joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b054
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4d5d68]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x49b097
cmp word [esi], dx
jne 0x49b097
or byte [edi + eax + 0x28], 4
jmp 0x49b09c
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x49b1ef
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x49b1cf
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x49b0de
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x49b114
cmp eax, edx
jae 0x49b120
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x49b0b6
jmp 0x49b1ef
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49b1cb
cmp dword [ebp - 0x14], 0
je 0x49b1cb
mov eax, dword [ebx*4 + 0x4d5d68]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x49b1a3
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x49b16c
mov word [esi], cx
jmp 0x49b19f
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4d5d68]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4d5d68]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4d5d68]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x49b1ef
pop ebx
cmp word [ebp - 4], bx
jne 0x49b1b4
cmp esi, dword [ebp + 0xc]
jne 0x49b1b4
mov word [esi], bx
jmp 0x49b1ec
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401924
add esp, 0x10
cmp word [ebp - 4], bx
je 0x49b1ef
push 0xd
jmp 0x49b1e8
mov ecx, dword [ebx*4 + 0x4d5d68]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x49b1e6
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x49b1ef
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x40221c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call fcn.00408320
mov dword [esp], str.KernelBase
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov ecx, dword [0x4411c0]
add ecx, ecx
mov dword [esp + 0x18], ecx
vxorps xmm0, xmm0, xmm0
vmovups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x1c
nop
test eax, eax
nop
call fcn.0040218b
nop
test eax, eax
nop
push 1
push dword fs:[0]
mov dword fs:[0], esp
mov dword [esp], str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
nop
test eax, eax
nop
mov byte [0x442a5c], 1
nop
test eax, eax
nop
add dword [0x4411bc], 0xffffff9c
nop
test eax, eax
nop
mov eax, dword [0x4411bc]
mov dword [esp], eax
call fcn.0040141f
test eax, eax
je 0x4022fa
mov dword [esp], 0x1b207
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov dword [esp], 0
call fcn.004060d1
sub esp, 4
nop
test eax, eax
nop
call fcn.00405731
nop
test eax, eax
nop
xor eax, eax
inc eax
add esp, 0x1c
pop ebp
ret
nop
test eax, eax
nop
mov dword [esp], 1
call sub.msvcrt.dll_exit
int3

Function at 0x40236c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x64757374
mov byte [ecx + 4], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 4
jne 0x4023aa
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4024fe
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.SiovAqpr]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x7573684c
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xc
jne 0x402549
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x402576
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [0x42e080]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x56797361
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xc
jne 0x4025c1
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x402646
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov word [ecx], 0x7472
mov byte [ecx + 2], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor edx, edx
mov al, 1
xor ecx, ecx
inc ecx
nop
test eax, eax
nop
nop
xor byte [esi + edx], dl
nop
test eax, eax
nop
nop
mov edx, ecx
test al, 1
mov eax, 0
jne 0x402688
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4027ec
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [0x42e0a0]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x64726564
mov word [ecx + 0xc], 0x7273
mov byte [ecx + 0xe], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xe
jne 0x40283d
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x402c42
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [esp + 0xa8]
mov eax, dword [esp + 0xa4]
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor ecx, ecx
vmovdqa ymm0, ymmword [0x4398c0]
vmovdqa xmm1, xmmword [0x4398e0]
vpbroadcastb xmm2, byte [0x4398f0]
nop
test eax, eax
nop
movsx edx, byte [eax + ecx]
vmovd xmm3, edx
vpbroadcastd ymm3, xmm3
vpsrlvd ymm3, ymm3, ymm0
vextracti128 xmm4, ymm3, 1
vpshufb xmm4, xmm4, xmm1
vpshufb xmm3, xmm3, xmm1
vpunpckldq xmm3, xmm3, xmm4
vpand xmm3, xmm3, xmm2
vmovq qword [esp + ecx*8 + 0x30], xmm3
inc ecx
cmp ecx, 8
jne 0x402c89
nop
test eax, eax
nop
lea ebx, [esp + 0x30]
push ebx
vzeroupper
call fcn.00402a56
nop
test eax, eax
nop
xor ebp, ebp
mov esi, esp
nop
test eax, eax
nop
vmovdqu ymm0, ymmword [ebx + 0x20]
vmovdqu ymmword [esp], ymm0
nop
test eax, eax
nop
push esi
vzeroupper
call fcn.00402af6
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
mov cl, byte [edi + eax]
xor byte [esp + eax], cl
nop
test eax, eax
nop
inc eax
cmp eax, 0x30
jne 0x402d03
nop
test eax, eax
nop
push esi
call fcn.00402b90
nop
test eax, eax
nop
push esi
call fcn.00402b48
xor eax, eax
nop
test eax, eax
nop
mov cl, byte [esp + eax]
xor byte [esp + eax + 0x30], cl
nop
test eax, eax
nop
inc eax
cmp eax, 0x20
jne 0x402d31
nop
test eax, eax
nop
cmp ebp, 0xf
je 0x402d96
nop
test eax, eax
nop
vmovups ymm0, ymmword [esp + 0x30]
vmovups ymmword [esp + 0x70], ymm0
nop
test eax, eax
nop
vmovups ymm0, ymmword [ebx + 0x20]
vmovups ymmword [esp + 0x30], ymm0
nop
test eax, eax
nop
vmovdqu ymm0, ymmword [esp + 0x70]
vmovdqu ymmword [ebx + 0x20], ymm0
nop
test eax, eax
nop
nop
test eax, eax
nop
inc ebp
add edi, 0x30
jmp 0x402cdf
push ebx
call fcn.00402aa4
nop
test eax, eax
nop
push dword [esp + 0xac]
push ebx
call fcn.004028cc
nop
test eax, eax
nop
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4038ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov dword [esp + 0x30], edx
mov ebp, ecx
nop
test eax, eax
nop
mov eax, dword [ecx + 0x3c]
nop
test eax, eax
nop
mov esi, dword [ecx + eax + 0x78]
nop
test eax, eax
nop
nop
test eax, eax
nop
mov eax, dword [ecx + esi + 0x1c]
add eax, ecx
mov dword [esp + 0x20], eax
nop
test eax, eax
nop
mov eax, dword [ecx + esi + 0x20]
add eax, ecx
mov dword [esp + 0x2c], eax
nop
test eax, eax
nop
mov eax, dword [ecx + esi + 0x24]
add eax, ecx
mov dword [esp + 0x1c], eax
nop
test eax, eax
nop
nop
test eax, eax
nop
lea ebx, [esp + 0xc]
mov ecx, ebx
call fcn.004023d6
push ebx
call sub.msvcrt.dll_atoi
add esp, 4
mov dword [esp + 0x28], esi
cmp eax, dword [ebp + esi + 0x18]
jae 0x403a70
mov edi, eax
mov dword [esp + 0x24], ebp
nop
test eax, eax
nop
mov eax, dword [esp + 0x2c]
mov esi, dword [eax + edi*4]
add esi, ebp
nop
test eax, eax
nop
lea ecx, [esp + 0xc]
push dword [esp + 0x30]
call fcn.004015ae
lea ecx, [esp + 0x3c]
push esi
call fcn.004015ae
nop
test eax, eax
nop
movzx eax, byte [esp + 0xc]
mov edx, eax
lea ecx, [esp + 0xd]
and dl, 1
je 0x403973
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov dword [esp + 0x18], edi
movzx ebx, byte [esp + 0x3c]
mov esi, dword [esp + 0x44]
test bl, 1
je 0x403993
mov edi, dword [esp + 0x40]
mov dword [esp + 8], esi
jmp 0x40399f
mov edi, ebx
shr edi, 1
lea ecx, [esp + 0x3d]
mov dword [esp + 8], ecx
test edi, edi
mov dword [esp + 0x38], ebx
je 0x4039b5
test dl, dl
mov dword [esp + 0x34], esi
je 0x4039bd
mov eax, dword [esp + 0x10]
jmp 0x4039bf
mov bl, 1
mov edi, dword [esp + 0x18]
jmp 0x403a31
shr eax, 1
mov ecx, dword [esp + 4]
lea esi, [ecx + eax]
cmp eax, edi
jge 0x4039ce
mov ebp, esi
jmp 0x403a16
mov byte [esp + 3], dl
mov ebp, ecx
mov ecx, dword [esp + 8]
movsx ebx, byte [ecx]
sub eax, edi
inc eax
je 0x403a0c
push eax
push ebx
push ebp
call sub.msvcrt.dll_memchr
add esp, 0xc
test eax, eax
je 0x403a0c
mov ebp, eax
push edi
push dword [esp + 0xc]
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x403a0e
inc ebp
mov eax, esi
sub eax, ebp
cmp eax, edi
jge 0x4039db
mov ebp, esi
mov dl, byte [esp + 3]
mov ecx, dword [esp + 4]
cmp ebp, esi
setne al
sub ebp, ecx
cmp ebp, 0xffffffff
setne bl
and bl, al
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
test byte [esp + 0x38], 1
je 0x403a48
push esi
call fcn.00406f30
add esp, 4
mov dl, byte [esp + 0xc]
and dl, 1
test dl, dl
je 0x403a58
push dword [esp + 0x14]
call fcn.00406f30
add esp, 4
nop
test eax, eax
nop
test bl, bl
jne 0x403a79
inc edi
mov eax, dword [esp + 0x28]
cmp edi, dword [ebp + eax + 0x18]
jb 0x403930
nop
test eax, eax
nop
xor ebp, ebp
jmp 0x403a88
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + edi*2]
mov ecx, dword [esp + 0x20]
add ebp, dword [ecx + eax*4]
mov eax, ebp
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403e26
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push ebx
push edi
push esi
nop
test eax, eax
nop
xor edi, edi
xor ebx, ebx
dec ebx
mov ebp, 0xfde9
push edi
push edi
push ebx
push dword [0x4430d4]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
nop
test eax, eax
nop
inc eax
push 2
push eax
call sub.msvcrt.dll_calloc
add esp, 8
mov dword [0x4430d8], eax
nop
test eax, eax
nop
push esi
push dword [0x4430d8]
push ebx
push dword [0x4430d4]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
test eax, eax
nop
push 0x4430b0
push dword [0x4430d8]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [0x4430d0], eax
nop
test eax, eax
nop
mov esi, dword [0x4430b0]
nop
test eax, eax
nop
shl esi, 2
cmp dword [0x4430b0], edi
jle 0x403efe
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ebp, ebp
mov eax, dword [0x4430d0]
mov eax, dword [eax + ebp*4]
sub esp, 0x20
mov dword [esp + 0x1c], edi
vmovaps xmm0, xmmword [0x439c80]
vmovups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0xfde9
call ebx
nop
test eax, eax
nop
nop
test eax, eax
nop
add esi, eax
inc ebp
cmp ebp, dword [0x4430b0]
jl 0x403ebb
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4430cc], eax
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
cmp dword [0x4430b0], 0
jle 0x403f85
mov eax, dword [0x4430b0]
mov ecx, dword [0x4430cc]
mov edx, dword [0x4430b0]
lea edi, [ecx + edx*4]
shl eax, 2
sub esi, eax
xor ebx, ebx
xor ebp, ebp
mov eax, dword [0x4430d0]
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [eax + ebp*4]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
test eax, eax
nop
mov ecx, dword [0x4430cc]
mov dword [ecx + ebp*4], edi
nop
test eax, eax
nop
add edi, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
sub esi, eax
inc ebp
cmp ebp, dword [0x4430b0]
jl 0x403f41
mov dword [0x4430ac], 1
nop
test eax, eax
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403f99
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
je 0x403fe9
nop
test eax, eax
nop
nop
test eax, eax
nop
movzx edx, word [ecx]
nop
test eax, eax
nop
cmp edx, 0x5a4d
jne 0x403fe9
mov edx, dword [ecx + 0x3c]
nop
test eax, eax
nop
cmp edx, 0x400
jg 0x403fe9
nop
test eax, eax
nop
nop
test eax, eax
nop
cmp dword [ecx + edx], 0x4550
jne 0x403fe9
add ecx, edx
nop
test eax, eax
nop
mov eax, ecx
ret

Function at 0x4046ca
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.kdroem33]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x6d6c652e
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xc
jne 0x404715
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x404742
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovups xmm0, xmmword [str.GdtLoeumeIaodme_]
vmovups xmmword [ecx], xmm0
mov byte [ecx + 0x10], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0x10
jne 0x404786
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4047b2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.LnaeLhbs]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x40797361
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xc
jne 0x4047fd
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x40482a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.Vhruu_l_]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x626f6d6c
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xc
jne 0x404875
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4048a2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovaps xmm0, xmmword [str.FeuCnmlaodMioe_]
vmovups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xf
jne 0x4048e2
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404914
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovaps xmm0, xmmword [str.FeuCnmlaodMioeV]
vmovups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xf
jne 0x404954
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x404986
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str._wfeum_]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x73616f69
mov word [ecx + 0xc], 0x7267
mov byte [ecx + 0xe], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xe
jne 0x4049d7
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404a04
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str._feum_i]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x6773616f
mov word [ecx + 0xc], 0x72
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xd
jne 0x404a51
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404a84
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [0x439d10]
vmovsd qword [ecx], xmm0
mov word [ecx + 8], 0x7767
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xa
jne 0x404ace
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404afa
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str._q__va]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x776773
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xb
jne 0x404b41
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404b74
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str._p_as]
vmovsd qword [ecx], xmm0
mov word [ecx + 8], 0x6267
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xa
jne 0x404bbe
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret