joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ba9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebp, esp
add ebp, 0x24
push esp
call fcn.00405a0a
mov edx, 0xa164eab0
xor byte [eax], al
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x407bce
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00405a0a
sbb dword [edx], ecx
push ebx
mov edi, eax
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00405a0a
mov byte [0x8b490c5b], dh
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x407bf7
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x407bf7
call fcn.00405a0a
dec edi
cwde
sbb dh, byte [edx - 0x75]
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00405a0a
sbb al, 0xde
wait
sar edi, cl
jne 0x407c41
push dword [ebp + 4]
push dword [ebp]
call fcn.0040620a
add cl, byte [edi]
test al, ch
add byte [eax], al
add byte [esi - 0x18], dl
pop eax
invalid
in eax, 0xff
inc dword [edx]
je 0x407d33
push esi
call fcn.00407ba9
pop ecx
cmp eax, 0xffffffff
je 0x407c85
push esi
call fcn.00407ba9
pop ecx
cmp eax, 0xfffffffe
je 0x407c85
push esi
call fcn.00407ba9
sar eax, 5
push esi
lea edi, [eax*4 + 0x412ea0]
call fcn.00407ba9
and eax, 0x1f
pop ecx
shl eax, 6
add eax, dword [edi]
pop ecx
jmp 0x407c87
mov eax, ebx
mov al, byte [eax + 0x24]
and al, 0x7f
cmp al, 1
je 0x407d33
push esi
call fcn.00407ba9
pop ecx
cmp eax, 0xffffffff
je 0x407cce
push esi
call fcn.00407ba9
pop ecx
cmp eax, 0xfffffffe
je 0x407cce
push esi
call fcn.00407ba9
sar eax, 5
push esi
lea edi, [eax*4 + 0x412ea0]
call fcn.00407ba9
and eax, 0x1f
pop ecx
shl eax, 6
add eax, dword [edi]
pop ecx
jmp 0x407cd0
mov eax, ebx
test byte [eax + 4], 0x80
je 0x407d33
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push 5
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040b09d
add esp, 0x10
test eax, eax
je 0x407cf6
mov eax, 0xffff
jmp 0x407d53
xor edi, edi
cmp dword [ebp - 0x10], edi
jle 0x407d2d
dec dword [esi + 4]
js 0x407d14
mov eax, dword [esi]
mov cl, byte [ebp + edi - 0xc]
mov byte [eax], cl
mov ecx, dword [esi]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x407d22
movsx eax, byte [ebp + edi - 0xc]
push esi
push eax
call fcn.00402afe
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x407cef
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x407cfd
mov ax, word [ebp + 8]
jmp 0x407d53
add dword [esi + 4], 0xfffffffe
js 0x407d46
mov ecx, dword [esi]
mov eax, dword [ebp + 8]
mov word [ecx], ax
add dword [esi], 2
jmp 0x407d53
movzx eax, word [ebp + 8]
push esi
push eax
call fcn.0040adbd
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004021fc
leave
ret
Function at 0x407bdb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebp, esp
add ebp, 0x24
push esp
call fcn.00405a0a
mov edx, 0xa164eab0
xor byte [eax], al
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x407bce
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00405a0a
sbb dword [edx], ecx
push ebx
mov edi, eax
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00405a0a
mov byte [0x8b490c5b], dh
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x407bf7
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x407bf7
call fcn.00405a0a
dec edi
cwde
sbb dh, byte [edx - 0x75]
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00405a0a
sbb al, 0xde
wait
sar edi, cl
jne 0x407c41
push dword [ebp + 4]
push dword [ebp]
call fcn.0040620a
add cl, byte [edi]
test al, ch
add byte [eax], al
add byte [esi - 0x18], dl
pop eax
invalid
in eax, 0xff
inc dword [edx]
je 0x407d33
push esi
call fcn.00407ba9
pop ecx
cmp eax, 0xffffffff
je 0x407c85
push esi
call fcn.00407ba9
pop ecx
cmp eax, 0xfffffffe
je 0x407c85
push esi
call fcn.00407ba9
sar eax, 5
push esi
lea edi, [eax*4 + 0x412ea0]
call fcn.00407ba9
and eax, 0x1f
pop ecx
shl eax, 6
add eax, dword [edi]
pop ecx
jmp 0x407c87
mov eax, ebx
mov al, byte [eax + 0x24]
and al, 0x7f
cmp al, 1
je 0x407d33
push esi
call fcn.00407ba9
pop ecx
cmp eax, 0xffffffff
je 0x407cce
push esi
call fcn.00407ba9
pop ecx
cmp eax, 0xfffffffe
je 0x407cce
push esi
call fcn.00407ba9
sar eax, 5
push esi
lea edi, [eax*4 + 0x412ea0]
call fcn.00407ba9
and eax, 0x1f
pop ecx
shl eax, 6
add eax, dword [edi]
pop ecx
jmp 0x407cd0
mov eax, ebx
test byte [eax + 4], 0x80
je 0x407d33
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push 5
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040b09d
add esp, 0x10
test eax, eax
je 0x407cf6
mov eax, 0xffff
jmp 0x407d53
xor edi, edi
cmp dword [ebp - 0x10], edi
jle 0x407d2d
dec dword [esi + 4]
js 0x407d14
mov eax, dword [esi]
mov cl, byte [ebp + edi - 0xc]
mov byte [eax], cl
mov ecx, dword [esi]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x407d22
movsx eax, byte [ebp + edi - 0xc]
push esi
push eax
call fcn.00402afe
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x407cef
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x407cfd
mov ax, word [ebp + 8]
jmp 0x407d53
add dword [esi + 4], 0xfffffffe
js 0x407d46
mov ecx, dword [esi]
mov eax, dword [ebp + 8]
mov word [ecx], ax
add dword [esi], 2
jmp 0x407d53
movzx eax, word [ebp + 8]
push esi
push eax
call fcn.0040adbd
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004021fc
leave
ret
Function at 0x40c1c8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004079cb
mov dword [ebp - 0x14], eax
cmp dword [0x4ab740], esi
jne 0x40c2bb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c248
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c39b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c39b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c39b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ab740], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ab744], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ab748], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ab750], eax
test eax, eax
je 0x40c2b8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ab74c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c2e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c2d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c2f5
push 4
pop eax
jmp 0x40c39d
cmp dword [ebp - 0x14], esi
je 0x40c2f5
push dword [0x4ab740]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c2da
mov eax, dword [0x4ab74c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c353
cmp dword [0x4ab750], edi
je 0x40c353
push eax
call ebx
push dword [0x4ab750]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c353
test eax, eax
je 0x40c353
call ecx
test eax, eax
je 0x40c348
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c348
test byte [ebp - 8], 1
jne 0x40c353
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c383
mov eax, dword [0x4ab744]
cmp eax, edi
je 0x40c380
push eax
call ebx
test eax, eax
je 0x40c380
call eax
mov esi, eax
test esi, esi
je 0x40c380
mov eax, dword [0x4ab748]
cmp eax, edi
je 0x40c380
push eax
call ebx
test eax, eax
je 0x40c380
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ab740]
call ebx
test eax, eax
je 0x40c39b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c39d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403b35
mov esp, ebp
pop ebp
ret
Function at 0x407280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41e5e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x425060]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x4073b0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, eax
cmp esi, 3
jne 0x407386
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jl 0x40739a
lea eax, [esp + 0x18]
push eax
mov ecx, 0x421f80
call fcn.00402dc0
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x2c], 0
call fcn.00402400
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40732d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov ebx, eax
call edi
mov esi, eax
cmp ebx, 0xffffffff
je 0x407366
test bl, 0x10
jne 0x407366
lea ecx, [esp + 0x14]
call fcn.00405bc0
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407386
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 2
je 0x40739a
cmp esi, 3
je 0x40739a
cmp esi, 0x7b
je 0x40739a
cmp esi, 0x35
jne 0x40734d
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
not al
movzx eax, al
shr eax, 4
and eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x407880
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, eax
push edi
call fcn.00407dc0
mov eax, dword [esp + 0x1c]
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407947
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xf4240
jg 0x407940
test ebp, ebp
jne 0x4078e2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
lea ecx, [ebp + 2]
push ecx
push 1
call fcn.0040c343
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x407940
push 0
lea edx, [esp + 0x18]
push edx
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407937
cmp dword [esp + 0x14], ebp
jne 0x407937
push ebp
mov eax, ebx
call fcn.00407960
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0040badb
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push ebx
call fcn.0040badb
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x40af60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
xor ebx, ebx
cmp eax, ebx
jne 0x40af78
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x14]
push edx
push ebx
push str.langFileName
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 1
call edi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40b004
mov ecx, dword [esp + 0xc]
cmp ecx, 1
je 0x40afba
cmp ecx, 7
je 0x40afba
cmp ecx, 2
jne 0x40b004
push esi
add eax, 2
push eax
push 1
call fcn.0040c343
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40b003
mov edx, dword [ebp]
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push ebx
push str.langFileName
push edx
call edi
test eax, eax
jne 0x40affa
mov edi, dword [esp + 0x1c]
mov edx, esi
call fcn.00405920
mov ebx, 1
push esi
call fcn.0040badb
add esp, 4
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 8

Function at 0x40b3b8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4267c8], 0
push esi
jne 0x40b32b
call fcn.0040b251
test eax, eax
je 0x40b36e
mov eax, dword [0x4267c8]
cmp eax, 1
jne 0x40b34c
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40b36e
pop esi
ret
push eax
call dword [0x4267d0]
test eax, eax
jne 0x40b3b6
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40b372
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4267c8]
call dword [0x4267d0]
mov edi, eax
test edi, edi
je 0x40b397
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b3b3
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4267c8]
call dword [0x4267cc]
add edi, 0x10
cmp edi, esi
jb 0x40b39f
mov eax, edi
pop edi
pop esi
ret
jmp 0x40b318

Function at 0x40b677
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425060]
jne 0x40b681
repz ret
jmp fcn.0040cd8c
Function at 0x4152bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040cf04
and dword [ebp - 4], 0
cmp dword [0x4273e8], 0
mov ebx, eax
jne 0x415370
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x415421
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x415421
push eax
call fcn.0040ce92
mov dword [esp], 0x420568
push edi
mov dword [0x4273e8], eax
call esi
push eax
call fcn.0040ce92
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4273ec], eax
call esi
push eax
call fcn.0040ce92
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4273f0], eax
call esi
push eax
call fcn.0040ce92
pop ecx
mov dword [0x4273f8], eax
test eax, eax
je 0x415370
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ce92
pop ecx
mov dword [0x4273f4], eax
mov eax, dword [0x4273f4]
cmp eax, ebx
je 0x4153c8
cmp dword [0x4273f8], ebx
je 0x4153c8
push eax
call fcn.0040cf0d
push dword [0x4273f8]
mov esi, eax
call fcn.0040cf0d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4153c8
test edi, edi
je 0x4153c8
call esi
test eax, eax
je 0x4153bf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4153bf
test byte [ebp - 0xc], 1
jne 0x4153c8
or dword [ebp + 0x10], 0x200000
jmp 0x415401
mov eax, dword [0x4273ec]
cmp eax, ebx
je 0x415401
push eax
call fcn.0040cf0d
pop ecx
test eax, eax
je 0x415401
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x415401
mov eax, dword [0x4273f0]
cmp eax, ebx
je 0x415401
push eax
call fcn.0040cf0d
pop ecx
test eax, eax
je 0x415401
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4273e8]
call fcn.0040cf0d
pop ecx
test eax, eax
je 0x415421
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415423
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4198b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.004195c2
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4198eb
inc dword [ebp - 0x8c]
invalid
scasd eax, dword es:[edi]
invalid
invalid
Function at 0x1005a3dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1005a3ec
pop dword [ebp - 0x1c]
mov eax, 0x7dd6a9d0
sub eax, 0x6dd105e4
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x8b4d6aa0
sub dword [ebp - 0x2c], 0x3cfb2555
mov dword [ebp - 0x28], 0x369747ea
add dword [ebp - 0x28], 0xfb9c045b
mov dword [ebp - 0x24], 0x56dacf7e
add dword [ebp - 0x24], 0xf57174b0
mov dword [ebp - 0x20], 0xac8b1e71
add dword [ebp - 0x20], 0x5374e18f
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x205b6e44
add eax, 0xefad01f0
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x210f99bc
add dword [ebp - 0x2c], 0x5362cf9a
mov dword [ebp - 0x28], 0xbf8c7f81
sub dword [ebp - 0x28], 0x7e201e0c
mov dword [ebp - 0x24], 0xc22d2933
sub dword [ebp - 0x24], 0x5ebdbcc7
mov dword [ebp - 0x20], 0xce7e0096
add dword [ebp - 0x20], 0x3181ff6a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x41fce
push 0
call eax
mov ecx, 0x6f9f694e
sub ecx, 0x6f9f0ee1
xor ebx, ebx
add ebx, eax
mov edi, 0x100b9000
add edi, dword [ebp - 0x1c]
mov edx, 0x39eb3e59
mov dword [ebp - 8], 0x1f4c9c76
mov esi, dword [edi]
xor dword [ebp - 4], 0x7471e553
sub esi, edx
add dword [ebp - 0x18], esi
mov dword [ebx], esi
add dword [ebp - 8], 0x2310aec1
add ebx, 4
add edi, 0x53ba13c1
sub edi, 0x53ba13bd
loop 0x1005a4ff
add eax, 0xce363ea4
add eax, 0x31cb1de3
xor ebx, ebx
add ebx, eax
add eax, 0xde6dfe18
sub eax, 0xde6dfe13
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x403630
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5d54ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403800
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.004662a0
jmp fcn.00403630
Function at 0x40cff0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x5d54ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d1bb
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40d019
mov eax, 0x7000000
jmp 0x40d021
test eax, eax
je 0x40d196
mov dword [esp + 0x34], eax
mov ecx, dword [0x5d54ec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call fcn.00467650
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x57ed20]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40d1ae
cmp edx, 0x21
jae 0x40d1a2
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.00460400
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004604d0
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x500ad0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x500b40]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40d171
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x500b88]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.00467730
mov eax, edx
mov ecx, 0x21
call fcn.004677c0
nop
call fcn.004662a0
jmp fcn.0040cff0