joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ac9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10011a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne fcn.01001b15
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
jmp loc.01007d0a

Function at 0x1001b21
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x10055b4]
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0x10011ec
call fcn.01001ac9
test eax, eax
je 0x1001b52
xor eax, eax
jmp 0x1001b89
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x260]
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov dword [ebp - 0x254], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
call fcn.01003d98
leave
ret

Function at 0x1001cac
Capabilities:
Link many functions at runtime
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100124c
push ebx
mov dword [edi + 0x18], ebx
call esi
test eax, eax
mov dword [edi], eax
je 0x1001d19
push 0x1001244
push ebx
call esi
test eax, eax
mov dword [edi + 4], eax
je 0x1001d19
push 0x1001238
push ebx
call esi
test eax, eax
mov dword [edi + 8], eax
je 0x1001d19
push 0x1001220
push ebx
call esi
test eax, eax
mov dword [edi + 0xc], eax
je 0x1001d19
jmp loc.01007b18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x1001e83
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10055dc]
test eax, eax
jne fcn.01001ea4
jmp loc.01007bd4

Function at 0x10021ff
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push esi
push 1
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [0x10055f4], eax
je 0x100223b
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x100206b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x10055f0], eax
jne 0x1002243
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x10023e8
Capabilities:
Get hostname
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10055b4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x2c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
push 0x400
push esi
push 0
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jbe fcn.01002455
add eax, eax
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
push eax
push 0
mov dword [0x1005610], esi
call sub.NETAPI32.dll_NetMessageBufferSend
push dword [ebp - 0x28]
jmp loc.01008647

Function at 0x10024f0
Capabilities:
Create thread
Packed with generic packer

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0x1005608], esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
jne 0x100250f
push esi
push esi
push esi
push esi
call edi
mov dword [0x1005608], eax
cmp dword [0x100560c], esi
jne 0x1002522
push esi
push esi
push esi
push esi
call edi
mov dword [0x100560c], eax
cmp dword [0x1005604], esi
jne 0x100253f
push esi
push esi
push esi
push 0x1002464
push esi
push esi
jmp 0x10079c3
pop edi
pop esi
ret

Function at 0x10025a2
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push esi
push 0xffffffffffffffff
call fcn.01002bc2
call fcn.01002c49
push 0xffffffffffffffff
mov esi, eax
call fcn.01002da6
test esi, esi
jne 0x10025ca
mov dword [0x1005614], 1
jmp fcn.010025d4
push 0
push 0
push esi
jmp loc.01007ab1

Function at 0x10026d2
Capabilities:
Packed with generic packer

Disassembly:
call fcn.01003898
push 2
jmp loc.01007df1

Function at 0x100279d
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
or esi, 0xffffffff
call fcn.01003886
lea eax, [ebp - 4]
push eax
call fcn.010033f8
test eax, eax
jne 0x10027da
cmp dword [ebp - 4], 1
jne 0x10027da
lea eax, [ebp - 8]
push eax
call fcn.01003413
test eax, eax
jne 0x10027da
mov esi, dword [ebp - 8]
imul esi, esi, 0xea60
call fcn.01002764
cmp eax, 4
jne 0x1002805
call fcn.01002e42
cmp eax, 1
jne 0x1002805
push esi
push 2
call fcn.01001c52
call fcn.01002764
cmp eax, 4
jne 0x1002805
push 5
pop eax
jmp 0x100280a
jmp 0x1008324
pop esi
leave
ret

Function at 0x1002853
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
dec ecx
dec ecx
je 0x1002876
dec ecx
je 0x100286f
dec ecx
jne 0x100287b
call fcn.0100279d
jmp 0x100287b
call fcn.01002775
jmp 0x100287b
jmp 0x10074e9
pop ebp
ret 4

Function at 0x1002884
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
call fcn.01002e42
test eax, eax
je 0x10028b5
jmp loc.01008254
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10028c1
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
dec eax
je 0x10028f1
dec eax
je 0x10028e7
dec eax
jne 0x10028f9
push dword [ebp + 0xc]
call fcn.010026c5
mov dword [0x100561c], 1
jmp 0x10028f9
push dword [ebp + 0xc]
call fcn.01002da6
jmp 0x10028f9
push dword [ebp + 0xc]
jmp 0x1007fc9
pop ebp
ret 8

Function at 0x1002902
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
dec eax
je 0x1002935
dec eax
je 0x100291e
dec eax
jne 0x100293d
push dword [ebp + 0xc]
call fcn.01002635
jmp 0x100293d
push dword [0x100561c]
push dword [ebp + 0xc]
call fcn.010025fb
and dword [0x100561c], 0
jmp 0x100293d
push dword [ebp + 0xc]
jmp 0x10075a3
pop ebp
ret 8

Function at 0x1002ada
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x1001258
jmp loc.01007eb2

Function at 0x1002b27
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10055b4]
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push 0x28
xor ebx, ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1002baf
lea eax, [ebp - 0x60]
push eax
push 0x1001260
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1002baf
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [ebp - 0x54]
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x58], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1002baf
lea eax, [ebp - 0x50]
push eax
call sub.POWRPROF.dll_GetPwrCapabilities
test al, al
je 0x1002ba3
cmp byte [ebp - 0x49], bl
je 0x1002ba3
push 0xffffffffffffffff
push 0xd
jmp 0x1002ba7
push 0xffffffffffffffff
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.01003d98
leave
ret

Function at 0x1002dae
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.01003886
lea eax, [ebp - 0xc]
push eax
call fcn.010033a7
lea eax, [ebp - 8]
push eax
call fcn.01003464
test eax, eax
jne fcn.01002df3
cmp dword [ebp - 8], 1
jne fcn.01002df3
lea eax, [ebp - 4]
push eax
call fcn.010034b5
test eax, eax
je 0x1002deb
mov dword [ebp - 4], 0x78
push dword [ebp - 4]
jmp loc.01007565

Function at 0x1002e4d
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp eax, 0xa
push esi
ja 0x1002e9f
jmp loc.010071ce
mov esi, dword [ebp + 8]
cmp dword [0x1005018], 0
jne 0x1002eb8
cmp esi, 6
je 0x1002eb8
cmp esi, 9
je 0x1002eb8
push 8
pop esi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1002ef0
Capabilities:
Packed with generic packer

Disassembly:
sub eax, 0
je 0x1002f29
dec eax
je 0x1002f22
sub eax, 4
je 0x1002f1b
dec eax
je 0x1002f14
dec eax
je 0x1002f0d
dec eax
jne fcn.01002f2f
push ecx
call fcn.01002da6
ret
push ecx
call fcn.010026c5
ret
push ecx
call fcn.01002d41
ret
push ecx
call fcn.010026c5
ret
push ecx
call fcn.0100283b
ret
push ecx
jmp loc.010072a6

Function at 0x1002ffd
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1003031
push esi
mov esi, dword [edi]
test esi, esi
je 0x1003030
mov eax, dword [esi + 0x10]
test eax, eax
je 0x100301f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp loc.0100820c
pop esi
pop edi
pop ebp
ret 4

Function at 0x100303b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jmp loc.01008198

Function at 0x1003113
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1003179
push esi
mov esi, dword [ebx]
test esi, esi
je 0x1003178
cmp dword [esi + 0x10], 0
je 0x1003173
cmp dword [ebp + 0xc], 1
je 0x1003139
cmp dword [esi + 0x18], 1
jne 0x1003173
lea eax, [ebp + 8]
push eax
push 2
push 0
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100316f
jmp 0x1007434
and dword [esi + 0x18], 0
add ebx, 4
jne 0x1003121
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100326b
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
je 0x100329b
cmp dword [ebp + 0xc], esi
je 0x100329b
jmp loc.010078a3
push 0x57
pop esi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x10032df
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x1005024], ebx
je 0x100334e
push esi
push edi
mov edi, 0x1005024
mov esi, 0x1005028
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [esi - 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne fcn.01003342
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
push dword [esi]
push 1
push ebx
jmp loc.01008388
pop ebx
leave
ret

Function at 0x1003665
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x10051b0
jmp loc.01007e29

Function at 0x1003830
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
jmp loc.01007950
Function at 0x10038e0
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
xor esi, esi
lea eax, [ebp - 8]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1001698
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100394d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 2
je 0x100393b
call fcn.01003886
lea eax, [ebp - 4]
push eax
call fcn.01003371
test eax, eax
jne 0x100393b
test byte [ebp - 4], 1
je 0x100393b
push 1
jmp 0x100393c
push esi
call fcn.010036d1
push 1
call fcn.010038aa
jmp 0x10077a1
pop esi
leave
ret

Function at 0x1003a01
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push 2
push edi
push edi
push edi
push 0x1001698
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jmp loc.0100810e

Function at 0x1003bf7
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
jmp loc.01007976

Function at 0x10070c3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
add dl, dl
push ebx
push edx
dec ecx
dec ecx
dec ecx
and al, 0
add al, 0
add esp, 8
leave
popal
popfd
mov ebp, esp
mov eax, dword [ebp + 0xc]
jmp fcn.0100294e

Function at 0x1007567
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call fcn.01001c92
jmp fcn.01002df3

Function at 0x1007e8c
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov edi, edi
push ecx
mov eax, dword [0x10049f1]
push ebx
push edi
push 0
mov ecx, eax
test eax, eax
add esp, 0x10
leave
popal
popfd
push 0x1001258
jmp loc.01002a2e

Function at 0x710c5e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7109ec
add ebx, 0xa893969c
add ebx, 0x1ae98e9f
call fcn.00710c97
add ebx, 1
xor dword [eax], edx
or ebx, ebx
add ebx, ebx
inc eax
add edi, ebx
push ebx
mov ebx, dword [esp]
add esp, 4
add ebx, ebx
cmp eax, esi
jne fcn.00710c5e
or ebx, ebx
add ebx, ebx
ret
Function at 0x432005
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x74f87e74
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x484b21f6
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402f60
Capabilities:
Get disk information

Disassembly:
sub esp, 0x430
mov eax, dword [esp + 0x434]
mov ecx, dword [eax]
push ebx
mov ebx, dword [0x430f4c]
push ebp
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [0x430f48]
xor ebp, ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x38], 0x9e3779b9
call fcn.00402f30
mov eax, dword [0x430f50]
mov edx, dword [0x430f54]
add dword [esp + 0x14], 0x23f
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], 0x20
mov dword [esp + 0x24], 2
add dword [esp + 0x24], 3
mov eax, dword [0x2adda1c]
shl ecx, 4
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
cmp eax, 0xfa9
jne 0x402ff0
mov dword [0x2adda18], 0xedeb2e40
jmp 0x402ffd
cmp eax, 0x3eb
jne 0x402ffd
mov dword [0x2ada924], ebp
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
shr eax, 5
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x18]
mov dword [0x2adda14], 0xf4ea3dee
call fcn.00402f40
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0x18], eax
cmp dword [0x2adda1c], 0x213
jne 0x403078
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
sub esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
mov eax, esi
mov dword [esp + 0x34], esi
call fcn.00402f20
add dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x14]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, esi
shr ecx, 5
add ecx, ebx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
cmp dword [0x2adda1c], 0x121
jne 0x4030d8
push ebp
push ebp
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
mov ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
mov dword [esp + 0x10], ecx
call fcn.00402f50
mov eax, dword [esp + 0x38]
sub dword [esp + 0x14], eax
sub dword [esp + 0x2c], 1
mov ecx, dword [esp + 0x28]
jne 0x402fc0
mov eax, dword [esp + 0x444]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x430
ret 4
Function at 0x40a3fd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430ba0]
jne 0x40a407
repz ret
jmp fcn.0040d4c2

Function at 0x40c25e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004086c0
and dword [ebp - 4], 0
cmp dword [0x432d38], 0
mov ebx, eax
jne 0x40c30f
push 0x401ad8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c3c0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401acc
push edi
call esi
test eax, eax
je 0x40c3c0
push eax
call fcn.0040864e
mov dword [esp], 0x401abc
push edi
mov dword [0x432d38], eax
call esi
push eax
call fcn.0040864e
mov dword [esp], 0x401aa8
push edi
mov dword [0x432d3c], eax
call esi
push eax
call fcn.0040864e
mov dword [esp], 0x401a8c
push edi
mov dword [0x432d40], eax
call esi
push eax
call fcn.0040864e
pop ecx
mov dword [0x432d48], eax
test eax, eax
je 0x40c30f
push 0x401a74
push edi
call esi
push eax
call fcn.0040864e
pop ecx
mov dword [0x432d44], eax
mov eax, dword [0x432d44]
cmp eax, ebx
je 0x40c367
cmp dword [0x432d48], ebx
je 0x40c367
push eax
call fcn.004086c9
push dword [0x432d48]
mov esi, eax
call fcn.004086c9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c367
test edi, edi
je 0x40c367
call esi
test eax, eax
je 0x40c35e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c35e
test byte [ebp - 0xc], 1
jne 0x40c367
or dword [ebp + 0x10], 0x200000
jmp 0x40c3a0
mov eax, dword [0x432d3c]
cmp eax, ebx
je 0x40c3a0
push eax
call fcn.004086c9
pop ecx
test eax, eax
je 0x40c3a0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c3a0
mov eax, dword [0x432d40]
cmp eax, ebx
je 0x40c3a0
push eax
call fcn.004086c9
pop ecx
test eax, eax
je 0x40c3a0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x432d38]
call fcn.004086c9
pop ecx
test eax, eax
je 0x40c3c0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c3c2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403030
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x69c3d8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403200
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.0046bac0
jmp fcn.00403030
Function at 0x40b7a0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x69c3d8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b96b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b7c9
mov eax, 0x7000000
jmp 0x40b7d1
test eax, eax
je 0x40b946
mov dword [esp + 0x34], eax
mov ecx, dword [0x69c3d8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x448]
mov ebx, dword [ecx + 0x44c]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x448], ebx
mov dword [ecx + 0x44c], ebp
mov dword [esp], edx
call fcn.0046ce70
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x66d620]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40b95e
cmp edx, 0x21
jae 0x40b952
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.0045f7c0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0045f890
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x5cd978]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x5cd9b8]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b921
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x5cd9f0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.0046cf50
mov eax, edx
mov ecx, 0x21
call fcn.0046d020
nop
call fcn.0046bac0
jmp fcn.0040b7a0