joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450e60
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x450e93
push esi
call fcn.0045f230
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x450e8c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x450f19
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x450f02
mov eax, dword [esi + 8]
test eax, eax
je 0x450eb7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x450efe
cmp eax, 2
je 0x450f02
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x450eaa
cmp eax, 3
je 0x450edd
cmp eax, 1
jne 0x450eaa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x450eaa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x450eaa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00450f40
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x450f28
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00450f40
add esp, 4
pop esi
ret

Function at 0x4517c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4517e1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4517e1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4517e1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46c0f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x46c156
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x46c156
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x46c137
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x46c4e0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x46c518
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x46d140
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x46d189
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x46d600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48f880
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0046d1b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0046d230
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0046d230
lea ecx, [esi + 0xc]
call fcn.00480a53
lea ecx, [esi + 0x10]
call fcn.00480a53
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0046e7c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0046e7c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0046e7c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00480ac8
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00480ac8
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x482e6f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x482ea7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00480f23
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00480efb
jmp 0x482eb3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x484561
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4845a3
call fcn.0048a2d2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4845a3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48459a
xor eax, eax
jmp 0x4845ab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004845b1
pop edi
pop esi
pop ebx
ret 4

Function at 0x48a802
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48a830
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48a84e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048a768
jmp 0x48a84e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48a84e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048a768
test edi, edi
mov eax, edi
jne 0x48a838
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40c620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x401527
rcl byte [ebx + 0x55], 0x56
inc esp
and al, 0x69
push 1
push 0
push edi
call fcn.0040d030
add esp, 0x18
mov esi, eax
call fcn.004092c0
mov dword [esi + 8], 1
mov dword [esi], ebp
test ebp, ebp
jle 0x402184
xor ebx, ebx
inc ebx
push ebx
push 1
push 0
push edi
call fcn.0040d030
add esp, 0x10
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0040e640
mov ecx, edi
lea eax, [esp + 0x3c]
call fcn.00401a70
cmp ebx, ebp
jl 0x42c23a
iretd
lea ecx, [esp + 0x18]
call fcn.00402620
lea esi, [esp + 0x28]
call fcn.004092c0
lea edi, [esp + 0x50]
call fcn.00401a30
mov dword [esp + 0x3c], 0
mov dword [esp + 0x50], str.Error_allocating_memory.
call fcn.00401a30
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004112ef
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00402620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x128]
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, ecx
mov ecx, dword [edi + 4]
xor ebx, ebx
fisttp dword [ecx - 0x38efdba4]
inc esp
and al, 0x18
add dword [eax], eax
add byte [eax], al
mov dword [esp + 0x1c], ebx
mov edx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
movsx ecx, word [edx + 0xa]
mov edx, dword [eax]
cmp word [edx + 8], 0x4e
mov dword [esp + 0x24], ecx
jne 0x40c6d7
inc dword [esi]
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov edx, dword [ecx + eax*4]
movsx eax, word [edx + 0xa]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x134]
push esi
push edi
mov dword [esp + 0x30], eax
call fcn.0040ab50
test eax, eax
jne 0x42c290
lea ecx, [esp + 0x10]
call fcn.0040c760
test eax, eax
jl 0x42c267
mov eax, dword [esi]
mov edx, dword [edi + 4]
mov ecx, dword [edx + eax*4]
cmp word [ecx + 8], 0x4f
jne 0x42c278
inc eax
lea ecx, [esp + 0x10]
mov dword [esi], eax
call fcn.0040c760
mov edx, dword [esi]
mov dword [esp + ebx*4 + 0x28], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + edx*4]
inc ebx
cmp word [ecx + 8], 0x4e
je 0x40c664
mov esi, dword [ebp]
cmp dword [esi + 8], 5
jne 0x42c24a
mov eax, dword [esi]
xor edi, edi
cmp ebx, edi
mov dword [eax + 0x210], edi
jle 0x40c703
mov esi, dword [esp + edi*4 + 0x28]
mov edx, dword [ebp]
call fcn.0040d0f0
inc edi
cmp edi, ebx
jl 0x40c6f2
mov ecx, dword [esp + 0x134]
mov edx, dword [ebp]
push 0
push ecx
push edx
call fcn.0040d030
add esp, 0xc
mov dword [ebp], eax
test eax, eax
je 0x42c256
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0xc
call 0x844116ac
dec ebp
in al, 8
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
dec ebp
call fcn.00401a8b
jmp 0x402134
jl 0x42c27c
jmp 0x402172
call fcn.0040e90b
jmp 0x40c6ff
sub al, 0xff
jo 0x42c28c
push eax
push 0x7a
push ecx
jmp 0x42c2a6
adc byte [edx + 0x6a], dl
jnp 0x42c2e1
push eax
jmp 0x42c2a6
jmp 0x4014f2
Function at 0x40e7e0
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, 5
cmp dword [edi + 8], ebx
je 0x42b34a
call fcn.0040e8f0
test esi, esi
je 0x40e833
cmp dword [edi + 8], ebx
jne 0x42b354
mov eax, dword [edi]
mov dword [eax + 0x210], 0
test esi, esi
jle 0x40e833
push ebp
lea ebx, [esp + 0x14]
mov ebp, esi
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, edi
call fcn.0040d0f0
sub ebp, 1
jne 0x40e820
pop ebp
mov eax, dword [edi]
mov ecx, dword [eax + 0x210]
mov dword [eax + 0x20c], ecx
mov edx, dword [edi]
mov dword [edx + 8], 1
mov eax, dword [edi]
cmp dword [eax + 0x20c], 0
jle 0x40e891
xor edx, edx
mov ecx, 0xc
lea esp, [esp]
mov esi, dword [ecx + eax + 0x100]
mov dword [ecx + eax], esi
mov eax, dword [edi]
mov esi, dword [ecx + eax]
imul esi, dword [eax + 8]
mov dword [eax + 8], esi
mov eax, dword [edi]
cmp dword [eax + 8], 0x1000000
jg 0x42b360
inc edx
add ecx, 4
cmp edx, dword [eax + 0x20c]
jl 0x40e860
mov eax, dword [edi]
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [edi]
push 4
mov dword [ecx], eax
call fcn.0041171a
add esp, 8
test eax, eax
je 0x40e8ea
mov dword [eax], 1
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [edi]
cmp dword [eax + 8], 0
jle 0x40e8e4
xor ecx, ecx
mov eax, dword [eax]
mov dword [eax + ecx*4], 0
mov eax, dword [edi]
inc ecx
cmp ecx, dword [eax + 8]
jl 0x40e8d3
pop edi
pop esi
mov al, 1
pop ebx
ret
xor eax, eax
jmp 0x40e8c4
adc byte [edx + esi*8 - 0x75], bh
pop es
inc edi
mov eax, dword [0xe44d40fe]
add al, 0x89
inc edi
add al, 0x33
shr cl, 0x46
inc ebx
invalid
Function at 0x40e7fb
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, 5
cmp dword [edi + 8], ebx
je 0x42b34a
call fcn.0040e8f0
test esi, esi
je 0x40e833
cmp dword [edi + 8], ebx
jne 0x42b354
mov eax, dword [edi]
mov dword [eax + 0x210], 0
test esi, esi
jle 0x40e833
push ebp
lea ebx, [esp + 0x14]
mov ebp, esi
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, edi
call fcn.0040d0f0
sub ebp, 1
jne 0x40e820
pop ebp
mov eax, dword [edi]
mov ecx, dword [eax + 0x210]
mov dword [eax + 0x20c], ecx
mov edx, dword [edi]
mov dword [edx + 8], 1
mov eax, dword [edi]
cmp dword [eax + 0x20c], 0
jle 0x40e891
xor edx, edx
mov ecx, 0xc
lea esp, [esp]
mov esi, dword [ecx + eax + 0x100]
mov dword [ecx + eax], esi
mov eax, dword [edi]
mov esi, dword [ecx + eax]
imul esi, dword [eax + 8]
mov dword [eax + 8], esi
mov eax, dword [edi]
cmp dword [eax + 8], 0x1000000
jg 0x42b360
inc edx
add ecx, 4
cmp edx, dword [eax + 0x20c]
jl 0x40e860
mov eax, dword [edi]
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [edi]
push 4
mov dword [ecx], eax
call fcn.0041171a
add esp, 8
test eax, eax
je 0x40e8ea
mov dword [eax], 1
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [edi]
cmp dword [eax + 8], 0
jle 0x40e8e4
xor ecx, ecx
mov eax, dword [eax]
mov dword [eax + ecx*4], 0
mov eax, dword [edi]
inc ecx
cmp ecx, dword [eax + 8]
jl 0x40e8d3
pop edi
pop esi
mov al, 1
pop ebx
ret
xor eax, eax
jmp 0x40e8c4
adc byte [edx + esi*8 - 0x75], bh
pop es
inc edi
mov eax, dword [0xe44d40fe]
add al, 0x89
inc edi
add al, 0x33
shr cl, 0x46
inc ebx
invalid
Function at 0x40f450
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425210
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x40f460
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00413990
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410f70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x40f4b0
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.004151b0
add esp, 0x10
cmp eax, 0x18
jl 0x40f531
mov ebp, eax
lea edi, [ebp - 0x14]
test edi, edi
jle 0x40f4fd
xor edx, edx
mov edi, edi
xor ecx, ecx
lea esi, [esp + edx + 0x30]
mov al, byte [esp + ecx + 0x1c]
cmp al, byte [esi + ecx]
je 0x40f521
cmp ecx, 0x14
je 0x42937a
inc edx
cmp edx, edi
jl 0x40f4e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10034]
lea edx, [ecx + ebp - 0x14]
sub esp, ebp
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [esp + 0x24], edx
call fcn.0041557c
add esp, 0xc
jmp 0x40f4b0
mov bl, byte [esp + ecx + 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x31]
je 0x40f543
inc ecx
jmp 0x40f4ef
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10020
ret 4
mov bl, byte [esp + ecx + 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x32]
je 0x40f555
add ecx, 2
jmp 0x40f4ef
mov bl, byte [esp + ecx + 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x33]
jne 0x429372
mov bl, byte [esp + ecx + 0x20]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x34]
je 0x429361
add ecx, 4
jmp 0x40f4ef
pushfd
add al, 0
add byte [ebx + 0x14d0e8ce], cl
invalid
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*4]
push ecx
call 0x8441130a
dec ebp
in al, 4
inc edi
cmp edi, dword [esi + 8]
jle 0x42937c
jb 0x429361
pop edi
jmp 0x410835
invalid
add ecx, 5
cmp ecx, 0x14
jl 0x40f501
jmp 0x40f50a

Function at 0x40f5e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
test byte [eax + ebp*4], ah
add byte [eax], al
add byte [esi + 0x50], dl
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push str.0x_p
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
jg 0x42b33a
and al, 0x18
call fcn.0040263b
or al, 0xff
Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
Function at 0x435d1d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esp, dword [esp + edx]
add al, 0x53
push ebp
push esi
mov esi, dword [esi + ebx*2 + 0x14]
push edi
push eax
call fcn.004112f0
xor ecx, ecx
mov edi, eax
dec ebp
in al, 4
dec edi
xor ebp, ebp
cmp dword [esp + 0x1c], ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
lea ebx, [ecx + 1]
mov dword [esp + 0x18], ecx
jle 0x435dc3
mov edi, edi
cmp edi, ecx
jl 0x435dc3
mov edx, dword [esp + 0x14]
movzx eax, word [edx + edi*2]
cmp ax, 0x30
jb 0x435d6d
add bh, bh
clc
cmp dword [edi + 8], esi
movzx eax, ax
sub eax, 0x30
jmp 0x435d93
add bh, bh
clc
inc ecx
jb 0x435d81
add bh, bh
clc
inc esi
ja 0x435d81
movzx eax, ax
sub eax, 0x37
jmp 0x435d93
add bh, bh
clc
popal
jb 0x435dc8
add bh, bh
clc
ja 0x435dc8
movzx eax, ax
sub eax, 0x57
push ebp
cdq
push ebx
push edx
push eax
call fcn.0042340b
add dword [esi], eax
and al, 0
push 0x10
adc dword [esi + 4], edx
push ebp
push ebx
dec edi
call fcn.0042340b
mov ebx, eax
mov eax, esi
pop esi
sbb byte [eax + 0x33], al
leave
cmp eax, dword [esp + 0x1c]
mov ebp, edx
xor al, 0x44
and al, 0x18
jl 0x435d4d
dec ebp
invalid
pop edi
mov dword [esi + 4], ecx
mov dword [esi], ecx
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x44aff7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp - 0xefff1c]
push esi
push edi
mov edi, dword [esp - 0x3f7aff10]
lea eax, [esp + 0x10]
push eax
call fcn.004431fb
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00443155
xor esi, esi
test edi, edi
jbe 0x44b049
lea esp, [esp + 0x448b3374]
lea eax, [esp + 0x10]
push eax
call fcn.004431cd
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b037
pop edi
pop esi
pop ebx
add esp, 0xff1000dc
ret 0xff0c
Function at 0x465fde
Capabilities:
Encode data using xor

Disassembly:
mov esp, dword [esp + edx]
or byte [esi - 0x75], dl
je 0x466044
or byte [eax - 0x74cc2f42], al
inc esp
add byte [esp + ebp - 0x7c], dh
sal byte [ebx], 1
mov eax, dword [eax + eax + 0x74]
sub al, 0x84
xor dword [eax + ebp - 0x73], 0xffffff86
aam 0x33
mov eax, dword [eax + edx*2 - 0x18]
jl 0x465fe9
cld
call dword [esi + 0x6a]
add byte [eax - 0x4a], ch
pop edi
inc esi
add al, ch
adc bh, dh
cli
push dword [ebx]
rol byte [ebx + 0x46390cc4], 0x18
sete al
pop esi
ret 8
and al, 0x20
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.0045309c
push eax
push edi
call 0xfe4646bd
test byte [ebx + 0x748b6e75], al
and al, 0x1c
call fcn.004092db
mov dword [esi + 8], 1
mov dword [esi], 0
mov eax, dword [edi]
mov eax, dword [eax + 4]
push 0
push 2
add eax, edi
call fcn.004040fb
pop edi
or al, 0xff
jo 0x466098
call [esi - 0x7d]
les ecx, [edx + eax*8]
or byte [eax], al
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push edx
push ecx
call fcn.0045307e
push eax
mov ecx, esi
call fcn.0040c77b
push eax
call fcn.004506b0
mov esi, dword [esp + 0x1c]
mov edi, eax
call fcn.004092db
mov dword [esi], edi
pop edi
mov dword [esi + 8], 1
xor eax, eax
pop esi
add esp, 0xc
ret 8

Function at 0x4781c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
push esi
mov esi, dword [esi + ebx*2 + 0x48]
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edi, ecx
cmp byte [0x4a7cc1], bl
je 0x478361
mov eax, dword [0x4a7cc4]
cmp eax, ebx
je 0x478361
mov edx, 3
xor al, 0x50
cmp byte [ecx - 0x7699bfb8], cl
nop
cwde
add byte [eax], al
add bh, bh
adc eax, 0x482304
mov edx, dword [0x4a7cc4]
mov dword [edx + 0xa0], eax
mov eax, 3
xor al, 0x82
test al, 0
test byte [eax], 0x8b
invalid
lea esi, [esp + 0x10]
call fcn.004092db
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x14
mov eax, dword [ebp]
mov eax, dword [eax + 4]
push ebx
push ecx
add eax, ebp
call fcn.004040fb
cmp byte [esp + 0x54], bl
je 0x47834c
lea esi, [esp + 0x10]
call fcn.004092db
pop edi
pop esi
pop ebp
or al, 0xff
jo 0x478396
call [ebx - 0x7d]
les esi, [eax]
ret 0x14
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esi + ebx*2 + 0x20]
push edi
lea edi, [esi + 0xc]
mov dword [esp + 0x30], 0xfffffd0f
mov dword [esi], ebx
mov dword [edi], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
mov dword [esi + 8], ebx
cmp edx, ebx
je 0x478664
cmp ebp, ebx
je 0x478664
mov esp, dword [esp + edx]
xor al, 0x3b
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x1f2b1845
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x3e22570b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4082e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x44d1fc], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408329
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408306
mov dword [edx*4 + 0x44d1f8], eax
inc edx
cmp edx, 0x100
jne 0x4082ff
mov eax, dword [ebp + 8]
not eax
jmp 0x408343
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x44d1f8]
test ebx, ebx
jne 0x408330
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x623957ba
Capabilities:
Encode data using xor

Disassembly:
ret
mov ah, 0x7d
aas
inc esi
jnp 0x62395753
shl dword [esp + edi - 0x77], 0xc8
invalid
Function at 0x402f6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x453020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403004
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402fe4
xor eax, eax
push ebp
push 0x402fdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403020
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402fe4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x453020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x453020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cb8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45504c], 0
je 0x403d19
cmp word [0x455220], 0xd7b2
jne 0x403ce1
cmp dword [0x455228], 0
jbe 0x403ce1
mov eax, 0x45521c
call dword [0x455238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45306c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d40
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x453030], 0
jne 0x403d35
push 0
push 0x453064
push 0x45306c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret