joyce8/EMBER2024-capa huggingface dataset:
Function at 0x659b8d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x659b8f8f
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.65982520
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0x65a781e0]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.65982400
mov eax, dword [esp + 4]
test eax, eax
je 0x659b8f74
mov eax, dword [esp + 0x1c]
lea ecx, [0x65a781e0]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.65987980
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.65982400
mov eax, dword [esp + 4]
test eax, eax
je 0x659b8f62
mov eax, dword [esp + 0x1c]
lea ecx, [0x65a781e0]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.659b93a0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
je 0x659b8e84
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.65982520
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.65987b80
mov eax, dword [esp + 0x24]
test eax, eax
je 0x659b8f5e
mov ecx, dword [eax + 0x10]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x659b8ee1
mov eax, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.659c7940
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x659b8f78
movzx ecx, byte [esp + 0x38]
test cl, cl
je 0x659b8f1b
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.659b8fa0
movzx eax, byte [esp + 4]
test al, al
je 0x659b8f17
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x659b8f1b
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.659b8a10
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x659b8f5e
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x659b8f5e
nop
lea eax, [0x65a19768]
mov dword [esp], eax
call fcn.659c9650
add esp, 0x30
ret
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.65987b80
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x65a1652b]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.659ab0e0
nop
call fcn.659c97c0
jmp fcn.659b8d90
Function at 0x659be750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x659be8d3
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x659be8cb
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x659be7ac
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x659be7ac
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x659be7bf
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x659be8a0
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x659be892
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x659be88b
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x659be816
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x659be85f
mov eax, 1
cmp eax, ecx
ja 0x659be84d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.659cad00
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x659be886
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x659be852
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x659be81b
call fcn.659caca0
xor eax, eax
call fcn.659cac90
call fcn.659cad00
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x659be8c6
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x659be897
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x659be7c4
call fcn.659caca0
xor eax, eax
call fcn.659cac90
nop
call fcn.659c97c0
jmp fcn.659be750
Function at 0x659c4110
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x659c41af
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.659cadc7
lea ecx, [0x659c41c0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.659c96b0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.659c97c0
jmp fcn.659c4110
Function at 0x659caab0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x65a9c260]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x659c929b
je 0x659c92ea
cmp ebx, 0x20
jbe 0x659c92f0
cmp ebx, 0x40
jbe 0x659c932e
jmp 0x659c93bf
test ebx, ebx
je 0x659c92e0
add eax, 0x10
test ax, 0xff0
je 0x659c92cc
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x65a2dd40]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x65a2de40]
jmp 0x659c92b8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x659c92b8
pxor xmm1, xmmword [0x65a9c270]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x65a9c270]
pxor xmm2, xmmword [0x65a9c280]
pxor xmm3, xmmword [0x65a9c290]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x65a9c270]
pxor xmm2, xmmword [0x65a9c280]
pxor xmm3, xmmword [0x65a9c290]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x659c941e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x65a9c00f], 0
je 0x659caaca
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x659c9260
jmp fcn.65986670

Function at 0x659cb840
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.659caa30
call fcn.659c9630
ret
Function at 0x659e8140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x659e8231
sub esp, 0x28
mov dword [esp + 0x14], 0x7321410c
mov dword [esp + 0x18], 0xed1b122e
lea edi, [esp + 0x1c]
lea esi, [0x65a2c7e4]
call fcn.659cb2c2
xor eax, eax
jmp 0x659e8192
movzx edi, byte [esp + ebx + 0x14]
lea edx, [edi + edx + 0x1f]
mov byte [esp + ebp + 0x14], dl
xchg esi, eax
mov byte [esp + ebx + 0x14], al
xchg esi, eax
add eax, 2
cmp eax, 0xc
jge 0x659e81d2
jae 0x659e8226
movzx edx, byte [esp + eax + 0x1c]
lea ebx, [eax + 1]
cmp ebx, 0xc
jae 0x659e821a
movzx ebx, byte [esp + eax + 0x1d]
mov ebp, edx
xor edx, ebx
xchg ebp, eax
movzx eax, al
xchg ebp, eax
add edx, eax
cmp ebp, 8
jae 0x659e820e
movzx ebx, bl
movzx esi, byte [esp + ebp + 0x14]
lea esi, [esi + edx + 0x1f]
cmp ebx, 8
jb 0x659e817c
jmp 0x659e8202
mov dword [esp], 0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 8
call fcn.659bcc20
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
add esp, 0x28
ret
mov eax, ebx
mov ecx, 8
call fcn.659cac90
mov eax, ebp
mov ecx, 8
call fcn.659cac90
mov eax, ebx
mov ecx, 0xc
call fcn.659cac90
mov ecx, 0xc
call fcn.659cac90
nop
call fcn.659c97c0
jmp fcn.659e8140
Function at 0x659e8a20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [0x65aa0f40], eax
test eax, eax
je 0x659e8a68
mov dword [esp], 0x65aa0f44
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp], 2
call dword [0x65a03d3c]
mov dword [esp + 8], 0x3d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x659e9180
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x65aa12d8]
test esi, esi
jle 0x659e9290
mov edi, dword [0x65aa12dc]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x659e91b4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x659e9235
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x659e91a0
mov dword [esp], eax
mov ebx, eax
call fcn.659e98d0
test eax, eax
mov edi, eax
je 0x659e92b7
mov eax, dword [0x65aa12dc]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.659e99d0
add eax, dword [edi + 0xc]
mov edx, dword [0x65aa12dc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x659e9297
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x659e922e
sub eax, 4
and eax, 0xfffffffb
jne 0x659e9240
add dword [0x65aa12d8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x65aa12dc]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x659e922e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.659e9ea8
lea esi, [esi]
xor esi, esi
jmp 0x659e91be
mov eax, dword [0x65aa12dc]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.659e9ea8
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.659e9ea8
mov esi, esi
lea edi, [edi]
Function at 0x659e9550
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x65aa12e8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x65aa12e0]
sub esp, 4
test ebx, ebx
je 0x659e95a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x659e959e
test esi, esi
je 0x659e959e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x659e9580
mov dword [esp], 0x65aa12e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x659e9ea8
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.659e9e80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.659e9e80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp fcn.659813e0
Function at 0x402150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, esp
mov dword [esi + 8], ebp
lea eax, [ebp + 8]
mov edx, esp
mov dword [esi + 0x7c], edx
mov dword [esi + 0x88], 0xffffffff
lea edx, [esi + 0x80]
mov dword [esi + 0x84], 0x408240
mov edi, dword fs:[0]
mov dword [esi + 0x80], edi
mov dword fs:[0], edx
mov edx, eax
add edx, 0xc
mov dword [esi + 0xc], edx
add eax, 0x30
mov dword [esi + 0x10], eax
mov dword [esi + 0x78], ecx
mov byte [esi + 0x77], 1
mov byte [esi + 0x76], 1
mov dword [esi + 0x88], 1
mov eax, esp
mov dword [eax], 0x418d91
lea ecx, [esi + 0x5c]
call fcn.00408320
sub esp, 4
jmp 0x4021d5
mov byte [esi + 0x5b], 0
mov dword [esi + 0x88], 2
mov eax, esp
mov dword [eax], str.yuwpuvzoshrocikhjkrwbxlbm
lea ecx, [esi + 0x40]
call fcn.00408320
sub esp, 4
jmp 0x4021fb
mov dword [esi + 0x3c], 0x9a4
mov dword [esi + 0x34], 0x40d064c0
mov dword [esi + 0x30], 0
mov dword [esi + 0x88], 3
mov eax, esp
mov dword [eax], str.uixfkz
lea ecx, [esi + 0x18]
call fcn.00408320
sub esp, 4
jmp 0x402232
mov dword [esi + 0x14], 0x260
lea ecx, [esi + 0x18]
call fcn.004083e0
lea ecx, [esi + 0x40]
call fcn.004083e0
lea ecx, [esi + 0x5c]
call fcn.004083e0
mov ecx, dword [esi + 0xc]
call fcn.004083e0
mov ecx, dword [esi + 0x10]
call fcn.004083e0
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
fld dword [0x418194]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x5c
Function at 0x402300
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
mov dword [esi + 8], ebp
lea eax, [ebp + 8]
mov dword [esi + 0xc], eax
mov edx, esp
mov dword [esi + 0x64], edx
mov dword [esi + 0x70], 0xffffffff
lea edx, [esi + 0x68]
mov dword [esi + 0x6c], 0x408260
mov edi, dword fs:[0]
mov dword [esi + 0x68], edi
mov dword fs:[0], edx
mov edx, dword [eax]
mov dword [esi + 0x10], edx
mov edx, eax
add edx, 0x10
mov dword [esi + 0x14], edx
mov edx, eax
add edx, 0x2c
mov dword [esi + 0x18], edx
mov edx, eax
add edx, 0x50
mov dword [esi + 0x1c], edx
add eax, 0x68
mov dword [esi + 0x20], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x5c], 0x40d7f7c0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0x40b77400
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0x40e37620
mov dword [esi + 0x48], 0
mov dword [esi + 0x70], 3
mov eax, esp
mov dword [eax], str.fkhwspzxcltffhtnfixxtrvpyouiltjnpiwlcdfcaayfjpriuhfrwfvwfkuqgkjcfmbzmbmfscwirsyjiltbqe
lea ecx, [esi + 0x30]
call fcn.00408320
sub esp, 4
jmp 0x4023ad
vmovsd xmm0, qword [0x418198]
vmovsd qword [esi + 0x28], xmm0
mov dword [esi + 0x24], 0x22
cmp dword [esi + 0x24], 0
jle 0x4023d9
mov eax, dword [esi + 0x24]
add eax, 0xffffffff
mov dword [esi + 0x24], eax
jmp 0x4023c1
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x70], 4
mov eax, esp
mov dword [eax], str.rmkuitnqmoige
call fcn.00408320
sub esp, 4
jmp 0x4023f8
lea ecx, [esi + 0x30]
call fcn.004083e0
mov ecx, dword [esi + 0x14]
call fcn.004083e0
mov ecx, dword [esi + 0x18]
call fcn.004083e0
mov ecx, dword [esi + 0x1c]
call fcn.004083e0
mov ecx, dword [esi + 0x20]
call fcn.004083e0
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi + 0x68]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x80
Function at 0x4024e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov esi, esp
mov dword [esi + 0xc], ebp
lea eax, [ebp + 8]
mov edx, esp
mov dword [esi + 0x9c], edx
mov dword [esi + 0xa8], 0xffffffff
lea edx, [esi + 0xa0]
mov dword [esi + 0xa4], 0x408280
mov edi, dword fs:[0]
mov dword [esi + 0xa0], edi
mov dword fs:[0], edx
mov edx, eax
add edx, 4
mov dword [esi + 0x14], edx
mov edx, eax
add edx, 0x24
mov dword [esi + 0x18], edx
add eax, 0x40
mov dword [esi + 0x1c], eax
mov dword [esi + 0x98], ecx
mov dword [esi + 0xa8], 2
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x80]
call fcn.00408320
sub esp, 4
jmp 0x40256e
mov dword [esi + 0x7c], 0x40dd4f80
mov dword [esi + 0x78], 0
mov dword [esi + 0x74], 0x40cbb200
mov dword [esi + 0x70], 0
mov dword [esi + 0xa8], 3
mov eax, esp
mov dword [eax], str.psfxaszgczajhymdkwftkwfrqvfayabhlyssalqazgusegiycskrcscfapcfelcdpjksjmzmpjounhzzwstyhulqplhtkohnf
lea ecx, [esi + 0x58]
call fcn.00408320
sub esp, 4
jmp 0x4025ac
mov byte [esi + 0x57], 1
mov byte [esi + 0x56], 1
mov dword [esi + 0xa8], 4
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x3c]
call fcn.00408320
sub esp, 4
jmp 0x4025d6
mov dword [esi + 0xa8], 5
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x24]
call fcn.00408320
sub esp, 4
jmp 0x4025f8
lea ecx, [esi + 0x24]
lea eax, [esi + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00408410
mov byte [esi + 0x13], al
lea ecx, [esi + 0x24]
call fcn.004083e0
lea ecx, [esi + 0x3c]
call fcn.004083e0
mov al, byte [esi + 0x13]
test al, 1
jne 0x40262d
jmp 0x402651
mov dword [esi + 0x20], 0x39
cmp dword [esi + 0x20], 0
jle 0x40264c
mov eax, dword [esi + 0x20]
add eax, 0xffffffff
mov dword [esi + 0x20], eax
jmp 0x402634
jmp 0x402651
lea ecx, [esi + 0x58]
call fcn.004083e0
lea ecx, [esi + 0x80]
call fcn.004083e0
mov ecx, dword [esi + 0x14]
call fcn.004083e0
mov ecx, dword [esi + 0x18]
call fcn.004083e0
mov ecx, dword [esi + 0x1c]
call fcn.004083e0
mov eax, dword [esi + 0xa0]
mov dword fs:[0], eax
mov eax, 0x1016d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x68
Function at 0x403820
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sbb ebx, 0x4d
or edi, 0xc2
rcr ebx, 0xd2
sub ebx, 0x15
rcr ebx, 0xc8
dec edi
dec ebx
or esi, 0x7c
inc eax
neg edi
imul eax
mov ebx, 0x82
or eax, 0x26
add ebx, 0xa
mov eax, 0xfd
bswap edi
imul edx
rcr eax, 0xd5
inc esi
or esi, 0xee
ror ebx, 0x9c
rol edx, 0xab
rcr eax, 0x61
rol esi, 0xe4
or edx, 0xdf
rol edx, 0xc5
or ebx, 0x88
or esi, 0x8b
rcl esi, 0x10
and ebx, 0xf
neg esi
neg ebx
add ebx, 0x8f
dec esi
rcl edx, 0x7b
not edi
mov eax, 0x6e
inc edi
and edx, 0xb5
dec edx
and eax, 0x3a
sbb edi, 0x5b
inc ebx
inc esi
rcl edi, 0x3a
inc ebx
rcr eax, 0x81
and edx, 0x48
rcl esi, 0x5c
bswap edi
xor ecx, ecx
xor edi, edi
bswap edi
inc edx
ror eax, 0x82
imul edx
neg edi
ror edi, 0xaa
imul edx
mov edx, 0x5f
rcr ebx, 0x9c
rcr eax, 0x63
imul eax
imul edi
ror esi, 0x6e
bswap edi
add eax, 3
dec ebx
neg eax
inc edi
or eax, 0xf1
add edi, 0x56
neg ebx
dec eax
add edi, 0xef
dec esi
imul edi
or eax, 0x81
or eax, 0xeb
neg edi
inc esi
imul esi
ror eax, 0x2a
imul esi
sub edi, 0x3f
and edi, 0x57
bswap ebx
and esi, 0xc8
bswap edi
rcr edi, 6
inc eax
inc esi
bswap edi
bswap esi
not ebx
sbb ebx, 0xd4
or ebx, 0x53
or esi, 0x2b
rol edi, 0xff
and eax, 0x94
neg edi
imul edx
mov ecx, dword [ebp + 0xc]
mov edi, 0x4e
bswap eax
dec ebx
mov edi, 0xd5
rcl esi, 0x48
and edi, 0xfb
rol esi, 3
mov edi, 0xe2
ror eax, 0x9b
not edx
mov esi, 0x39
ror edi, 0xd4
not edx
dec esi
rcr eax, 0xf2
dec esi
bswap eax
not edx
ror esi, 0x8d
imul ebx
inc edx
imul edi
add esi, 0xa9
rcr edx, 0x29
and esi, 0xb
sub edi, 0x96
inc edx
neg edi
sub edx, 0x15
sub edi, 0xbb
rcr eax, 0x52
neg eax
not esi
rol ebx, 0xca
sbb ebx, 0x31
inc esi
neg eax
rcr ebx, 0x30
inc ebx
bswap edx
sbb ebx, 0xfd
sub esi, 0xf2
bswap edi
rcl ebx, 0x2c
neg ebx
not edi
rcr edx, 0xa4
imul ebx
mov edx, 0x64
bswap esi
mov edi, dword [ebp + 8]
mov eax, eax
xor eax, ebx
mov ebx, ebx
xor eax, eax
mov esi, eax
mov ebx, eax
xor eax, ebx
xor esi, ebx
xor ebx, eax
mov ebx, eax
xor ebx, ebx
mov ebx, eax
not byte [edi]
xor esi, eax
xor ebx, eax
mov eax, eax
xor eax, eax
mov eax, esi
mov esi, ebx
xor ebx, eax
xor esi, esi
mov eax, esi
sub byte [edi], 0x98
mov ebx, esi
mov eax, esi
mov esi, esi
mov esi, esi
mov esi, esi
mov esi, eax
xor ebx, eax
mov eax, esi
xor eax, esi
add byte [edi], 0x53
mov ebx, esi
mov esi, esi
xor eax, ebx
xor eax, ebx
mov ebx, ebx
mov esi, eax
xor esi, eax
mov esi, eax
xor eax, esi
imul byte [edi]
inc edi
loop 0x4039e9
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409b83
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409bc2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409bc2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409bc2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409bc2
cmp dword [ecx + 0x74], 0xe
jbe 0x409bc2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret