joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10014dd5
push eax
push esi
push dword [ebp + 8]
call fcn.10014d8a
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10014dd5
push eax
push esi
push dword [ebp + 8]
call fcn.10014d8a
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10014dc5
and eax, dword [ecx + 3]
invalid
Function at 0x1001cbc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100124e0

Function at 0x10020ba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bcd3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1008400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
lea edi, [ecx + 0x30]
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CAnnoTextRange.0
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [edi], vtable.CAnnoParagraphFormat.0
mov word [edi + 4], ax
mov dword [edi + 8], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x24], eax
mov byte [edi + 0x28], al
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x2c], eax
lea esi, [ecx + 0x60]
mov ecx, esi
call fcn.1001eb70
mov byte [ebp - 4], 2
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov word [ecx + 8], ax
mov dword [ecx + 0xc], eax
mov word [ecx + 0x20], ax
mov byte [ecx + 0x22], al
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x2c], eax
lea eax, [ebx + 8]
push eax
call fcn.100212b0
lea eax, [ebx + 0x30]
mov ecx, edi
push eax
call fcn.10020a20
lea eax, [ebx + 0x60]
mov ecx, esi
push eax
call fcn.1001f8c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10026460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bde9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1008400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CAnnoId.0
mov dword [esi + 4], 0xffffffff
mov dword [esi], vtable.CAnnoPageId.0
mov dword [ebp - 4], 0
mov dword [esi + 8], vtable.CAnnoRefCount.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], vtable.CAnnoObjObserver.0
mov byte [ebp - 4], 2
push 0xb4
mov dword [esi], vtable.CAnnoPage.0
mov dword [esi + 8], vtable.CAnnoPage.1.0
mov dword [esi + 0x10], vtable.CAnnoPage.2.0
mov dword [esi + 0x18], 0
call fcn.10069221
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.100137a0
mov byte [ebp - 4], 2
push 0xb4
mov dword [esi + 0x1c], eax
call fcn.10069221
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.100137a0
mov byte [ebp - 4], 2
push 0xb4
mov dword [esi + 0x20], eax
call fcn.10069221
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.100137a0
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x2d], 1
mov dword [esi + 0x30], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 7
mov word [esi + 0x34], ax
mov dword [esi + 0x4c], 0xffffff
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], esi
mov dword [esi + 0x5c], 0x7fffffff
mov dword [esi + 0x58], 0x7fffffff
mov dword [esi + 0x64], SysStringLen
mov dword [esi + 0x60], SysStringLen
mov byte [esi + 0x68], al
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x10026596
mov eax, dword [ecx + 0xc]
inc eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100265a4
mov eax, dword [ecx + 0xc]
inc eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x100265b2
mov eax, dword [ecx + 0xc]
inc eax
mov dword [ecx + 0xc], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10033af0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c8d2
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1008400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
sub ecx, 0
je 0x10033cd1
sub ecx, 1
je 0x10033c56
sub ecx, 1
jne 0x10033c43
push 0x6c
call fcn.10069221
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.CAnnoScribble.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov eax, dword [esi + 8]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x28], eax
mov ecx, dword [esi + 0x20]
mov dword [edi + 0x24], ecx
mov eax, dword [esi + 0x28]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x18], eax
mov dword [edi + 0x30], 0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
mov dword [edi], vtable.CAnnoThicknessScribble.0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
addsd xmm0, qword [ecx*8 + 0x10077200]
lea ecx, [edi + 0x54]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x10076ee4]
movss dword [edi + 0x48], xmm0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov byte [ebp - 4], 3
xor edx, edx
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
sar eax, 3
cmp eax, 5
jae 0x10033c1c
push ecx
call fcn.1003b5b0
mov edx, dword [edi + 0x68]
sub edx, dword [edi + 0x60]
sar edx, 3
cmp edx, 5
jae 0x10033c30
push ecx
lea ecx, [edi + 0x60]
call fcn.1003b5b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x48
call fcn.10069221
mov edx, eax
add esp, 4
mov dword [ebp - 0x10], edx
mov dword [edx], vtable.CAnnoScribble.0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov eax, dword [esi + 8]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [edx + 0x28], eax
mov eax, dword [esi + 0x20]
mov dword [edx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edx + 0x2c], eax
mov eax, dword [esi + 0x1c]
mov dword [edx + 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [edx + 0x1c], eax
mov eax, edx
mov ecx, dword [esi + 0x14]
mov dword [edx + 0x18], ecx
mov dword [edx + 0x30], 0
mov dword [edx], vtable.CAnnoSmoothScribble.0
mov dword [edx + 0x44], 0
mov dword [edx + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x40
call fcn.10069221
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
push esi
call fcn.10033d00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10045f40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d310
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1008400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [edi + 0x2d0]
test ebx, ebx
je 0x10045f8e
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1006f584]
mov ecx, ebx
call esi
mov dword [edi + 0x2d0], 0
push 0x48
call fcn.10069221
mov edx, eax
add esp, 4
mov dword [ebp - 0x10], edx
mov dword [edx], vtable.CAnnoScribble.0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov ecx, dword [edi + 0x24]
mov dword [edx + 0xc], ecx
mov ecx, dword [edi + 0x40]
mov dword [edx + 0x28], ecx
mov ecx, dword [edi + 0x3c]
mov dword [edx + 0x24], ecx
mov eax, dword [edi + 0x44]
mov dword [edx + 0x2c], eax
mov eax, dword [edi + 0x38]
mov dword [edx + 0x20], eax
mov eax, dword [edi + 0x34]
mov dword [edx + 0x1c], eax
mov eax, dword [edi + 0x30]
mov dword [edx + 0x18], eax
xor eax, eax
mov dword [edx + 0x30], 0
mov dword [edx], vtable.CAnnoSmoothScribble.0
mov dword [edx + 0x44], 0
mov dword [edx + 0x40], 0
mov dword [edi + 0x2d0], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004d020
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ac10
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1008400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0xa0]
mov dword [edi], vtable.CAnnoLocalView.1.0
mov dword [edi + 0x18], vtable.CAnnoLocalView.0
mov dword [edi + 0x1c], vtable.CAnnoLocalView.6.0
mov dword [edi + 0x20], vtable.CAnnoLocalView.4.0
mov dword [edi + 0x24], vtable.CAnnoLocalView.3.0
mov dword [edi + 0x28], vtable.CAnnoLocalView.7.0
mov dword [edi + 0x2c], vtable.CAnnoLocalView.2.0
mov dword [edi + 0x30], vtable.CAnnoLocalView.5.0
call fcn.10050640
lea ebx, [edi + 0x90]
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0xc]
mov dword [ebx], vtable.CAnnoTransactionMerge.0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1004d0df
mov eax, dword [eax]
push ebx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006f584]
mov ecx, dword [ebp - 0x10]
call esi
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1004d0df
mov eax, dword [eax]
push 1
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1006f584]
mov ecx, dword [ebp - 0x10]
call esi
mov dword [ebx + 0xc], 0
mov dword [ebx], vtable.CAnnoTimerModule.0
lea ecx, [edi + 0x64]
mov dword [edi + 0x7c], vtable.CAnnoRefCount.0
call fcn.10050450
test byte [ebp + 8], 1
mov dword [edi + 0x30], vtable.CAnnoLayerObserver.0
mov dword [edi + 0x2c], vtable.CAnnoNameTagPoolObserver.0
mov dword [edi + 0x28], vtable.CAnnoWindowObserver.0
mov dword [edi + 0x24], vtable.CAnnoFileSaverObserver.0
mov dword [edi + 0x20], vtable.CAnnoFileObserver.0
mov dword [edi + 0x1c], vtable.CAnnoMenuObserver.0
mov dword [edi + 0x18], vtable.CAnnoCmdObserver.0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CAnnoDocObserver.0
je 0x1004d154
push 0xfc
push edi
call fcn.1006956b
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100630b0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10086ba8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10086c5c]
cmp eax, dword [ecx + 4]
jg 0x100630d2
mov eax, 0x10084518
ret
push 0x10086c5c
call fcn.100696fa
add esp, 4
cmp dword [0x10086c5c], 0xffffffff
jne 0x100630cc
push esi
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x1006318a
cmp dword [0x1008451c], 0
jne 0x1006311a
push str.EnableMouseInPointer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1008451c], eax
jmp 0x1006311a
cmp dword [0x10084520], 0
jne 0x10063136
push str.GetPointerInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10084520], eax
jmp 0x10063136
cmp dword [0x10084524], 0
jne 0x10063152
push str.GetPointerPenInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10084524], eax
jmp 0x10063152
cmp dword [0x10084528], 0
jne 0x1006316e
push str.GetPointerTouchInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10084528], eax
jmp 0x1006316e
cmp dword [0x1008452c], 0
jne 0x1006318a
push str.SetWindowFeedbackSetting
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1008452c], eax
jmp 0x1006318a
push 0x1006e630
call fcn.10069556
push 0x10086c5c
call fcn.100696b0
add esp, 8
pop esi
jmp 0x100630cc

Function at 0x10063860
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x54], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [esi + 0x14]
cmp dword [esi + 0x3c], eax
jne 0x100638b5
test edx, edx
jne 0x10063886
lea eax, [edx + 1]
pop esi
pop ebp
ret 4
cmp byte [esi + 0x54], 0
je 0x100638a5
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor eax, eax
pop esi
pop ebp
ret 4
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
test edx, edx
je 0x100638c9
push 0
push 0
push 0x1601
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40a340
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ebp, dword [eax + 8]
or byte [ebx + ecx*4 - 0x3f7afbbf], ch
jne 0x40a35f
add ecx, 0xc
push ecx
call dword [0xd3c02c]
xor ebp, dword [edx + 0x4c21c5e]
mov byte [ebx + 0xc7501f8], al
cmp eax, 1
jne 0x40a370
mov eax, dword [ecx + 8]
mov ecx, 0xc03028ff
inc eax
add bl, ch
jae 0xe3b5a66d
cmp eax, 2
jne 0x40a358
mov ecx, dword [ecx + 8]
push ecx
pop ecx
adc eax, 0x40f634
sub edi, dword [ecx]
jne 0x40a358
mov esi, dword [0xee40c098]
call esi
adc al, al
je 0x40a358
call esi
add eax, 0xafc80
pop esi
push eax
ret 4

Function at 0x40ae50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x40ac90
cld
call 0x40af62
nop
jmp 0x40aca1
nop
jmp 0x40acae
pushal
mov ebp, esp
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
nop
mov edx, dword [edx + 0x14]
jmp 0x40acc8
mov esi, dword [edx + 0x28]
jmp 0x40acd5
movzx ecx, word [edx + 0x26]
xor edi, edi
jmp 0x40aceb
nop
xor eax, eax
lodsb al, byte [esi]
nop
cmp al, 0x61
nop
jl 0x40ad09
nop
jmp 0x40ad07
sub al, 0x20
nop
jmp 0x40ad1a
ror edi, 0xd
nop
add edi, eax
jmp 0x40ad2c
dec ecx
nop
jne 0x40aceb
nop
jmp 0x40ad42
push edx
jmp 0x40ad4d
mov edx, dword [edx + 0x10]
nop
jmp 0x40ad60
mov eax, dword [edx + 0x3c]
nop
jmp 0x40ad75
add eax, edx
push edi
nop
mov eax, dword [eax + 0x78]
test eax, eax
nop
je 0x40af2b
nop
nop
jmp 0x40ad97
add eax, edx
jmp 0x40adaa
push eax
mov ebx, dword [eax + 0x20]
add ebx, edx
nop
mov ecx, dword [eax + 0x18]
nop
jmp 0x40adc6
test ecx, ecx
je 0x40af15
nop
nop
dec ecx
nop
xor edi, edi
jmp 0x40ade0
mov esi, dword [ebx + ecx*4]
nop
jmp 0x40adf0
add esi, edx
nop
jmp 0x40ae01
jmp 0x40ae0b
xor eax, eax
nop
jmp 0x40ae18
lodsb al, byte [esi]
nop
ror edi, 0xd
nop
add edi, eax
nop
jmp 0x40ae2d
cmp al, ah
jne 0x40ae01
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
nop
jmp 0x40ae4b
jne 0x40adb4
nop
nop
jmp 0x40ae5f
pop eax
nop
jmp 0x40ae70
mov ebx, dword [eax + 0x24]
nop
jmp 0x40ae7e
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
jmp 0x40ae91
mov ebx, dword [eax + 0x1c]
add ebx, edx
jmp 0x40aea0
mov eax, dword [ebx + ecx*4]
nop
add eax, edx
nop
jmp 0x40aeb1
mov dword [esp + 0x24], eax
jmp 0x40aebf
pop ebx
jmp 0x40aed4
pop ebx
nop
jmp 0x40aee9
popal
nop
jmp 0x40aefe
pop ecx
nop
pop edx
jmp 0x40af11
push ecx
jmp eax
jmp 0x40af29
pop eax
nop
pop edi
nop
jmp 0x40af3d
pop edx
nop
jmp 0x40af4d
mov edx, dword [edx]
jmp 0x40acbe
cwde
clc
inc ecx
das
clc
aaa
xchg edx, eax
aas
inc ecx
cwde
inc eax
aas
cmc
aas
stc
daa
inc eax
stc
dec eax
das
inc edx
inc ecx
daa
xchg ecx, eax
inc ebx
lahf
nop
cwde
inc eax
aas
cdq
xchg edx, eax
xchg ecx, eax
inc edx
nop
inc ebx
cld
dec ecx
daa
aas
stc
std
daa
aas
stc
xchg ebx, eax
cld
wait
aas
inc edx
std
dec eax
xchg edx, eax
dec ebx
std
xchg ebx, eax
aas
aaa
nop
wait
xchg edx, eax
cdq
aas
daa
xchg ecx, eax
jmp 0x40ac7e
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4aea460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4aea860]
xor edx, dword [ebx*4 + 0x4aeac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4aea460]
add ecx, 4
xor edx, dword [eax*4 + 0x4aeb060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4aea860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4aeac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4aea460]
add ecx, 4
xor eax, dword [edx*4 + 0x4aeb060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4aea860]
xor edx, dword [ebx*4 + 0x4aeac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4aea460]
xor edx, dword [eax*4 + 0x4aeb060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4aea860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4aeac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4aea460]
xor eax, dword [edx*4 + 0x4aeb060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4aea860]
xor edx, dword [ebx*4 + 0x4aeac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4aea460]
xor edx, dword [eax*4 + 0x4aeb060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4aea860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4aeac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4aea460]
and edx, 0xff
xor eax, dword [edx*4 + 0x4aeb060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4aea860]
xor edx, dword [ebx*4 + 0x4aeac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4aea460]
add ecx, 4
xor edx, dword [eax*4 + 0x4aeb060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4aea860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4aeac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4aea460]
and edx, 0xff
xor eax, dword [edx*4 + 0x4aeb060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x4aea860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x4aeac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4aea460]
and eax, 0xff
xor edi, dword [eax*4 + 0x4aeb060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4aea460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x402de2
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4151c4], 0
jne 0x402df0
call fcn.00402db8
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402e1d
test cl, 7
je 0x402e1d
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec esi
inc ecx
jmp 0x402dfe
cmp esi, 8
jb 0x402ea1
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4151c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec edi
jne 0x402e27
xor edx, edx
test esi, esi
jbe 0x402ec1
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4151c0]
inc edx
cmp edx, esi
jb 0x402ea8
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x403385
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00401200
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x403417
push esi
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407912
lea eax, [ebp - 0x800]
push eax
call fcn.0040af68
mov esi, eax
lea eax, [ebp - 0x800]
push eax
call fcn.004081ef
test al, al
jne 0x4033f3
lea eax, [ebp - 0x1000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040af68
lea esi, [esi + eax + 1]
mov eax, 0x104
pop edi
cmp esi, eax
pop esi
jbe 0x403417
push eax
push 0xaf
call fcn.0040a252
push eax
push 0x413300
call fcn.0040be6b
add esp, 0xc
leave
ret 8