joyce8/EMBER2024-capa huggingface dataset:
Function at 0x598fab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x598fc5
push dword [ebp + 0x14]
call fcn.005982da
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.00598315
fadd dword es:[0x10468e4]
add eax, 0x10468e4
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x599009
cmp dword [ebp - 0x398], 0
je 0x5991d3
cmp dword [ebp + 0xc], 1
je 0x5991d3
cmp dword [ebp + 0xc], 8
jne 0x59919b
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
call dword [eax - 1]
jne 0x599163
invalid
call fcn.00598315
sbb byte [ebx], bh
xor byte [ecx], 0x80
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.00598315
xchg esi, eax
pop ebx
jg 0x599156
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.005982f3
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00598325
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.005982da
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00598315
sbb bh, byte [edi + 0x46812e2]
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
lea eax, [ebp - 0x12c]
push eax
invalid
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x599021
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.00598325
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.005982da
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.00598315
mov bh, 0x52
pop edx
dec esi
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.005984f1
add esp, 0x14
call fcn.00598315
fisttp dword [esi - 0x4a00e6a4]
push 0x6afffff9
add edi, edi
mov ch, 0x8c
stc
invalid
Function at 0x5a57b2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005a5475

Function at 0x5a57bd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005a55f6

Function at 0x5abbe7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ab555

Function at 0x5abbf2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ab790

Function at 0x5b3500
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5b352d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5b352d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403530
Capabilities:
Terminate process

Disassembly:
jmp 0x559019
push 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x559029
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.0040589e
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403657
Capabilities:
Query environment variable

Disassembly:
jmp 0x5a1853
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5a1867
xor edi, edi
jmp 0x5a189e
push ebx
push esi
call fcn.005a175c
sub eax, esi
sar eax, 1
lea ebx, [eax + eax]
push ebx
call fcn.00403f3f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5a188e
push ebx
push esi
push edi
call fcn.0040567d
add esp, 0xc
push 0
call fcn.004061b3
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40574f
Capabilities:
Parse pe header

Disassembly:
jmp 0x549332
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x549372
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x549372
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x549372
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x549372
cmp dword [ecx + 0x74], 0xe
jbe 0x549372
cmp dword [ecx + 0xe8], 0
je 0x549372
mov al, 1
ret
xor al, al
ret

Function at 0x445200
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [eax]
mov edx, dword [ebp - 0xc]
sbb edx, dword [eax + 4]
push 0
push 0x3e8
push edx
push ecx
call fcn.004025db
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x18]
push ecx
push edx
push eax
call fcn.00405f0b
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
je 0x44525e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4501f0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
cmp dword [ebp + 8], 0
je 0x45020d
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x45020d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x450217
mov eax, 0xffffaf00
jmp 0x45035e
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0xc]
jbe 0x45027d
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
add esp, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
call ecx
add esp, 0xc
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x18]
call ecx
add esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
mov dword [ebp + 0x10], ecx
lea edx, [ebp - 0x4c]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, dword [eax + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edx
push 0x36
mov eax, dword [ebp - 8]
push eax
call fcn.00403099
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push eax
push 0x5c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00403099
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4502d7
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x450319
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
jmp 0x4502ce
push 0x40
lea ecx, [ebp - 0x4c]
push ecx
call fcn.004505d0
add esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x453780
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x5ca3a8
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x45379f
cmp dword [ebp + 8], 0
jne 0x4537a3
xor eax, eax
jmp 0x4537f1
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x4537ef
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 4]
cmp ecx, dword [eax + 4]
jne 0x4537de
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call fcn.00402086
add esp, 0xc
test eax, eax
jne 0x4537de
mov eax, dword [ebp - 4]
jmp 0x4537f1
mov edx, dword [ebp - 4]
add edx, 0x18
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x4537a3
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x453800
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x5ca4f8
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x45381f
cmp dword [ebp + 8], 0
jne 0x453823
xor eax, eax
jmp 0x453871
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x45386f
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 4]
cmp ecx, dword [eax + 4]
jne 0x45385e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call fcn.00402086
add esp, 0xc
test eax, eax
jne 0x45385e
mov eax, dword [ebp - 4]
jmp 0x453871
mov edx, dword [ebp - 4]
add edx, 0x14
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x453823
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4835e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
jne 0x48372f
mov dword [ebp - 0x14], 0x101
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0x632b38
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0x103
jne 0x48366a
mov dword [ebp - 4], 0
jmp 0x48372f
cmp dword [ebp - 4], 0
jne 0x4836e0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040606e
add esp, 4
mov esi, eax
push 0x632b38
call fcn.0040606e
add esp, 4
lea ecx, [esi + eax + 2]
push ecx
call fcn.00402f8b
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
push 0x632b38
mov eax, dword [ebp + 0xc]
push eax
push str._s_s
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00406465
add esp, 0x10
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004835e0
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0040454d
add esp, 4
cmp dword [ebp - 4], 0
jne 0x48372a
push 0x632b38
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x483721
movsx ecx, byte [0x6297bb]
test ecx, ecx
jne 0x48371a
mov edx, dword [ebp + 0xc]
push edx
push str.Error_in_deleting_profile__s_in_the_registry_n
call fcn.0040220c
add esp, 8
mov eax, 0xb
jmp 0x48373c
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x483611
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4842d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREPublic_DomainBlat
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x484312
push str.Failed_to_open_registry_key_for_Blat_using_default._n
call fcn.004048b3
add esp, 4
jmp 0x4843f9
mov byte [0x6297bb], 0
mov edx, 1
imul eax, edx, 0
mov byte [eax + 0x632b38], 0
push str._default_
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004013e8
add esp, 8
test eax, eax
je 0x484352
push str._all_
mov edx, dword [ebp + 0xc]
push edx
call fcn.004013e8
add esp, 8
test eax, eax
jne 0x484363
push 0x5b7fd3
mov eax, dword [ebp + 8]
push eax
call fcn.00484120
add esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x101
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x632b38
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4843e5
push 0x632b38
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004013e8
add esp, 8
test eax, eax
je 0x4843d4
push str._all_
mov edx, dword [ebp + 0xc]
push edx
call fcn.004013e8
add esp, 8
test eax, eax
jne 0x4843e5
push 0x632b38
mov eax, dword [ebp + 8]
push eax
call fcn.00484120
add esp, 8
cmp dword [ebp - 4], 0
je 0x48436a
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x3f110c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x3f11b9
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0x3f1160
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x3f11a8
mov esi, dword [ebp - 4]
jns 0x3f1187
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x3f1197
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0x3f1169
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0x3f1140
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x3f11d2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov ebx, edx
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 0x18], ebx
push ebx
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0x3f1024]
lea eax, [ebx - 1]
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0x3f1254
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 1]
mov dword [ebp - 4], eax
sub edi, esi
lea ecx, [edi + eax]
mov eax, edx
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov al, byte [edx + esi]
mov esi, dword [ebp - 4]
mov byte [esi], al
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, 0xffffcfc7
mov byte [edx + esi], cl
imul edx, eax, 0xeeb9eb65
mov eax, dword [ebp - 4]
and edx, 0x7fffffff
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
dec ebx
jne 0x3f1214
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3f257c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498e0c], 1
mov ecx, 0xd45a
jne 0x3f2603
or dword [0x498e0c], 1
lea eax, [ecx + 0x25]
mov edx, eax
add eax, 0xffffff87
mov word [0x4929d4], ax
mov word [0x4929c8], dx
add edx, 0xffffff8f
lea eax, [ecx - 0x1c]
mov word [0x4929d6], ax
add eax, 0xfffffff1
mov word [0x4929d8], ax
mov word [0x4929ca], dx
lea edx, [ecx - 0x3b]
lea eax, [ecx - 0x23]
mov word [0x4929da], ax
mov word [0x4929cc], dx
add edx, 0xfffffff8
add eax, 0xfffffff3
mov word [0x4929dc], ax
lea eax, [ecx - 0x55]
mov word [0x4929de], ax
mov eax, ecx
mov word [0x4929ce], dx
mov dword [0x4929d0], 0xd47fd40a
mov word [0x4929e0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4929c8]
add eax, 2
mov word [eax + 0x493072], dx
cmp eax, 0x1a
jb 0x3f2605
mov eax, 0x493074
ret

Function at 0x3f2623
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498e04], 1
jne 0x3f2651
or dword [0x498e04], 1
mov dword [0x4929f0], 0x3e353766
mov dword [0x4929f4], 0x653f362f
mov dword [0x4929f8], 0x5a646565
xor eax, eax
mov cl, byte [eax + 0x4929f0]
xor cl, 0x5a
mov byte [eax + 0x49309c], cl
inc eax
cmp eax, 0xc
jb 0x3f2653
mov eax, 0x49309c
ret

Function at 0x3f266e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498e00], 1
mov edx, 0xd45a
jne 0x3f272e
push esi
lea ecx, [edx + 0x1e]
mov eax, ecx
mov word [0x4929fc], ax
add eax, 2
or dword [0x498e00], 1
mov word [0x4929fe], ax
lea eax, [edx + 0x1d]
mov esi, eax
mov word [0x492a00], si
mov word [0x492a02], ax
add eax, 0xffffffc2
mov word [0x492a04], ax
lea eax, [edx - 0x32]
mov esi, eax
mov word [0x492a06], si
add esi, 0x13
mov word [0x492a08], si
lea esi, [edx - 0x31]
mov word [0x492a0a], si
add esi, 9
mov word [0x492a0c], si
lea esi, [edx - 0x55]
mov word [0x492a0e], si
mov esi, eax
mov word [0x492a10], si
add esi, 0x17
add eax, 6
mov word [0x492a12], si
lea esi, [edx - 0x30]
mov word [0x492a1a], ax
mov eax, edx
mov word [0x492a14], si
mov dword [0x492a16], 0xd428d435
mov dword [0x492a1c], 0xd478d467
mov word [0x492a20], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4929fc]
add eax, 2
mov word [eax + 0x4930a6], cx
cmp eax, 0x26
jb 0x3f2730
mov eax, 0x4930a8
ret
Function at 0x3f2811
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0x498dfc], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0xd45a
jne 0x3f284f
or dword [0x498dfc], 1
lea eax, [ecx - 0x2d]
mov word [0x492a24], ax
add eax, 0xb
mov word [0x492a26], ax
mov eax, ecx
mov word [0x492a28], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x492a24]
add eax, 2
mov word [eax + 0x4930ce], dx
cmp eax, 6
jb 0x3f2853
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x3f2876
mov eax, dword [eax]
push 0x4930d0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043b957
add esp, 0xc
test eax, eax
jne 0x3f2941
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.003f35a4
push dword [esp + 0x10]
call fcn.003f294a
push eax
call fcn.0043beb1
push dword [esp + 0x18]
call fcn.0043c43c
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.0043f010
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0x46a08c]
test eax, eax
jne 0x3f292f
call dword [0x46a0a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0041a8c0
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x3f2913
mov eax, dword [eax]
push eax
call fcn.003f298a
push eax
call fcn.0043c180
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.003f4ce6
jmp 0x3f2941
push dword [esp + 0x18]
mov esi, dword [0x46a0bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x3f294a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498df8], 1
jne 0x3f296d
or dword [0x498df8], 1
mov dword [0x492a2c], 0x141f5057
mov word [0x492a30], 0x5a1e
xor eax, eax
mov cl, byte [eax + 0x492a2c]
xor cl, 0x5a
mov byte [eax + 0x4930d8], cl
inc eax
cmp eax, 6
jb 0x3f296f
mov eax, 0x4930d8
ret

Function at 0x3f298a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498df4], 1
jne 0x3f2a0f
or dword [0x498df4], 1
mov dword [0x492a34], 0x36333b1c
mov dword [0x492a38], 0x2e7a3e3f
mov dword [0x492a3c], 0x28397a35
mov dword [0x492a40], 0x3f2e3b3f
mov dword [0x492a44], 0x3b28397a
mov dword [0x492a48], 0x287a3229
mov dword [0x492a4c], 0x28352a3f
mov dword [0x492a50], 0x7a283f2e
mov dword [0x492a54], 0x3935282a
mov dword [0x492a58], 0x6029293f
mov dword [0x492a5c], 0x50297f7a
mov byte [0x492a60], 0x5a
xor eax, eax
mov cl, byte [eax + 0x492a34]
xor cl, 0x5a
mov byte [eax + 0x4930e0], cl
inc eax
cmp eax, 0x2d
jb 0x3f2a11
mov eax, 0x4930e0
ret