joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419289
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x5a08a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4192bc
xor eax, eax
jmp 0x419352
push 0x5a08dc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4192df
xor eax, eax
jmp 0x419352
push 0x5a08fc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419302
xor eax, eax
jmp 0x419352
push 0x5a090c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419325
xor eax, eax
jmp 0x419352
push 0x5a093c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419348
xor eax, eax
jmp 0x419352
mov eax, 1
jmp 0x419352
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4195f4
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0xf01ff
push 0x5a09f8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x419639
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x20005
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x419676
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419664
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x20008
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
jmp 0x419676
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41967b
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0xf01ff
push 0x5a0a04
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4196c0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x20005
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x419701
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4196ef
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x20007
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
jmp 0x419701
pop edi
pop esi
pop ebx
leave
ret

Function at 0x419706
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0xf01ff
push 0x5a0a10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x41974b
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x20005
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x41978e
lea eax, [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x41977c
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x20006
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
jmp 0x41978e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419851
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5a06b4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
cmp dword [ecx + eax*8], 0
je 0x4199b9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*8]
push eax
push 0x41a984
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41990f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*8]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419907
cmp dword [ebp + 0xc], 0
je 0x4198fd
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*8]
push eax
push 0x2010007
call dword [ebp + 0xc]
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc]
jmp 0x419874
push 0xff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
jne 0x41995c
cmp dword [ebp + 0xc], 0
je 0x419954
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*8]
push eax
push 0x2010007
call dword [ebp + 0xc]
add esp, 8
inc dword [ebp - 0xc]
jmp 0x419874
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4199b1
cmp dword [ebp + 0xc], 0
je 0x4199a7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*8]
push eax
push 0x2010007
call dword [ebp + 0xc]
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc]
jmp 0x419874
cmp dword [0x5a06b4], 0
je 0x4199d2
mov eax, dword [0x5a06b4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41a5e2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
mov ecx, dword [ebp + 8]
mov word [ecx], ax
push 0x200
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5a0aec
lea eax, [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x41a6bc
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x41a6bc
push 0x5a0af8
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41a6af
call dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x5a0b08
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x41a783
mov word [ebp - 0x218], 0
mov word [ebp - 0x214], 0
mov ax, word [ebp - 0x214]
mov word [ebp - 0x216], ax
push 0
lea eax, [ebp - 0x20c]
push eax
push 6
lea eax, [ebp - 0x218]
push eax
push 6
lea eax, [ebp - 0x218]
push eax
push 0x9c402450
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x41a755
jmp 0x41a783
xor eax, eax
mov ax, word [ebp - 0x216]
cmp eax, 0xfafa
je 0x41a776
mov eax, dword [ebp + 8]
mov word [eax], 0x100
jmp 0x41a783
mov ax, word [ebp - 0x214]
mov ecx, dword [ebp + 8]
mov word [ecx], ax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41a78a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [0x5a1d9c], 0
mov eax, dword [ebp + 0xc]
lea eax, [eax + eax*8]
shl eax, 4
add eax, dword [ebp + 8]
mov dword [0x5a1da0], eax
mov dword [ebp - 4], 0
jmp 0x41a7bd
inc dword [ebp - 4]
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 4], eax
jge 0x41a825
mov eax, dword [ebp - 4]
lea eax, [eax + eax*8]
shl eax, 4
mov ecx, dword [ebp + 8]
cmp dword [eax + ecx], 2
jne 0x41a820
push 0x5a0b18
mov eax, dword [ebp - 4]
lea eax, [eax + eax*8]
shl eax, 4
add eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.0041d600
add esp, 8
test eax, eax
jne 0x41a820
mov eax, dword [ebp - 4]
lea eax, [eax + eax*8]
shl eax, 4
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 4]
push eax
push 0x41a89b
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x41a7ba
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a82a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [0x5a1d9c], 0
mov dword [0x5a1da0], 0
mov dword [ebp - 4], 0
jmp 0x41a856
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp dword [ecx + eax*8 + 4], 0
je 0x41a881
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*8]
push eax
push 0x41a89b
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x41a853
mov eax, dword [0x5a1d9c]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x41a894
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41acb0
Capabilities:
Query service status

Disassembly:
call fcn.0041ac40
cmp eax, 2
je 0x41acc5
cmp eax, 3
je 0x41acca
mov eax, 9
ret
jmp 0x41ad50
jmp 0x41acd0
push ebx
push esi
push edi
xor esi, esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x41acf1
mov eax, 2
pop edi
pop esi
pop ebx
ret
push 0xf01ff
push 0x5a0b58
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x41ad18
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 2
pop edi
pop esi
pop ebx
ret
push 0x5a1d80
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41ad3b
cmp dword [0x5a1d84], 4
mov esi, 3
jne 0x41ad3b
mov esi, 4
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push edi
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
ret
push 0
push 0x5a0b44
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, 1
sbb eax, eax
add eax, 4
ret
Function at 0x41b685
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x41b6c9
push 0x400
lea eax, [ebp - 0x410]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x41b6dc
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0041bfa0
add esp, 8
push 0x5a0cf4
lea eax, [ebp - 0x810]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.0041bfb0
add esp, 8
push 0x5a0d08
lea eax, [ebp - 0x810]
push eax
call fcn.0041bfb0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x410]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
push eax
call fcn.0041bb95
add esp, 4
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0xc]
inc eax
push eax
push 0
mov eax, dword [ebp - 0x814]
push eax
call fcn.0041d470
add esp, 0xc
mov eax, dword [ebp - 0x814]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x410]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x41b7dc
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x814]
push eax
call sub.VERSION.dll_VerQueryValueA
cmp dword [ebp - 0x10], 0
jne 0x41b7cc
push 0x5a0d0c
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041bfa0
add esp, 8
jmp 0x41b7dc
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x814]
push eax
call fcn.0041c090
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x41b7f3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420241
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5a10b0
cmp edx, dword [eax]
je 0x420263
add eax, 8
inc ecx
cmp eax, 0x5a1140
jl 0x420254
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5a10b0]
jne 0x420391
mov eax, dword [0x5a1a48]
cmp eax, 1
je 0x42036b
test eax, eax
jne 0x420294
cmp dword [0x5a0fc4], 1
je 0x42036b
cmp edx, 0xfc
je 0x420391
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4202cb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041bfa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041bdf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x42030e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041bdf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42551c
push edi
call fcn.0041cdc0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041bfa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041bfb0
lea eax, [ebp - 0xa0]
push 0x4254fc
push eax
call fcn.0041bfb0
push dword [esi + 0x5a10b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041bfb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00422460
add esp, 0x2c
pop edi
jmp 0x420391
lea eax, [ebp + 8]
lea esi, [esi + 0x5a10b4]
push 0
push eax
push dword [esi]
call fcn.0041bdf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x424e7d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x424e9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004208f6
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x424ebe
test byte [esp + 8], 2
je 0x424ebe
mov dword [0x5a1a4c], 0xd
mov dword [0x5a1a50], 5
jmp 0x424e99
xor eax, eax
ret

Function at 0x424f39
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x424f64
test byte [esp + 8], 0x80
je 0x424f53
and al, 0xfe
jmp 0x424f55
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x424f75
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004208f6
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x42b3a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ax, word [esp + 0xc]
mov ebp, esp
xor word [ebp + 8], ax
push ebx
push esi
mov esi, 0xb
mov bl, byte [ebp + 9]
mov al, byte [ebp + 8]
mov byte [ebp + 9], al
mov eax, dword [ebp + 9]
push eax
call fcn.0042b3e8
xor al, bl
dec esi
mov byte [ebp + 8], al
jne 0x42b3bb
mov ax, word [ebp + 8]
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42c6b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0xb
mov bl, byte [ebp + 8]
mov al, byte [ebp + 9]
mov byte [ebp + 8], al
mov eax, dword [ebp + 8]
push eax
call fcn.0042b3e8
xor al, bl
dec esi
mov byte [ebp + 9], al
jne 0x42c6c2
mov ax, word [ebp + 0xc]
pop esi
xor word [ebp + 8], ax
pop ebx
mov ax, word [ebp + 8]
pop ebp
ret 8

Function at 0x4abec4
Capabilities:
Encode data using xor

Disassembly:
mov ax, 0x11
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov edx, dword [ebp + 8]
mov dword [ebp - 4], 0x14
push esi
push edi
mov si, word [edx]
xor ecx, ecx
xor di, di
mov bx, ax
xor bx, si
and bx, 1
shl bx, cl
or di, bx
mov bx, si
and bx, 1
shr ax, 1
imul bx, bx, 0x4951
xor bx, ax
mov ax, bx
shr si, 1
inc cx
cmp cx, 0x10
jb 0x4abee3
mov word [edx], di
add edx, 2
dec dword [ebp - 4]
jne 0x4abedb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4abf34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x14
push esi
push edi
mov di, 0x11
xor cx, cx
mov eax, dword [ebp - 4]
mov ax, word [eax]
xor esi, esi
mov dx, di
xor dx, ax
and dx, 1
mov bx, dx
shl bx, cl
or si, bx
imul dx, dx, 0x4951
shr di, 1
xor di, dx
shr ax, 1
inc cx
cmp cx, 0x10
jb 0x4abf5a
mov eax, dword [ebp - 4]
add dword [ebp - 4], 2
mov word [eax], si
dec dword [ebp - 8]
jne 0x4abf4f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x51ff18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ax, word [esp + 0xc]
mov ebp, esp
xor word [ebp + 8], ax
push ebx
push esi
mov esi, 0xb
mov bl, byte [ebp + 9]
mov al, byte [ebp + 8]
mov byte [ebp + 9], al
mov eax, dword [ebp + 9]
push eax
call fcn.0051ff58
xor al, bl
dec esi
mov byte [ebp + 8], al
jne 0x51ff2b
mov ax, word [ebp + 8]
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5211f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0xb
mov bl, byte [ebp + 8]
mov al, byte [ebp + 9]
mov byte [ebp + 8], al
mov eax, dword [ebp + 8]
push eax
call fcn.0051ff58
xor al, bl
dec esi
mov byte [ebp + 9], al
jne 0x521202
mov ax, word [ebp + 0xc]
pop esi
xor word [ebp + 8], ax
pop ebx
mov ax, word [ebp + 8]
pop ebp
ret 8
Function at 0x575fc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov word [ebp - 2], 0
cmp word [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x57614a
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x1c]
mov word [ebp - 2], 0
mov ax, word [esi + 4]
mov word [ebp - 0xc], ax
mov cx, word [esi + 6]
cmp byte [ebp + 0x10], 0
mov word [ebp - 0xa], cx
mov dx, word [esi]
mov word [ebp - 8], dx
mov ax, word [esi + 2]
mov word [ebp - 6], ax
je 0x576057
jmp 0x57601a
push edi
mov eax, dword [ebp + 0x18]
and eax, 0xffff
lea ecx, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x14]
and eax, 0xffff
push eax
push ecx
call fcn.0057617b
add esp, 0x10
test ax, ax
je 0x576115
cmp ax, 0xfc19
jne 0x57615f
mov byte [ebp + 0x10], 0
mov bl, 5
push edi
lea eax, [ebp - 2]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0xa]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.005612f9
xor ax, word [ebp - 0xc]
add esp, 0x14
xor ax, word [ebp - 0xa]
mov cl, al
shr ax, 8
add al, cl
lea edx, [eax + eax]
shr al, 7
or dl, al
inc dl
lea eax, [edx + edx]
shr dl, 7
or al, dl
add cl, al
lea edx, [ecx + ecx]
shr cl, 7
or dl, cl
lea ecx, [edx + edx]
shr dl, 7
or cl, dl
movzx dx, al
shl dx, 8
movzx ax, cl
add dx, ax
mov cx, word [ebp - 0xa]
add cx, dx
mov ax, cx
and cx, 0xff00
inc al
movzx ax, al
add ax, cx
mov cx, ax
shr cx, 0xf
add ax, ax
or cx, ax
mov ax, cx
shr ax, 0xf
add cx, cx
or ax, cx
xor dx, word [ebp - 8]
mov cx, word [ebp - 0xc]
xor ax, word [ebp - 6]
mov word [ebp - 8], cx
mov cx, word [ebp - 0xa]
mov word [ebp - 6], cx
xor word [ebp - 0xc], dx
xor word [ebp - 0xa], ax
dec bl
jne 0x576059
mov ax, word [ebp - 0xc]
mov word [esi], ax
mov cx, word [ebp - 0xa]
add esi, 8
mov word [esi - 6], cx
mov dx, word [ebp - 8]
mov word [esi - 4], dx
mov ax, word [ebp - 6]
mov word [esi - 2], ax
dec word [ebp + 0xc]
cmp word [ebp + 0xc], 0
jne 0x575fea
cmp word [ebp - 2], 2
jae 0x576168
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ax, 0x26
pop edi
cmp ax, word [ebp - 2]
pop esi
sbb al, al
pop ebx
inc al
mov esp, ebp
pop ebp
ret

Function at 0x57e4fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 4
mov ecx, dword [ebp + 8]
mov dx, word [ebp - 0x10]
mov word [ecx + 0x18], dx
ja 0x58e397
jbe 0x57e512
mov ebp, 0x7f860f5b
inc byte [eax]
add byte [eax + edx*8], dh
jbe 0x58e397
xor al, 0xd0
jmp fcn.0059460a
Function at 0x57ec9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
pop es
add byte [eax], al
and eax, 0x24448ffd
inc esp
and al, 0xfc
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx]
loop 0x581174
invalid
inc dword [eax]
add dh, al
add byte [eax], al
invalid
dec eax
shr bl, 0x40
loop 0x588ffb
add byte [eax], al
add byte [edi], cl
sbb byte [ebx + 0x10000c8], 0xd0
add byte [eax], al
add eax, edx
sar eax, 3
mov ecx, dword [ebp + 0xc]
mov word [ecx + 0x16], ax
mov edx, dword [ebp + 0xc]
mov word [edx + 0x3e], 0
shl dl, 0x20
jmp 0x580af6
mov eax, dword [ebp + 8]
xor ecx, ecx
jb 0x58f417
mov cl, byte [eax + 0xba]
and ah, ah
test ecx, ecx
jb 0x58f421
jne 0x58118c
mov edx, edx
je 0x58bbd7
and ch, 0x6b
insb byte es:[edi], dx
shl bx, 0x20
mov edx, dword [ebp - 0x18]
test ebx, ebp
jno 0x58bbe5
test dword [edx - 0x777ef0b0], eax
push ebp
invalid
jno 0x581173
add eax, 0xff368b72
mov edx, 0x2c8d0f4f
inc ebx
invalid
jns 0x58f476
ja 0x58bfd7
jbe 0x58f423
cmpsd dword [esi], dword es:[edi]
jge 0x58f433
jbe 0x58bfd7
xchg byte [esi - 0x25000035], ch
les ecx, [edi]
mov edi, 0x8d000544
jbe 0x58f43f
fcmovb st(0), st(4)
movsx eax, word [ebp + eax]
lea esi, [esi + 0xc]
mov eax, eax
mov dword [ebp + ebx], eax
jne 0x582577
je 0x58f444
lodsb al, byte [esi]
int3
je 0x582577
fisub dword [ecx - 0x72fbb975]
or dword [ebx + 0x5c8b085e], ecx
sbb eax, 0xc768d00
or word [ebx], ax
jb 0x583c7c
jmp dword [esi]
jmp 0xccf81bb
lea esp, [esp + 4]
js 0x588ff2
jns 0x591c38
adc eax, 0xb4890fa3
jae 0x591c3c
jns 0x588ff2
invalid
inc dword [0x99aae1]
add eax, 0x99aae1
add byte [ebx + eax*2], al
add bl, ah
push 0xee190001
dec ecx
inc esp
inc ebx
add byte [eax], al
pop ss
mov bl, 0
add cl, bl
loopne 0x591cc3
adc dword [edx], 0x35c30001
push ebp
mov bl, bl
mov ax, word [ebp - 0x14]
mov word [edx + 0x4c], ax
mov ecx, dword [ebp + 8]
xor edx, edx
jb 0x585923
mov dl, byte [ecx + 0xba]
cmp edx, 1
jne 0x58bbae
je 0x591c8d
fmul dword es:[edi]
add dword [edx], 0x70fffed0
add ebx, dword [eax - 6]
jno 0x57ec95
jo 0x591c98
pop eax
cli
inc edi
jo 0x57ec95
fiadd dword [edi - 0x75]
pop esi
or cl, al
jecxz 0x591cc6
js 0x58f42b
shr edi, 0x40
jns 0x591cb3
sub byte [edi + ecx - 0x288d77], dh
inc edi
mov cs, word [ecx]
add al, 0x13
jns 0x58f42b
invalid
add byte [esi - 0x79], ah
xchg si, dx