joyce8/EMBER2024-capa huggingface dataset:
Function at 0x650e04
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x650ef1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, ebx
call fcn.00428a3c
test al, al
jne 0x650e86
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x650f0c
call fcn.0040c260
mov eax, dword [ebp - 4]
call fcn.006474e4
cmp byte [0x68a222], 0
jne 0x650e7d
push 0x10
push 0x650f48
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, 0x650f60
call fcn.0064753c
mov eax, dword [ebp - 8]
call fcn.0040bffc
push eax
mov eax, dword [0x682434]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x68a228], 1
jmp 0x650ed4
push 1
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x650f98
call fcn.0040c260
mov eax, dword [ebp - 0xc]
call fcn.0040bffc
push eax
push 0x650fd4
push 0x650ff0
mov eax, dword [0x682434]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_ShellExecuteW
cmp byte [0x68a221], 0
je 0x650ed4
mov edx, ebx
mov eax, 0x651008
call fcn.0064888c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x650ef8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b4c4
pop eax
jmp eax
Function at 0x656d94
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x656e60
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00643830
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040b89c
xor eax, eax
push ebp
push 0x656e36
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0042840c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x656df9
mov byte [ebp - 5], 0
jmp 0x656e2c
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetSystemTime
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x656e67
lea eax, [ebp - 0x24]
call fcn.0040b464
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax
Function at 0x6610cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x66116c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b464
mov eax, dword [ebp - 4]
test eax, eax
je 0x66110f
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x66113c
mov esi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, di
call fcn.0040c01c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040c208
inc esi
dec ebx
jne 0x66111a
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040b854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x661173
lea eax, [ebp - 0x10]
call fcn.0040b464
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4c4
pop eax
jmp eax
Function at 0x66cc4c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
mov edx, 0x66ccf8
call fcn.0040b854
xor edx, edx
push ebp
push 0x66cc86
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetUserDefaultLangID
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
pop dword fs:[0]
add esp, 8
jmp 0x66cc97
cmp bx, 0x409
jne 0x66cca4
cmp ax, 0x409
je 0x66cce4
cmp bx, 0x419
je 0x66ccd8
cmp ax, 0x419
je 0x66ccd8
cmp bx, 0x423
je 0x66ccd8
cmp ax, 0x423
je 0x66ccd8
cmp bx, 0x43f
je 0x66ccd8
cmp ax, 0x43f
je 0x66ccd8
cmp bx, 0x443
je 0x66ccd8
cmp ax, 0x443
jne 0x66cce4
mov eax, esi
mov edx, 0x66cd10
call fcn.0040b854
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000a850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov dword [esi], eax
add esp, 0x18
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop esi
pop ebp
ret

Function at 0x100122f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x10], ecx
mov dword [esi], eax
jmp 0x10012467
mov ecx, dword [esi]
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp + 0x1c]
je 0x10012472
mov ebx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edi, word [ebx]
xor ebx, ebx
inc ebx
cmp bx, di
jae 0x10012368
lea eax, [ecx + 0x2400]
mov ebx, 0x3ff
cmp ax, bx
ja 0x10012485
mov eax, edi
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
xor eax, eax
inc eax
cmp ebx, 0x80
jae 0x1001238b
mov cl, bl
xor eax, eax
jmp 0x100123ae
mov ebx, eax
lea eax, [ecx + 0x2800]
mov ecx, 0x3ff
cmp ax, cx
ja 0x10012357
add ebx, 0xffff2840
xor eax, eax
shl ebx, 0xa
inc eax
mov byte [ebp - 1], al
jmp 0x1001235a
mov ecx, ebx
cmp ebx, 0x800
jae 0x1001239d
shr ecx, 6
or cl, 0xc0
jmp 0x100123ae
cmp ebx, 0x10000
jae 0x100123b5
shr ecx, 0xc
push 2
or cl, 0xe0
pop eax
mov dword [ebp - 8], eax
mov edi, eax
jmp 0x100123cd
movzx edi, byte [ebp - 1]
xor eax, eax
inc eax
shr ecx, 0x12
xor edi, eax
mov dword [ebp - 8], 3
or cl, 0xf0
add edi, edi
mov eax, dword [ebp + 0x1c]
inc edi
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
cmp eax, edi
jl 0x10012472
mov edx, dword [ebp + 8]
movzx eax, word [edx]
mov edx, dword [ebp + 0x14]
test ax, ax
jne 0x10012414
mov eax, dword [ebp - 0x10]
test byte [eax + 0xc], 2
je 0x10012414
lea eax, [edi + 3]
cmp dword [ebp - 0x14], eax
jl 0x10012472
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xef
inc dword [esi]
mov eax, dword [esi]
mov byte [eax], 0xbb
inc dword [esi]
mov eax, dword [esi]
mov byte [eax], 0xbf
inc dword [esi]
add dword [edx], 2
cmp byte [ebp - 1], 0
jne 0x10012425
mov eax, dword [ebp - 8]
cmp eax, 3
jae 0x1001242f
mov eax, dword [esi]
mov byte [eax], cl
inc dword [esi]
dec edi
mov eax, dword [ebp - 8]
test edi, edi
jle 0x10012451
imul ecx, eax, 6
mov eax, dword [esi]
sub ecx, 6
mov edx, ebx
dec edi
shr edx, cl
and dl, 0x3f
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
test edi, edi
jg 0x10012436
mov edx, dword [ebp + 0x14]
cmp byte [ebp - 1], 0
je 0x1001245c
shr ebx, 0xa
jmp 0x10012461
xor eax, eax
lea ebx, [eax + 1]
mov eax, dword [ebp + 8]
mov word [eax], bx
mov eax, dword [edx]
cmp eax, dword [ebp + 0x10]
jne 0x10012311
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [edx]
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
push 2
pop eax
jmp 0x1001247c
Function at 0x10016960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10066008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov eax, 0x10005614
je 0x1001699a
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.1003e690
mov esp, ebp
pop ebp
ret

Function at 0x10016c60
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [0x10066008]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
push esi
push edi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x3c]
push eax
call fcn.10017008
mov edx, dword [esp + 0x4c]
test edx, edx
je 0x10016cd4
mov ecx, dword [esp + 0x50]
lea esi, [esp + 0x3c]
mov eax, dword [esp + 0x3c]
cmp ecx, 8
jb 0x10016cb9
mov esi, eax
cmp word [esi + edx*2 - 2], 0x2f
je 0x10016cec
lea esi, [esp + 0x3c]
cmp ecx, 8
jb 0x10016ccc
mov esi, eax
cmp word [esi + edx*2 - 2], 0x5c
je 0x10016cec
push 1
push 0x10005618
lea ecx, [esp + 0x44]
call fcn.100170ea
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x3c]
cmp ecx, 8
jb 0x10016cf7
mov edx, eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x10016d41
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov edi, dword [ebp + 8]
lea esi, [esp + 8]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x3c]
call fcn.10017048
mov ecx, dword [esp + 0x54]
mov eax, dword [ebp + 8]
pop edi
pop esi
xor ecx, esp
call fcn.1003e690
mov esp, ebp
pop ebp
ret

Function at 0x1001ec6f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
xor edi, edi
mov esi, 0x811c9dc5
test edx, edx
je 0x1001ec8d
movzx eax, byte [edi + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edi
cmp edi, edx
jb 0x1001ec7c
pop edi
mov eax, esi
pop esi
ret

Function at 0x1002c3e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1002c411
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1002c409
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1002c413
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1002c3f9
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002c4e5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002c512
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002c512
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax

Function at 0x100365e0
Capabilities:
Encode data using xor

Disassembly:
push es
sub eax, 0x22a1502
sub bh, al
add dword [eax], eax
push es
outsd dx, dword [esi]
mov eax, 0x2a060001
push edx
add dl, byte [edi]
sub bl, dl
add dword [eax], eax
push es
add ch, byte [eax]
sub bh, al
add dword [eax], eax
push es
add ebp, dword [edi - 0x42]
add dword [eax], eax
push es
sub ch, byte [edx + 2]
pop ss
sub dl, dl
add dword [eax], eax
push es
sub eax, 0x22a1602
sub bh, al
add dword [eax], eax
push es
add eax, dword [eax + 0x1bb6f]
push es
sub al, byte [eax]
add byte [ebx], dl
xor byte [ebx], al
add byte [eax], ch
add byte [eax], al
add byte [edx], ch
add byte [eax], al
adc dword [ebx], eax
add al, 5
jae 0x10036596
add dword [eax], eax
push es
or ch, byte [ebx]
adc al, 2
pop ss
sub bl, dl
add dword [eax], eax
push es
add ch, byte [eax]
mov dword [ecx], 0x6f060600
ret

Function at 0x100376a0
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx], eax
jb 0x1003766a
add al, 0
jo 0x100376d0
sbb eax, dword [eax]
add byte [ebx], ch
add dh, byte es:[edx - 0x22]
add al, 0
jo 0x100376dc
sbb eax, dword [eax]
add byte [ebx], ch
jae 0x1003772e
add byte [ebx], dl
xor byte [ebx], al
adc dword [edx], eax
Function at 0x10038150
Capabilities:
Encode data using xor

Disassembly:
mov cl, 1
add byte [edx], cl
and eax, 0x1ae80
sub dh, byte [edx]
add ch, byte [eax]
mov dh, 1
add byte [edx], cl
jae 0x10038100
add dword [eax], eax
or ch, byte [edx]
xor al, byte [edx]
add ch, byte [eax]
mov bh, 1
add byte [edx], cl
jae 0x1003810d
add dword [eax], eax
or ch, byte [edx]
add bh, byte ss:[esp + esi*4 + 1]
add ch, byte [eax]
mov bh, 1
add byte [edx], cl
jae 0x1003810d
add dword [eax], eax
or ch, byte [edx]
add bh, byte ss:[esp + esi*4 + 1]
add byte [edx], cl
add ebp, dword [eax]
mov eax, 0x2a0a0001
add bh, byte ss:[esp + esi*4 + 1]
add byte [edx], cl
add ebp, dword [eax]
mov ecx, 0x2a0a0001
jp 0x1003817e
add bh, byte [esp + esi*4 + 1]
add byte [edx], cl
sub byte [edx - 0x7ef5ffff], bh
insd dword es:[edi], dx
add byte [eax], al
sbb eax, dword [edx]
jl 0x10038141
add dword [eax], eax
or al, byte [ebx]
sub byte [eax + 0x2a0a0001], bh
add byte [eax], al
adc esi, dword [eax]
add al, byte [eax]
push cs
add byte [eax], al
add byte [ecx], al
add byte [ecx], dl
add bh, byte [esp + esi*4 + 1]
add byte [edx], cl
adc al, byte [eax]
sub byte [eax + 0x2a0a0001], bh
add byte [eax], al
add byte [edx], cl
sub al, byte [eax]
add byte [ebx], dl
xor byte [edx], al
add byte [esi], cl
adc esi, dword [eax]
add al, byte [eax]
push cs
add byte [eax], al
add byte [edx], al
add byte [ecx], dl
add bh, byte [esp + esi*4 + 1]
add byte [edx], cl
adc al, byte [eax]
sub byte [ecx + 0x2a0a0001], bh
dec edx
add bh, byte [esp + esi*4 + 1]
add byte [edx], cl
add ebp, dword [eax]
xor eax, dword [eax]
add byte [ebx], ch
sub byte [ecx + eax + 0x2a0a00], bh
add byte [eax], al
adc esi, dword [eax]
add al, 0
add dword [eax], eax
or ch, byte [edx]
add byte [eax], al
add byte [ebx], dl
xor byte [eax + eax], al
add byte es:[eax], al
add byte [ebx], al
add byte [ecx], dl
jae 0x100381b0
add dword [eax], eax
or cl, byte [edx]
push es
add edi, dword [ebp - 0x42]
add dword [eax], eax
or al, byte [edx]
jl 0x100381b5
add dword [eax], eax
or al, byte [esi + eax]
inc byte [esi]
mov edi, 0x730a0001
rol byte [ecx], 0
or ch, byte [eax]
xor al, 0
add byte [ebx], ch
sub bh, byte [edx]
add bh, byte [esp + esi*4 + 1]
add byte [edx], cl
add al, 3
sub byte [eax + eax], dh
add byte [ebx], ch
sub cl, byte [edx + 2]
jl 0x100381de
add dword [eax], eax
or al, byte [ebx]
sub byte [0x282b0000], dh
add byte [eax], al
sub ebp, dword [eax]
Function at 0x1003a040
Capabilities:
Encode data using xor

Disassembly:
push es
ror dword [0x6c730600], 1
add byte [esi], al
jae 0x1003a0b0
add byte [esi], al
jae 0x1003a0b0
add al, byte [eax]
or al, byte [eax + ebp]
mov byte [ebx], al
add byte [esi], al
sub bh, byte [edx]
add al, byte [ebx]
and byte [eax], al
add byte [ecx], al
add byte [edx + 0x28], ch
mov byte [ebx], al
add byte [esi], al
sub dl, byte [ebx]
xor byte [ebx], al
add byte [eax], ah
add byte [eax], al
add byte [ecx], ah
add byte [ecx], dl
jae 0x1003a03d
or eax, 0x60a0600
add edi, dword [ebp - 0x4c]
add eax, 0x6020400
inc byte [esi]
ror dword [0x6c730600], cl
add al, byte [eax]
or ch, byte [eax]
xchg byte [ebx], al
add byte [esi], al
sub dl, byte [ebx]
xor byte [eax + eax], al
xor al, byte [eax]
add byte [eax], al
bound eax, qword [eax]
add byte [ecx], dl
add al, 0xd4
lea esi, [edi + 0xa010000]
push ss
push 0xc
sub edx, dword [ebx]
add eax, dword [esi]
push ss
pop es
jae 0x1003a0e6
add dword [eax], eax
or ch, byte [edi + 0x6d]
add al, byte [eax]
or cl, byte [eax]
pop es
or byte [edi], al
push 0x58
or al, 2
push es
push ss
push es
mov gs, word [ecx + 0x6f]
outsb dx, byte [esi]
add al, byte [eax]
or ah, byte [0xdd30160b]
or byte [edx], ch
add byte [eax], al
adc esi, dword [eax]
add eax, 0x3300
add byte [ebx], ah
add byte [ecx], dl
add eax, 0xb78dd4
add byte [ecx], al
or ch, byte [ebx]
push cs
add eax, dword [esi]
push ss
pop es
outsd dx, dword [esi]
outsd dx, dword [esi]
add al, byte [eax]
or al, byte [edi + eax]
add byte [edx], cl
add al, 7
pop ecx
adc byte [edx], al
add al, 0x16
xor dword [esi], edx
add al, byte [esi]
push ss
add al, 6
mov gs, word [ecx + 0x28]
cmp eax, 0x6f0a0001
outsb dx, byte [esi]
add al, byte [eax]
or ah, byte [0xd830160b]
sub al, byte [eax]
adc esi, dword [eax]
add al, 0
and eax, 0x8000000
add byte [eax], al
adc dword [ebx], ebp
push ds
add al, byte [ebx]
add al, 5
outsd dx, dword [esi]
jo 0x1003a120
add byte [edx], cl
or al, byte [esi]

Function at 0x1003a5f0
Capabilities:
Encode data using xor

Disassembly:
push es
outsd dx, dword [esi]
jg 0x1003a5f6
add byte [edx], cl
fiadd word es:[ebx]
fiadd word es:[eax]
add ch, byte [edi - 0x80]
add al, byte [eax]
add byte [edx], al
outsd dx, dword [esi]
add byte [edx], 0
or ch, byte [edx]
add byte [eax], al
add dword [eax], edx
add byte [eax], al
add byte [eax], al
or eax, 0x281b00
add ecx, dword [0x13010000]
xor byte [eax + eax], al
dec ecx
add byte [eax], al
add byte [eax], ch
add byte [ecx], dl
jae 0x1003a5fb
or eax, 0x60a0600
add bh, byte [ebp - 0x49]
add eax, 0x7b060400
mov bh, 5
add byte [eax + ebp], al
pop ecx
add byte [eax], al
sub eax, dword [esi]
inc byte [esi]
invalid
Function at 0x1003b9d0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
or bl, ah
pop es
sub al, byte [eax]
add byte [eax], al
add dword [eax + eax], ebx
add byte [edx], al
add byte [edi], cl
add byte [esi], bl
sub eax, 0xa00
add byte [eax], al
add al, byte [eax]
inc edi
add byte [edx], bh
add dword [eax], 0xa
add byte [ebx], dl
xor byte [edx], al
add byte [ebx], bl
add byte [eax], al
add byte [edx + 0x2110000], cl
adc al, byte [eax]
sub byte [ebx], al
add eax, dword [eax]
or ch, byte [0xfe01120a]
adc eax, 0x1b00012f
pop es
sub al, byte [esi]
jae 0x1003b9bd
add al, byte [eax]
or ch, byte [edx]
add byte [ebx], dl
xor byte [edx], al
add byte [ebx], bl
add byte [eax], al
add byte [ebx + 0x2110000], cl
adc al, byte [eax]
sub byte [ebx + eax], al
add byte [edx], cl
sub eax, 0xfe01120a
adc eax, 0x1b00014a
pop es
sub al, byte [esi]
jae 0x1003ba45
add eax, dword [eax]
or ch, byte [edx]
add byte [ebx], dl
xor byte [edx], al
add byte [esi], cl
adc esi, dword [eax]
add al, byte [eax]
push cs
add byte [eax], al
add byte [eax], bh
add byte [ecx], dl
add dl, byte [edx]
add byte [eax], ch
add al, 3
add byte [edx], cl
sub eax, 0x62a0302
sub al, byte [eax]
add byte [ebx], dl
xor byte [edx], al
add byte [esi], cl
add byte [eax], al
add byte [esi], ch
add byte [ecx], dl
add dl, byte [edx]
add byte [eax], ch
push es
add eax, dword [eax]
or ch, byte [0x62a0302]
sub al, byte [eax]
add byte [ebx], dl
xor byte [edx], al
add byte [esi], cl
add byte [eax], al
add byte [eax + eax + 0x12021100], cl
add byte [eax], ch
pop es
add eax, dword [eax]
Function at 0x1003e080
Capabilities:
Encode data using xor

Disassembly:
or byte [eax], al
push es
adc al, 0x28
test al, 3
add byte [esi], al
sub bh, byte es:[esi + 0x73]
invalid
Function at 0x4038d0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x4c], eax
je 0x40391c
call fcn.00434d90
lea eax, [0x516ea5]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435670
call fcn.00434e00
mov dword [esp], 2
call fcn.0042f1e0
mov eax, dword [esp + 0x2c]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
nop
inc dword [ecx + 0x148]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
mov ebx, ecx
mov dword [edx + 0xc0], ecx
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x98], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x30], ecx
test byte [ecx], al
lea esi, [ecx + 0x19c]
lea edi, [esp + 0x10]
call fcn.0045dcb4
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0xc], edx
call fcn.00459fe0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 0
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0x1d8
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00402090
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.00403a30
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 1
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x30]
cmp ecx, edx
jne 0x403a16
mov dword [esp], ecx
call fcn.004309e0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043ce60
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x19c]
lea esi, [esp + 0x10]
call fcn.0045dcb4
add esp, 0x34
ret
lea eax, [0x5189e0]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.00433870
nop
int3
Function at 0x40b600
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b7d1
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b62b
mov eax, 0x7000000
jmp 0x40b633
test eax, eax
je 0x40b7ac
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0045d5b0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x5cd620]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40b7c4
cmp ecx, 0x21
jae 0x40b7b8
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004576d0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.004577a0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x53ad30]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x53ada0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b787
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x53ade0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.0045d690
mov eax, ecx
mov ecx, 0x21
call fcn.0045d740
nop
call fcn.0045c1c0
jmp fcn.0040b600