joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b920
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x442ef8]
mov dword [esp + 8], 0x9550b37
mov dword [esp + 0xc], 0x5760778
mov dword [esp + 0x10], 0x17d0358
mov dword [esp + 0x14], 0x1d611f8c
mov dword [esp + 0x18], 0x197e1b27
mov dword [esp + 0x1c], 0x156e1774
mov dword [esp + 0x20], 0x1160139f
mov dword [esp + 0x24], 0x2d552f6c
mov dword [esp + 0x28], 0x29542ba2
mov dword [esp + 0x2c], 0x25a8275f
mov dword [esp + 0x30], 0x21462358
mov dword [esp + 0x34], 0x3db03f70
mov dword [esp + 0x38], 0x39403b4d
mov dword [esp + 0x3c], 0x3542374f
mov dword [esp + 0x40], 0x31bf334f
mov word [esp + 0x44], 0x4f30
mov dword [esp + 0x46], 0
mov word [esp + 0x4a], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x43
ja 0x41ba00
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0x87c79683
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x71
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x44
jb 0x41b9d0
lea ebx, [esp + 0x4c]
lea edi, [esp + 8]
push ebx
push 0
push 0
push 0x1e
push edi
push 0
call eax
mov ebp, dword [esp + 0x4c]
test ebp, ebp
jns 0x41ba23
mov eax, 0xffffffff
jmp 0x41ba2a
lea eax, [ebp*2]
push eax
call fcn.004097d0
add esp, 4
mov esi, eax
mov eax, dword [0x442ef8]
mov dword [esp + 8], 0x99559bb7
mov dword [esp + 0xc], 0xa556a768
mov dword [esp + 0x10], 0xa14da368
mov dword [esp + 0x14], 0xad41af5c
mov dword [esp + 0x18], 0xa94eab87
mov dword [esp + 0x1c], 0xb55eb774
mov dword [esp + 0x20], 0xb140b34f
mov dword [esp + 0x24], 0xbd55bf5c
mov dword [esp + 0x28], 0xb954bb42
mov dword [esp + 0x2c], 0x45b8474f
mov dword [esp + 0x30], 0x41a643a8
mov dword [esp + 0x34], 0x4db04f90
mov dword [esp + 0x38], 0x49a04bbd
mov dword [esp + 0x3c], 0x55a257bf
mov dword [esp + 0x40], 0x51af53bf
mov word [esp + 0x44], 0x5f50
mov dword [esp + 0x46], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x41
ja 0x41bb00
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0x686b85b
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x39
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x42
jb 0x41bad0
push ebx
push ebp
push esi
push 0x1e
push edi
push 0
call eax
mov dword [esp + 8], 0x9f76994c
mov dword [esp + 0xc], 0xa3509d69
mov dword [esp + 0x10], 0xa743a144
mov dword [esp + 0x14], 0xab4ca552
mov dword [esp + 0x18], 0xaf58a941
mov dword [esp + 0x1c], 0xb3b2ad48
mov byte [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x18
ja 0x41bb7e
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xd316ed5a
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x3e
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x19
jb 0x41bb50
push 0
push 0
push edi
push esi
push dword [esp + 0x74]
call fcn.00416390
add esp, 0x14
jmp dword [0x43e5ac]
Function at 0x41e590
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0041e5b0
add esp, 4
test al, al
je 0x41ed10
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xac
xor esi, esi
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x43ed40]
Function at 0x42bda0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.004187a0
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
jmp 0x42bdb8
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42bddb
jmp 0x42bf06
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42be17
jmp 0x42bf00
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.00409910
add esp, 4
mov edx, eax
xor ebx, ebx
cmp edx, 0
je 0x42bef1
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov byte [esi], 0x31
mov byte [esi + 1], 0x6f
mov byte [esi + 2], 0x6d
mov byte [esi + 3], 0x69
mov byte [esi + 4], 0x16
mov byte [esi + 5], 0x76
mov byte [esi + 6], 9
mov byte [esi + 7], 0x7b
mov byte [esi + 8], 8
mov byte [esi + 9], 0x31
mov byte [esi + 0xa], 0x7e
mov byte [esi + 0xb], 0x79
mov byte [esi + 0xc], 0x7c
mov byte [esi + 0xd], 0xef
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x12
jne 0x42be85
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x12
jae 0x42becf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov edi, edx
call fcn.0042c280
mov edx, edi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x42be98
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040a150
mov bl, al
and bl, 1
jmp 0x42beef
jmp 0x42bef1
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42f760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x42f780
mov dword [esp + 4], 0xdedadc51
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 3
ja 0x42f7e0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add esi, 0x68d897cf
xor esi, edi
mov dword [esp + 8], esi
mov ebx, dword [esp + 8]
add bl, 0xf5
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 4
jb 0x42f7b0
test edx, edx
je 0x42f84e
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x42f811
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x42f800
cmp edi, 3
jb 0x42f84e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x42f820
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4304e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [esp + 0x1c]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x4c]
call fcn.00437a10
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4406f8]
Function at 0x433690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x383b3a3d
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x4336fb
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xe0005f8b
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, eax
not ecx
and ecx, 0xb7
and eax, 0x48
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x4336c0
mov edi, dword [esp + 4]
mov eax, dword [0x442efc]
test eax, eax
je 0x433746
xor ecx, ecx
mov edx, dword [0x442f00]
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x433720
inc ecx
cmp eax, ecx
jne 0x433710
jmp 0x433746
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x433746
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x442f04]
push eax
call fcn.00435810
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x433895
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.00433570
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x383b3a3d
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x4337cc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0xe0005f8b
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov esi, edx
not esi
and esi, 0xb7
and edx, 0x48
sub edx, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x433790
mov edi, dword [esp + 4]
mov edx, dword [0x442efc]
test edx, edx
je 0x433826
xor ebx, ebx
mov ebp, dword [0x442f00]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x433801
inc ebx
cmp edx, ebx
jne 0x4337f0
jmp 0x433826
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x433826
push 0
push ecx
push eax
push 5
push 4
push dword [0x442f04]
push edx
mov esi, eax
call fcn.00435810
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43388c
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x433865
add ebx, 2
cmp bp, si
je 0x433850
cmp bp, si
je 0x433877
mov ebx, dword [edx]
test ebx, ebx
jne 0x433840
mov edi, 0xc0000225
jmp 0x43388c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.00433600
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4338d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 4]
test edx, edx
je 0x4339c0
xor eax, eax
cmp dword [ecx], 0
jne 0x433a17
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x383b3a3d
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43398b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add eax, 0xe0005f8b
xor eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov edx, eax
not edx
and edx, 0xb7
and eax, 0x48
sub eax, edx
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x433950
mov eax, dword [esp + 0xc]
mov esi, dword [0x442efc]
test esi, esi
je 0x433a17
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x442f00]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x433a20
inc edi
cmp esi, edi
jne 0x4339b0
jmp 0x433a17
mov dword [esp + 0x14], 0xff3e3930
mov word [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x433a13
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x1440a
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xce
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x4339e0
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x433a17
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x442f04]
push esi
call fcn.00435810
add esp, 0x1c
jmp 0x433a17

Function at 0x433a50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x433b21
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x383b3a3d
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x433abc
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0xe0005f8b
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov esi, edx
not esi
and esi, 0xb7
and edx, 0x48
sub edx, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x433a80
mov edx, dword [0x442efc]
test edx, edx
je 0x433b0e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x442f00]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x433af0
inc edi
cmp edx, edi
jne 0x433ae0
jmp 0x433b0e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x433b0e
push eax
push 1
push dword [0x442f04]
push edx
mov esi, ecx
call fcn.00435810
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x433b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 4], 0
je 0x433bea
mov edx, dword [ecx]
test edx, edx
je 0x433bea
mov dword [esp + 4], 0x383b3a3d
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x433bab
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0xe0005f8b
xor eax, esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov esi, eax
not esi
and esi, 0xb7
and eax, 0x48
sub eax, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x433b70
mov edi, dword [ebp + 0x10]
mov eax, dword [esp + 4]
mov ebx, dword [0x442efc]
test ebx, ebx
je 0x433c81
xor edi, edi
mov esi, dword [0x442f00]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xc766965c
je 0x433c5d
inc edi
cmp ebx, edi
jne 0x433bd0
mov edi, dword [ebp + 0x10]
jmp 0x433c81
mov dword [esp + 4], 0x793a3b34
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x433c54
nop
nop
nop
mov ecx, dword [esp]
mov eax, dword [esp]
movzx edx, byte [esp + eax + 4]
add ecx, 0x689815cb
mov eax, ecx
and eax, edx
xor ecx, edx
sub ecx, eax
lea ecx, [ecx + eax*2]
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 9
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x433c10
mov eax, dword [esp + 4]
jmp 0x433d82
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x433c81
push dword [ebp + 8]
push edx
push 2
push dword [0x442f04]
push esi
mov esi, ecx
call fcn.00435810
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x433d75
cmp eax, 0xc000010a
jne 0x433d75
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov dword [esp + 4], 0x383b3a3d
mov byte [esp + 8], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 4
ja 0x433d1e
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0xc]
movzx esi, byte [esp + esi + 4]
add eax, 0xe0005f8b
xor eax, esi
mov dword [esp], eax
mov eax, dword [esp]
mov esi, eax
not esi
and esi, 0xb7
and eax, 0x48
sub eax, esi
mov esi, dword [esp + 0xc]
mov byte [esp + esi + 4], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 5
jb 0x433ce0
mov eax, dword [esp + 4]
mov esi, dword [0x442efc]
test esi, esi
je 0x433d75
xor edi, edi
mov ebx, dword [0x442f00]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e28bda7
je 0x433d50
inc edi
cmp esi, edi
jne 0x433d40
jmp 0x433d75
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x433d75
lea eax, [esp + 0x10]
push eax
push 0
push edx
push 3
push dword [0x442f04]
push esi
mov esi, ecx
call fcn.00435810
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x433d82
mov esi, eax
call fcn.00433a50
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x433d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edx, dword [esp + 0x34]
mov ecx, dword [ecx]
mov dword [esp + 4], 0x383b3a3d
mov byte [esp + 8], 0
test edx, edx
jne 0x433db2
lea edx, [esp + 0x10]
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x433e0b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0xe0005f8b
xor eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esi, eax
not esi
and esi, 0xb7
and eax, 0x48
sub eax, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x433dd0
mov eax, dword [esp + 4]
mov ebp, dword [0x442efc]
test ebp, ebp
je 0x433e64
mov ebx, dword [esp + 0x30]
xor esi, esi
mov edi, dword [0x442f00]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x3baba5e0
je 0x433e40
inc esi
cmp ebp, esi
jne 0x433e30
jmp 0x433e64
mov ebp, dword [edi + esi*8 + 4]
cmp ebp, eax
je 0x433e64
push edx
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push ecx
push 5
push dword [0x442f04]
push ebp
call fcn.00435810
add esp, 0x20
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x435730
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x440f68]
Function at 0x436990
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 8], 0x393a3b6c
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x4369ee
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x1440b
xor eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0xc9
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x4369c0
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x30], 0
sete cl
jmp dword [ecx*4 + 0x44171c]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp + 4], 0
mov esi, dword [case.0x4369ff.6]
mov edi, dword [edx]
xor eax, eax
cmp edi, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x441724]
jmp esi
mov ebp, dword [edi + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov dword [esp + 0x14], 1
jmp dword [eax*4 + 0x44173c]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [0x44175c]
nop
nop
jmp eax

Function at 0x436c90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0xb18e8fdc
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x436cee
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0xebeb411d
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x6f
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x436cc0
mov edx, dword [esp + 4]
jmp dword [0x44178c]
Function at 0x436eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, dword [ebp + 8]
push eax
push eax
mov eax, esp
movzx ecx, word [edi]
mov dword [ebp - 0x20], 0x514e9583
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
cmp edx, 7
ja 0x436f0e
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
movzx esi, byte [ebp + esi - 0x20]
add edx, 0x4700af8d
xor edx, esi
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x14]
add dl, 0x3f
mov esi, dword [ebp - 0x10]
mov byte [ebp + esi - 0x20], dl
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb case.default.0x436f16
xor edx, edx
cmp dword [ebp - 0x20], ecx
setne dl
jmp dword [edx*4 + 0x44180c]
mov ecx, dword [edi + 0x3c]
mov edx, dword [edi + ecx]
mov dword [eax], 0xd1ce889c
mov byte [eax + 4], 0
mov dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x14]
cmp esi, 4
ja 0x436f6c
nop
nop
nop
nop
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
movzx edi, byte [eax + edi]
add esi, 0xe99b74d
xor esi, edi
mov dword [ebp - 0x20], esi
mov ebx, dword [ebp - 0x20]
add bl, 0x7f
mov esi, dword [ebp - 0x14]
mov byte [eax + esi], bl
inc dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
cmp esi, 5
jb 0x436f40
xor ebx, ebx
cmp edx, dword [eax]
setne bl
xor eax, eax
mov edi, dword [ebp + 8]
jmp dword [ebx*4 + 0x441824]
mov edx, dword [case.0x436f78.4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
mov ebx, dword [edi + ecx + 0x78]
mov esi, dword [edi + ecx + 0x7c]
test esi, esi
sete cl
test ebx, ebx
sete dl
or dl, cl
movzx ecx, dl
mov dword [ebp - 0x28], ebx
jmp dword [ecx*4 + 0x44183c]
mov ecx, dword [case.0x436f78.1]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x402e2e
call fcn.00402c70
push ebx
push 0xa
push 0x65
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
xor ebx, ebx
cmp eax, ebx
je 0x40102c
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
jne 0x401033
xor eax, eax
jmp 0x40114a
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push 0x18
mov dword [0x405148], esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x18
push ebx
push eax
mov dword [0x405144], eax
call sub.MSVCRT.dll_memset
push dword [esi + 0x2d]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [0x405144]
add esp, 0x14
mov dword [ecx], eax
mov eax, dword [esi + 0x25]
push dword [esi + 0x29]
add eax, esi
push eax
mov eax, dword [0x405144]
push dword [esi + 0x2d]
push dword [eax]
call fcn.004013a2
mov ecx, dword [0x405144]
mov eax, dword [esi + 0x2d]
push 0x104
mov dword [ecx + 8], eax
mov eax, dword [0x405144]
mov dword [eax + 4], ebx
push dword [0x405138]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x31], ebx
je 0x401108
push edi
mov edi, dword [esi + 0x39]
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x4010cd
mov ecx, eax
call fcn.00401cd7
jmp 0x4010cf
xor eax, eax
or dword [ebp - 4], 0xffffffff
push edi
mov dword [0x40514c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ebx, eax
mov eax, dword [esi + 0x31]
push dword [esi + 0x35]
add eax, esi
push eax
push edi
push ebx
call fcn.004013a2
mov ecx, dword [0x40514c]
push edi
push ebx
call fcn.00401d08
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor ebx, ebx
pop edi
mov eax, dword [esi + 0x15]
cmp eax, ebx
je 0x401114
add eax, esi
mov dword [esi + 0x15], eax
mov eax, dword [esi + 0x19]
cmp eax, ebx
je 0x401120
add eax, esi
mov dword [esi + 0x19], eax
mov eax, dword [esi + 0x1d]
cmp eax, ebx
je 0x40112b
add eax, esi
jmp 0x401130
mov eax, dword [str.Microsoft_Visual_FoxPro]
mov dword [esi + 0x1d], eax
mov eax, dword [esi + 0x21]
cmp eax, ebx
je 0x40113e
add eax, esi
jmp 0x401143
mov eax, dword [str.Cannot_locate_the_Microsoft_Visual_FoxPro_support_library.]
push 1
mov dword [esi + 0x21], eax
pop eax
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret