joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1039140e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
je 0x101f2664
setb dl
setle dh
lea edx, [ebx + 4]
not di
bswap di
not edi
call fcn.101f25d5
pushfd
bts dx, 2
add dh, al
cmp bx, 0x3088
mov edx, dword [esi + 0x78]
test ah, cl
push ebp
call fcn.101f2206
lea esp, [esp + 0x14]
je 0x101f26b3
neg dl
btr si, 8
mov esi, dword [eax + 0x3c]
shl dh, 3
clc
add esi, eax
jo 0x1038c40e
movzx dx, cl
rcl dh, cl
mov edx, dword [esi + 0x78]
stc
cmc
stc
test edx, edx
jmp 0x103b5ef2
clc
pushfd
cmp ecx, dword [ebp - 8]
pushal
pushfd
call fcn.103aa552
cmc
cmp bl, ah
cmp cl, cl
or eax, eax
pushal
pushal
mov word [esp + 4], 0xee35
lea esp, [esp + 0x40]
jne 0x101f2664
bswap cx
cmp dh, 0x20
bswap cx
mov ecx, dword [ebx]
cmp si, 0x107
bt ecx, esi
clc
cmc
or ecx, ecx
pushal
mov byte [esp + 4], 0x65
pushfd
jmp 0x101f22ce
pushal
add ebx, eax
rcl cx, 9
not cx
mov dword [ebp - 8], 0
bsr cx, bp
rcr ecx, cl
sar ecx, cl
mov ecx, dword [edx + 0x18]
cmp bh, 0xfe
jmp 0x10392e5d
pushal
lea esp, [esp + 0x20]
je 0x101f26b3
and ecx, 0xf1cf4f
clc
neg cl
not ch
add edx, eax
ror ch, cl
setne ch
mov cx, 0x1548
lea ecx, [esi + 0x74cd2225]
mov ecx, dword [esi + 0x7c]
push esi
mov byte [esp], 0xd1
add ecx, edx
clc
stc
mov dword [ebp - 0x10], ecx
dec cl
mov ecx, dword [ebp + 0xc]
bt si, 3
bt bx, 0xc
stc
cmp ecx, 0xffff
push dword [esp]
lea esp, [esp + 8]
jbe 0x103b3fcf
xchg bx, di
adc di, 0xf00a
and di, cx
mov edi, dword [edx + 0x24]
lea ebx, [eax*8 - 0x3683b5d9]
add edi, eax
lea ecx, [ebx + 0x2c28a5a5]
and cx, 0xa3d6
neg bl
mov ebx, dword [edx + 0x20]
bsr ecx, edi
jo 0x103ad232
adc ch, 0xf7
sar cl, cl
add ebx, eax
rcr ch, cl
adc cx, 0x4a5f
bt si, bx
mov dword [ebp - 8], 0
lea ecx, [eax*8 + 0x79302790]
pushfd
mov cx, 0xf974
shrd cx, ax, cl
mov ecx, dword [edx + 0x18]
jmp 0x101f2474
Function at 0x103b4097
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x36
cmp dword [eax], edx
call 0x10390583
and byte [esi - 0x2c], 0x9a
mov dword [0xc3c77f41], eax
xchg ecx, eax
dec byte [edi]
cmp eax, 0x63eab64b
pop eax
mov fs, edi
out dx, ax
sub eax, 0x16a05e08
js 0x103b40dd
pop ebp
nop
add dword [edx + 0x75e7818], eax
push cs
outsb dx, byte [esi]
push esp
cli
xor byte [edi], al
insb byte es:[edi], dx
sal edx, 1
mov dl, byte [edx + 0x634ccc70]
or al, 0xed
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
xor al, 0x22
add al, 0x70
out 0xb, al
pop edx
push cs
std
pop ds
insd dword es:[edi], dx
mov eax, dword [0x5de1dcc]
sbb edi, dword [ebx - 0x44ea8a21]
or byte ss:[ecx], dl
in eax, dx
fbstp tbyte [ebp + 0x15]
mov ebx, 0xed110836
cli
xor dword [edi + 0x48ad2585], ebp
jle 0x103b40e8
loop 0x103b4134
outsb dx, byte [esi]
je 0x103b4080
fadd st(4), st(0)
adc cl, bl
pop ebx
retf
jp 0x103b41a4
cmpsd dword [esi], dword es:[edi]
lahf
xchg ebp, eax
mov dh, 0x4a
and edx, esp
mov ch, 0x2b
fadd st(4), st(0)
sbb ch, bl
inc edx
arpl word [ecx], bx
push es
fcmovbe st(0), st(7)
inc ecx
loopne 0x103b41b3
and al, 0x66
cmp eax, 0xbdb00543
pop ecx
xor al, ah
and eax, 0x30b8aac1
les esp, [0x30b8aac1]
add dword [ecx + 0x60], 0x2a715c0b
cwde
fmulp st(7)
lodsb al, byte [esi]
and dl, byte [eax - 2]
and al, 0x51
jl 0x103b417f
fimul dword [eax - 0x3890f443]
add eax, 0x79877930
pushfd
sar byte [ecx + ebx*8 - 0x55fa94af], cl
shr ebx, cl
pop edi
add eax, 0x5febd3aa
dec ebp
cmp dword [edi], 0x72073d66
or eax, 0x8d243a0
push eax
sub eax, 0xce389942
mov edx, dword [edi - 0x77ff333b]
dec byte [edx + 0x20]
je 0x103b4156
cld
jge 0x103b4148
and eax, 0xebbf3e37
sub eax, 0xc4be5f9
inc eax
loopne 0x103b421c
int3
cwde
mov bl, 0xe9
push esi
invalid
loop 0x103b427e
dec edi
int 0xb7
in al, 0xf3
lodsd eax, dword [esi]
aam 0xe5
xor dword [edi + 0x38], esi
xchg byte [eax], bl
sub byte [esi], dh
sbb al, 0x59
push cs
adc dl, byte [0xb03a04b6]
xor dword [ebp - 0x7d], ebx
push 0x656ece67
jbe 0x103b429b
mov cl, 0x47
inc edx
imul esi, dword [ebx], 0xffffffa2
clts
scasb al, byte es:[edi]
rcl ebx, cl
ret 0xbdd3
call 0xe0fefb3
cmp byte [ecx], al
invalid
pushfd
cwde
enter 0xfffffffffffffc83, 0x11
mov al, 0x92
cmp byte [edx + 0x6cdce686], dh
dec byte [edx]
iretd

Function at 0x103b6dce
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x28]
je 0x101f2664
call fcn.101ef822

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2fb7166
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3dab6761
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x47d51a31
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x38333b7f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x433003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4073c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
mov eax, dword [0x6d48e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x728], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x724], ebx
push esi
mov esi, ecx
test eax, eax
jne 0x407401
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00598fe4
mov esp, ebp
pop ebp
ret 0x10
test ebx, ebx
je 0x4073ed
push eax
push 1
lea eax, [ebp - 0x71d]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
push 0x200
lea eax, [ebp - 0x604]
push 0
push eax
call sub.MSVCR120.dll_memset
lea edx, [esi + 0x10]
add esp, 0x1c
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407435
push edi
sub ecx, esi
lea eax, [ebp - 0x604]
push ecx
push edx
push eax
call sub.MSVCR120.dll_memcpy
push 0x100
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x71c]
push eax
call fcn.004083e0
xor esi, esi
add esp, 0x18
mov dword [ebp - 0x72c], esi
cmp dword [ebp + 0x10], esi
jle 0x4075ab
mov edi, ebx
jmp 0x407480
push dword [ebp - 0x728]
lea eax, [ebp - 0x404]
push 0x10
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
cmp eax, 0x10
jne 0x4075f0
lea eax, [ebp - 0x404]
push eax
push eax
lea eax, [ebp - 0x71c]
push 0
push eax
call fcn.004076f0
lea ecx, [esi + 0xf]
add esp, 0x10
lea edx, [ebp - 0x3f5]
xor eax, eax
add ecx, ebx
cmp edi, edx
ja 0x4074d7
lea edx, [ebp - 0x404]
cmp ecx, edx
jae 0x40752e
movdqu xmm0, xmmword [ebp - 0x404]
mov eax, 0x10
xorps xmm1, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm2, xmmword [edi]
paddb xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
paddb xmm2, xmm0
movd ecx, xmm2
add byte [ebp + 0x14], cl
xor bl, bl
xor dl, dl
cmp eax, 0x10
jge 0x407590
mov ecx, 0x10
sub ecx, eax
cmp ecx, 2
jl 0x407564
mov cl, byte [ebp + eax - 0x404]
mov byte [edi + eax], cl
add bl, cl
mov cl, byte [ebp + eax - 0x403]
mov byte [edi + eax + 1], cl
add dl, cl
add eax, 2
cmp eax, 0xf
jl 0x407543
cmp eax, 0x10
jge 0x407586
mov cl, byte [ebp + eax - 0x404]
add eax, dword [ebp - 0x724]
mov esi, dword [ebp - 0x72c]
mov byte [eax + esi], cl
mov eax, dword [ebp + 0x14]
add al, cl
jmp 0x407589
mov eax, dword [ebp + 0x14]
add dl, bl
add al, dl
mov dword [ebp + 0x14], eax
mov ebx, dword [ebp - 0x724]
add esi, 0x10
add edi, 0x10
mov dword [ebp - 0x72c], esi
cmp esi, dword [ebp + 0x10]
jl 0x407480
push dword [ebp - 0x728]
lea eax, [ebp - 0x71e]
push 1
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
mov al, byte [ebp - 0x71d]
add esp, 0x10
cmp al, byte [ebp - 0x71e]
jne 0x4075f0
cmp al, byte [ebp + 0x14]
jne 0x4075f0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00598fe4
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00598fe4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x408180
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x6d48e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
lea ecx, [ecx]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x4081a0
mov esi, 1
mov edx, 0x6dc1c0
lea esp, [esp]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0x6dc1e8
jl 0x4081e0
mov eax, 1
mov byte [0x6d9fc0], 0x63
mov byte [0x6db123], 0
mov dword [ebp - 0x808], eax
mov edi, edi
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 0x808]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x6d9fc0], bl
mov byte [ebx + 0x6db0c0], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x408220
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
lea esp, [esp]
movzx edx, byte [esi + 0x6d9fc0]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x6db0c0]
mov dword [esi*4 + 0x6da0c0], eax
rol eax, 8
mov dword [esi*4 + 0x6da4c0], eax
rol eax, 8
mov dword [esi*4 + 0x6da8c0], eax
rol eax, 8
mov dword [esi*4 + 0x6dacc0], eax
test ecx, ecx
je 0x408373
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x40837f
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x6db1c0], eax
rol eax, 8
mov dword [esi*4 + 0x6db5c0], eax
rol eax, 8
mov dword [esi*4 + 0x6db9c0], eax
rol eax, 8
mov dword [esi*4 + 0x6dbdc0], eax
inc esi
cmp esi, 0x100
jl 0x4082b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00598fe4
mov esp, ebp
pop ebp
ret
Function at 0x4083e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6d48e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub eax, 0x80
je 0x408424
sub eax, 0x40
je 0x40841c
sub eax, 0x40
jne 0x4085d0
mov dword [edi], 0xe
jmp 0x40842a
mov dword [edi], 0xc
jmp 0x40842a
mov dword [edi], 0xa
push esi
push ecx
push edx
lea eax, [ebp - 0x11c]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.004085f0
mov eax, dword [ebp - 0x11c]
add esp, 0xc
shl eax, 4
add eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
sub eax, 0x10
mov dword [esi + 0xc], ecx
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x4085b9
jmp 0x408480
movzx ecx, byte [eax + 3]
dec edi
movzx edx, byte [ecx + 0x6d9fc0]
movzx ecx, byte [eax + 2]
mov edx, dword [edx*4 + 0x6dbdc0]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db9c0]
movzx ecx, byte [eax + 1]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db5c0]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db1c0]
mov dword [esi], edx
movzx ecx, byte [eax + 4]
movzx edx, byte [ecx + 0x6d9fc0]
movzx ecx, byte [eax + 7]
mov edx, dword [edx*4 + 0x6db1c0]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6dbdc0]
movzx ecx, byte [eax + 6]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db9c0]
movzx ecx, byte [eax + 5]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db5c0]
mov dword [esi + 4], edx
movzx ecx, byte [eax + 8]
movzx edx, byte [ecx + 0x6d9fc0]
movzx ecx, byte [eax + 0xb]
mov edx, dword [edx*4 + 0x6db1c0]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6dbdc0]
movzx ecx, byte [eax + 0xa]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db9c0]
movzx ecx, byte [eax + 9]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db5c0]
mov dword [esi + 8], edx
movzx ecx, byte [eax + 0xc]
movzx edx, byte [ecx + 0x6d9fc0]
movzx ecx, byte [eax + 0xf]
mov edx, dword [edx*4 + 0x6db1c0]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6dbdc0]
movzx ecx, byte [eax + 0xe]
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db9c0]
movzx ecx, byte [eax + 0xd]
sub eax, 0x10
movzx ecx, byte [ecx + 0x6d9fc0]
xor edx, dword [ecx*4 + 0x6db5c0]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x408480
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00598fe4
mov esp, ebp
pop ebp
ret
Function at 0x409a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a1c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6d48e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x409b5d
cmp byte [edi + 0x45], 0
je 0x409b5d
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x409a84
xor al, al
jmp 0x409b5f
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x48]
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmp ebx, 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x409af1
dec eax
je 0x409af5
sub eax, 2
je 0x409b46
xor bl, bl
jmp 0x409b48
mov byte [edi + 0x45], 0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp ebx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, ecx
sub esi, eax
je 0x409b28
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x409aed
cmp byte [edi + 0x45], 0
je 0x409b46
test esi, esi
lea esi, [edi + 0x48]
jne 0x409ab7
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00409d20
jmp 0x409ab4
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x409b59
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
jmp 0x409b5f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00598fe4
mov esp, ebp
pop ebp
ret
Function at 0x40b560
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6e51d8]
push ebx
push esi
push edi
cmp eax, 1
jne 0x40b5e2
mov dword [ebp - 4], 0x5a8bc0
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b5c6
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b5bd
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b5a4
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6e5154]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40b65e
mov dword [ebp - 4], 0x5a8c40
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b642
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b639
sub edi, ecx
lea ebx, [ebx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b620
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6e5154]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0x5a8bc0
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b6b3
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b6aa
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b691
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6e5154]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40b880
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0040bd90
mov eax, dword [0x6e51d8]
cmp eax, 1
jne 0x40b90e
mov dword [ebp - 4], 0x5a8a88
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b8f2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b8e9
sub edi, ecx
lea esp, [esp]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b8d0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6e5154]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x40b984
mov dword [ebp - 4], 0x5a8b20
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b968
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b95f
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b946
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6e5154]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0x5a8a88
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x40b9d9
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x40b9d0
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x40b9b7
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x6e5154]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40bb30
Capabilities:
Check os version
Encode data using xor
Query or enumerate registry value

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x40bb45
mov dword [0x6dc204], 1
ret
jmp fcn.0040ba70

Function at 0x40bc20
Capabilities:
Create thread

Disassembly:
call fcn.0040bc80
test eax, eax
je 0x40bc68
cmp dword [0x6dc200], 0
jne 0x40bc47
push 0
push 0
push 0
push 0x40c300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x6dc1fc], 0
jne 0x40bc7d
push 0
push 0
push 0
push fcn.0040b6d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret
push 0
push 0
push 0
push 0x40bd20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret