dl, dl
jne 0x41d36c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d3bd
xor eax, eax
add dl, dl
jne 0x41d379
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d45a
add dl, dl
jne 0x41d388
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d393
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d39e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d3a9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d3b3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d358
mov eax, 1
add dl, dl
jne 0x41d3cb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d3d6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3c2
sub eax, ebx
mov ebx, 1
jne 0x41d409
mov ecx, 1
add dl, dl
jne 0x41d3ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3e6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d358
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d420
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d42b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d417
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d358
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d47b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d358
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41eb18
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
add edx, edx
inc edx
test edx, edx
js 0x41eb34
mov ecx, dword [eax + edx*4]
dec edx
push ecx
jns 0x41eb2d
mov dword [ebp + 0x10], esp
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
lea ebx, [ecx + 1]
mov eax, ebx
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ebx, ebx
jle 0x41eb6e
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], eax
sub dword [ebp - 0x30], 1
sbb dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp ebx, 1
jle 0x41eb95
mov eax, dword [esi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x30], 1
sbb dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp ebx, 2
jle 0x41ebbc
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1c], eax
sub dword [ebp - 0x30], 1
sbb dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
cmp ebx, 3
jle 0x41ebe3
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x24], eax
sub dword [ebp - 0x30], 1
sbb dword [ebp - 0x2c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
lea eax, [esi + 0x20]
xor edx, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
xor eax, eax
mov dword [ebp - 8], eax
mov word [ebp - 2], 0
mov word [ebp - 2], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 8], esp
and esp, 0xfffffff0
push 0x33
call 0x41ec23
add dword [esp], 5
retf

Function at 0x41ecb8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [ebp + 8], 0
je 0x41ed29
cmp dword [ebp + 0x10], 0
jne 0x41ecce
cmp dword [ebp + 0xc], 0
je 0x41ed29
cmp dword [ebp + 0x14], 0
je 0x41ed29
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x33
call fcn.0041ece9
pop ecx
pop ecx
pop ebp
ret

Function at 0x41ed30
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
cmp dword [ebp + 8], 0
je 0x41edb4
cmp dword [ebp + 0x10], 0
jne 0x41ed48
cmp dword [ebp + 0xc], 0
je 0x41edb4
cmp dword [ebp + 0x14], 0
je 0x41edb4
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x33
call fcn.0041ed67
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x41edbc
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.0041edd7
Function at 0x41f5a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x42ea8e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f5ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f60e
mov ecx, edx
add ecx, ebx
jmp 0x41f60e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f60e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f680
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f669
test esi, esi
jbe 0x41f680
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f65b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f680
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f638
jmp 0x41f680
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f680
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ea95
ret
Function at 0x4207ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x42fe07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420827
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420840
lea eax, [ebp - 0x10]
mov edx, dword [0x44d77c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420853
lea eax, [ebp - 0x10]
mov edx, dword [0x44d77c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42085f
adc edx, 0
mov edx, dword [edx*4 + 0x44c568]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4209d9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4209cc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4209cc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42096a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42096a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42096a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42096a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4209cc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4209cc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4209f1
inc ebx
cmp ebx, 0x19
jne 0x420819
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fe0e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x40a680
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
and esp, 0xfffffff8
sub esp, 0x78
xor eax, eax
lea ecx, [esp + 0x40]
mov edx, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
mov edi, edx
or edi, edi
mov ebx, esi
or ebx, ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], edi
mov edi, dword [esp + 0x64]
mov dword [esp + 0x64], edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [0x45402c]
mov dword [esp + 0x20], eax
call ecx
lea ecx, [esp + 0x40]
mov edx, dword [0x454034]
push ecx
mov dword [esp + 0x20], eax
call edx
mov eax, dword [esp + 0x20]
add eax, 1
cmp eax, 0x5dc
mov dword [esp + 0x24], eax
je 0x40a73a
jmp 0x40a6c6
lea eax, [esp + 0x38]
mov ecx, dword [0x454010]
push eax
call ecx
mov ecx, dword [0x454060]
push 0x58
push 0x58
mov dword [esp + 0x20], eax
call ecx
mov dword [esp + 0x14], eax
call fcn.00424724
mov ecx, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
lea esp, [ebp - 0xc]
pop edi
pop ebx
pop esi
pop ebp
ret
xor eax, eax
mov dword [esp + 8], eax
call fcn.0040a7ed
mov eax, dword [0x454004]
call eax
mov ecx, dword [0x454078]
push 0x478da2
push 0xa8c50d
mov dword [esp + 0xc], eax
call ecx
mov dword [esp], eax
mov ecx, dword fs:[0x18]
mov eax, dword [esp + 0x2c]
or eax, eax
mov edx, dword [esp + 0x28]
or edx, edx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x30]
add eax, eax
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 0x30]
cmp dword [eax + 0xa4], 6
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
jb 0x40a72e
call fcn.004244ab
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
add edx, esi
mov eax, dword [eax + esi]
cmp eax, 0x4550
mov eax, ecx
cmove eax, edx
cmp word [eax + 0x48], 5
mov dword [esp + 0xc], ecx
ja 0x40a6fb
jmp 0x40a72e
Function at 0x42426c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov word [esp + 0x36], 0x49ed
mov dword [esp + 0x30], eax
mov edx, dword fs:[0x18]
xor eax, eax
mov esi, dword [esp + 0x30]
cmp esi, 0
setne bl
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0xc]
mov edi, edx
add edi, 0x14
mov edx, dword [edx + 0x14]
cmp edx, edi
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x2b], bl
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], eax
je 0x4243b3
jmp 0x4242e8
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dx, word [ecx]
shr dx, 1
movzx esi, dx
cmp dx, 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
je 0x42433f
jmp 0x424359
mov eax, dword [esp + 0x24]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x10]
mov esi, dword [esp + 0x30]
cmp edx, esi
sete bl
mov bh, byte [esp + 0x2b]
and bh, bl
mov edi, dword [eax + 0x28]
test bh, 1
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
jne 0x42431d
jmp 0x4242c8
mov eax, dword [esp + 0xc]
add eax, 0xfffffff8
mov dword [esp + 0x1c], eax
jmp 0x4243b3
mov al, byte [esp + 3]
test al, 1
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
jne 0x4243b3
jmp 0x42433f
xor eax, eax
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov esi, dword [esp + 0x20]
cmp edx, esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], eax
je 0x4243b3
jmp 0x4242e8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
cmovb dx, di
mov ebx, eax
add ebx, 1
mov ecx, dword [esp + 0x14]
cmp ebx, ecx
setb cl
mov esi, dword [esp + 0x2c]
cmp word [esi + eax*2], dx
sete ch
cmp dx, 0
setne al
mov ah, ch
and ah, al
and ah, cl
test ah, 1
mov byte [esp + 3], ch
mov dword [esp + 0x10], ebx
jne 0x424359
jmp 0x42432d
mov eax, dword [esp + 0x1c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x424fdf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
and esp, 0xfffffff8
sub esp, 0x88
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
lea esi, [esp + 0x58]
lea edi, [esp + 0x44]
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x3c], eax
mov eax, ebx
mov dword [esp + 0x38], ecx
mov cl, al
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x3c]
shr eax, cl
mov cl, byte [esp + 0x37]
mov dword [esp + 0x30], eax
mov eax, ebx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x3c]
shrd eax, edx, cl
xor ecx, ecx
mov dl, byte [esp + 0x37]
test dl, 0x20
mov edx, dword [esp + 0x30]
cmovne eax, edx
cmovne edx, ecx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], eax
jmp 0x4250f1
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 0
mov eax, dword [esp + 0x28]
call eax
mov ecx, eax
mov edx, dword [esp + 0x40]
push edx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
call fcn.00424e8f
add esp, 8
mov eax, dword [esp + 0x14]
add eax, 0xffc00000
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x54], edx
mov dword [ecx + 0x58], eax
mov eax, dword [esp + 0x28]
add eax, 0xc8120c8c
mov esi, dword [esp + 0x3c]
adc esi, 0xffffffff
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x10]
add eax, 0x28b1
mov dword [esp + 0xc], eax
jmp 0x4250e5
mov eax, dword [esp + 8]
add eax, 1
cmp eax, 4
mov dword [esp + 0x1c], eax
je 0x425069
jmp 0x4250f1
mov eax, dword [esp + 0xc]
lea esp, [ebp - 0xc]
pop edi
pop ebx
pop esi
pop ebp
ret
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [eax*4 + 0x40982c]
mov dword [esp + eax*4 + 0x44], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 4]
mov cl, byte [eax + 0x409a17]
mov dl, byte [eax + 0x40999c]
sub dl, cl
mov byte [esp + eax + 0x58], dl
add eax, 1
cmp eax, 0xe
mov dword [esp + 4], eax
jne 0x42510a
call fcn.0042456d
sub esp, 8
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.00424cd7
add esp, 8
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ecx
je 0x4250e5
jmp 0x4250d3
Function at 0x42515d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x2c], 0x2461c049
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
jmp 0x4251de
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
xor ecx, 0x2461c025
xor edx, edx
mov dword [esp + 4], eax
div ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 4]
mov bl, byte [eax + ecx]
mov bh, byte [edx + 0x4099aa]
sub bl, bh
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0x2a0e81a0
mov edx, dword [esp + 0x10]
mov byte [edx + ecx], bl
add ecx, 0x58
mov esi, dword [esp + 0x18]
cmp ecx, esi
mov dword [esp + 8], ecx
jb 0x42518d
jmp 0x425201
mov eax, dword [esp + 0xc]
mov ecx, dword [eax*4 + 0x40983c]
mov edx, dword [esp + 0x18]
cmp ecx, edx
mov dword [esp], eax
mov dword [esp + 8], ecx
jb 0x42518d
jmp 0x425201
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, 0x2461c04a
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp]
add ecx, eax
cmp ecx, 0x58
mov dword [esp + 0xc], ecx
je 0x4251fa
jmp 0x4251de
Function at 0x4060c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c593
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x43d054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [0x42e098]
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.00406020
mov edi, eax
mov dword [ebp - 4], 0
call dword [0x42e098]
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.00405e50
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.0040d290
push 0x439a8c
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0040d400
push edi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.0040d5c0
push 0x439a80
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0040d400
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.00403050
lea ecx, [ebp - 0x58]
call fcn.00403050
lea ecx, [ebp - 0x70]
call fcn.00403050
lea ecx, [ebp - 0x88]
call fcn.00403050
lea ecx, [ebp - 0xa0]
call fcn.00403050
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00403010
push eax
push 0x439ab0
push 0
push 0
call dword [0x42e1e4]
push 0
call fcn.0041882d
int3
Function at 0x40a080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ca00
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x43d054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 4], 0
call fcn.004193f3
add esp, 4
push eax
call fcn.00418997
mov edx, dword [ebp + 0x1c]
lea ecx, [ebp + 8]
mov esi, dword [ebp + 8]
add esp, 4
cmp edx, 0x10
cmovae ecx, esi
cmp dword [ebp + 0x18], 3
jne 0x40a0ff
movzx eax, byte [ecx]
cmp al, 0x63
jne 0x40a0f6
movzx eax, byte [ecx + 1]
cmp al, 0x68
jne 0x40a0f6
movzx eax, byte [ecx + 2]
cmp al, 0x6b
jne 0x40a0f6
xor eax, eax
jmp 0x40a0fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a149
cmp edx, 0x10
lea ecx, [ebp + 8]
cmovae ecx, esi
cmp dword [ebp + 0x18], 4
jne 0x40a16f
mov eax, dword [ecx]
mov edx, 0x439b48
cmp eax, dword [edx]
jne 0x40a120
add ecx, 4
xor eax, eax
jmp 0x40a145
cmp al, byte [edx]
jne 0x40a140
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40a140
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40a140
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x40a140
xor eax, eax
jmp 0x40a145
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40a16f
push ecx
lea ecx, [ebp - 0xd8]
call fcn.0040a250
sub esp, 0xc
lea ecx, [ebp - 0xd8]
push 0x439b50
call fcn.0040c0a0
push 0
call fcn.0041882d
push 0
push 0
push 0
push 0x4056a0
push 0
push 0
call dword [0x42e094]
push 0xbb8
call dword [0x42e084]
push 0x439b58
lea ecx, [ebp - 0xf4]
call fcn.00403120
lea edx, [ebp - 0xf4]
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00406aa0
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0
call fcn.00403050
call fcn.00405440
mov esi, eax
call fcn.00405b20
mov ecx, eax
test esi, esi
je 0x40a1d9
mov eax, 0x439b60
jmp 0x40a1e8
test ecx, ecx
mov eax, 0x439b64
mov edx, 0x439b68
cmove eax, edx
push eax
mov ecx, 0x450db0
call fcn.00403020
lea ecx, [ebp - 0x28]
call fcn.004076a0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040d660
test al, al
je 0x40a22c
sub esp, 0x18
mov ecx, esp
push 0x439b70
call fcn.00403120
lea ecx, [ebp - 0x28]
call fcn.00403010
mov ecx, eax
call fcn.004072a0
add esp, 0x18
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.0040c710
call fcn.00409900
add esp, 0x18
call fcn.004060c0
int3
Function at 0x40c0a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42caff
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x43d054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0
mov dword [ebx], 0x439c34
mov dword [ebp - 0x1c], eax
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x68], 0x439c30
mov dword [ebp - 4], 0
lea esi, [ebx + 4]
mov eax, dword [ebx]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x439cf8
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.0040cf80
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov dword [ebp - 0x14], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x439c28
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.0040ceb0
lea eax, [ebx + 4]
lea ebx, [eax + 4]
mov dword [eax], 0x439be8
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea esi, [eax + 8]
mov byte [eax + 0x48], 0
lea edi, [eax + 0x14]
mov byte [eax + 0x3d], 0
lea edx, [eax + 0x24]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x450d1c]
mov dword [eax], 0
mov eax, dword [0x450d18]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x18]
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 3
cmp dword [ebx + 0x4c], 0
jne 0x40c275
push 0x40
push 2
push dword [ebp - 0x1c]
call fcn.0040f1b4
add esp, 0xc
test eax, eax
je 0x40c275
push 1
push eax
mov ecx, ebx
call fcn.0040cd30
mov eax, dword [ebx + 0x34]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
call fcn.0040d670
add esp, 4
mov ecx, ebx
push eax
call fcn.0040cbd0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x40c25e
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40c25e
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00404f60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10