joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b76e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00406be0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b809
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x415298]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40b809
cmp eax, 1
je 0x40b82a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b809
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40b7d6
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40b805
xor eax, eax
inc eax
jmp 0x40b849
cmp edi, eax
jae 0x40b80d
xor eax, eax
jmp 0x40b849
cmp eax, esi
jae 0x40b814
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x415298]
jmp 0x40b82d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bf53
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x4122e0
call fcn.00404484
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x4155b8], edi
jne 0x40bf97
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40bf82
mov dword [0x4155b8], ebx
jmp 0x40bf97
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x40bf97
mov dword [0x4155b8], 2
mov eax, dword [0x4155b8]
cmp eax, ebx
jne 0x40bfb7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x40c07a
cmp eax, 2
je 0x40bfc0
cmp eax, edi
jne 0x40bfe8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x40bfd3
mov eax, dword [0x4154b0]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x40bfef
xor eax, eax
jmp 0x40c07a
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.00406be0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x40c022
cmp esi, edi
jne 0x40c038
push dword [ebp - 0x20]
call fcn.004031fe
pop ecx
mov esi, eax
cmp esi, edi
je 0x40bfe8
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x40c06b
cmp dword [ebp + 0x14], edi
jne 0x40c055
push edi
push edi
jmp 0x40c05b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x40c077
push esi
call fcn.004045d9
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.004044bf
ret
Function at 0x40c083
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x4122f0
call fcn.00404484
xor esi, esi
cmp dword [0x4155bc], esi
jne 0x40c0c7
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40c0b2
mov dword [0x4155bc], edi
jmp 0x40c0c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x40c0c7
mov dword [0x4155bc], 2
mov eax, dword [0x4155bc]
cmp eax, 2
je 0x40c1a8
cmp eax, esi
je 0x40c1a8
cmp eax, 1
jne 0x40c10c
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x40c0f5
mov eax, dword [0x4154b0]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x40c113
xor eax, eax
jmp 0x40c1ba
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.00406be0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x40c149
cmp edi, esi
jne 0x40c164
lea eax, [ebx + ebx]
push eax
call fcn.004031fe
pop ecx
mov edi, eax
cmp edi, esi
je 0x40c10c
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40c197
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x40c181
push esi
push esi
jmp 0x40c187
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x40c1a3
push edi
call fcn.004045d9
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x40c1ba
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.004044bf
ret
Function at 0x40f0dd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x40f2b1
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x416a20]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x40f2b1
test cl, 0x48
je 0x40f148
cmp byte [eax + 5], 0xa
je 0x40f148
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f19a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x40f182
call fcn.00407928
mov dword [eax], 9
call fcn.00407931
mov dword [eax], esi
jmp 0x40f192
cmp eax, 0x6d
je 0x40f2b1
push eax
call fcn.0040793a
pop ecx
or eax, 0xffffffff
jmp 0x40f2b3
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x40f2ac
test eax, eax
je 0x40f1c1
cmp byte [ebx], 0xa
jne 0x40f1c1
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40f1ca
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x40f2a6
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x40f296
cmp al, 0xd
je 0x40f1fc
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x40f288
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x40f216
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x40f211
add dword [ebp + 0x10], 2
jmp 0x40f26a
mov dword [ebp + 0x10], eax
jmp 0x40f284
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f23e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40f284
cmp dword [ebp - 0xc], 0
je 0x40f284
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40f25f
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40f26a
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40f287
cmp ebx, dword [ebp + 0xc]
jne 0x40f26f
cmp byte [ebp - 1], 0xa
jne 0x40f26f
mov byte [ebx], 0xa
jmp 0x40f287
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00406c1d
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x40f288
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x40f1e0
jmp 0x40f2a6
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x40f2a6
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x40f2b3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b130
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov eax, esi
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 7
jbe 0x40b14c
mov eax, dword [esi]
xor ecx, ecx
push ecx
push ecx
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
test eax, eax
je 0x40b18a
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0040ea48
add esp, 4
mov ebx, eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x40b1bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x40b1b2
test eax, eax
jle 0x40b1a3
movzx eax, ax
or eax, 0x80070000
push eax
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.00406ff0
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov ecx, esi
call fcn.004080a0
push ebx
call fcn.0040ea43
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40fab5
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40fab8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
pushal
pushal
jmp 0x40fad6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40fb34
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40fb1b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40fb24
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40fb2e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40fb10
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x40fa9a
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x40fb18
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40fab8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
pushal
pushal
jmp 0x40fad6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40fb34
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40fb1b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40fb24
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40fb2e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40fb10
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x40fa9a
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x4102c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
Function at 0x4102df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040f3bf
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040f3f1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f3a6
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040f3e1
mov ecx, 0x687a5738
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.0040f3e1
loope 0x410452
add al, byte [eax - 0x7fff1f9b]
loope 0x410403
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.0040f3f1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f3a6
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x41048d
out dx, eax
invalid
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x4104ad
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x4104ca
Function at 0x410340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040f3bf
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040f3f1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f3a6
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040f3e1
mov ecx, 0x687a5738
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.0040f3e1
loope 0x410452
add al, byte [eax - 0x7fff1f9b]
loope 0x410403
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.0040f3f1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f3a6
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x41048d
out dx, eax
invalid
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x4104ad
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x4104ca

Function at 0x411a60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411a8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411a8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x283548
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x30]
mov eax, 0x29d940
push ebp
push esi
push edi
push dword [esp + 0x44]
push dword [esp + 0x44]
push ebx
push dword [esp + 0x44]
push edx
push eax
call fcn.0028621e
push ebx
push eax
call fcn.0028621e
mov dword [esp + 0x44], 0x3ece4f
xor edi, edi
mov dword [esp + 0x48], 0x244da6
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x38], 0xbf01
imul eax, dword [esp + 0x38], 0x51
mov dword [esp + 0x38], eax
xor dword [esp + 0x38], 0x3c3f23
mov dword [esp + 0x34], 0x6472
add dword [esp + 0x34], 0xffff36d3
xor dword [esp + 0x34], 0xffffef10
mov dword [esp + 0x30], 0xe6ec
add dword [esp + 0x30], 0x4fb8
xor dword [esp + 0x30], 0x55db56bf
add dword [esp + 0x30], 0xb9d9
xor dword [esp + 0x30], 0x55db1a1b
mov eax, dword [0x29d940]
mov edx, dword [0x29d944]
xor edx, eax
mov dword [esp + 0x3c], eax
mov eax, edx
mov dword [esp + 0x40], edx
and eax, 0xfffffffc
mov ecx, edx
add eax, 4
mov esi, edx
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
add esp, 0x18
mov eax, dword [esp + 0x20]
mov edx, esi
call fcn.00287d07
mov ebp, eax
pop ecx
pop ecx
test ebp, ebp
je 0x28366e
shr esi, 2
mov edx, 0x29d948
xor eax, eax
lea ecx, [esi*4 + 0x29d948]
mov esi, ecx
sub esi, edx
add esi, 3
shr esi, 2
cmp ecx, edx
cmovb esi, eax
test esi, esi
je 0x283664
mov ecx, ebp
sub ecx, edx
mov eax, dword [edx]
xor eax, dword [esp + 0x1c]
inc edi
mov dword [ecx + edx], eax
lea edx, [edx + 4]
cmp edi, esi
jb 0x283653
test ebx, ebx
je 0x28366e
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x283c7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ebx, edx
inc ebp
push ebp
push dword [esp + 0x64]
push dword [esp + 0x64]
push dword [esp + 0x64]
push ebp
push ebx
push ecx
call fcn.0028621e
mov dword [esp + 0x60], 0x3786e1
xor esi, esi
mov dword [esp + 0x64], 0x6954ba
add esp, 0x1c
mov dword [esp + 0x4c], esi
xor edx, edx
mov dword [esp + 0x10], 0x359
mov ecx, 0x2574357e
shl dword [esp + 0x10], 8
add dword [esp + 0x10], 0xffff7d74
imul eax, dword [esp + 0x10], 0xa
push 0x1f
pop edi
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x1c1d99
mov dword [esp + 0x38], 0xd0de
mov eax, dword [esp + 0x38]
div edi
mov dword [esp + 0x38], eax
xor dword [esp + 0x38], 0x794
mov dword [esp + 0x1c], 0xce9
add dword [esp + 0x1c], 0xad1
add dword [esp + 0x1c], 0xffff935a
xor dword [esp + 0x1c], 0xffffb322
mov dword [esp + 0x34], 0x79d
xor dword [esp + 0x34], 0x20cc0fb6
xor dword [esp + 0x34], 0x20cc22a6
mov dword [esp + 0x30], 0x698c
add dword [esp + 0x30], 0xe9d4
xor dword [esp + 0x30], 0x13dbc
mov dword [esp + 0x14], 0xc6a
shr dword [esp + 0x14], 0xa
add dword [esp + 0x14], 0xffffe6be
shl dword [esp + 0x14], 2
xor dword [esp + 0x14], 0xffffa310
mov dword [esp + 0x3c], 0x2350
add dword [esp + 0x3c], 0xa4db
xor dword [esp + 0x3c], 0xc2d5
mov dword [esp + 0x24], 0xfe5
add dword [esp + 0x24], 0xffff72d2
add dword [esp + 0x24], 0xfffff704
xor dword [esp + 0x24], 0xffff6d21
mov dword [esp + 0x20], 0x11b5
shl dword [esp + 0x20], 2
add dword [esp + 0x20], 0xfffff1b3
xor dword [esp + 0x20], 0x3b7a
mov dword [esp + 0x2c], 0xeb07
shr dword [esp + 0x2c], 0xb
or dword [esp + 0x2c], 0x3be8e7a4
xor dword [esp + 0x2c], 0x3be88f92
mov dword [esp + 0x18], 0x1f1a
add dword [esp + 0x18], 0xffff032f
shr dword [esp + 0x18], 6
or dword [esp + 0x18], 0x64ca0553
xor dword [esp + 0x18], 0x67ffa598
mov dword [esp + 0x28], 0x9bd9
shr dword [esp + 0x28], 8
add dword [esp + 0x28], 0xffff3091
xor dword [esp + 0x28], 0xffff45ba
mov edi, dword [esp + 0x40]
cmp ecx, 0x9e98051
je 0x283ecf
cmp ecx, 0x2574357e
je 0x283ec5
cmp ecx, 0x282704b2
je 0x283eab
cmp ecx, 0x32e98f77
je 0x283e81
cmp ecx, 0x3aa6c900
jne 0x283efd
push dword [esp + 0x28]
push dword [esp + 0x1c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x48]
call fcn.0028bc28
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
lea eax, [esp + 0x40]
mov ecx, edi
push eax
push dword [esp + 0x34]
push dword [esp + 0x3c]
push dword [esp + 0x28]
mov edx, dword [esp + 0x48]
call fcn.00282f33
add esp, 0x10
test eax, eax
je 0x283e77
mov ecx, 0x9e98051
jmp 0x283e2c
mov eax, dword [esp + 0x10]
call fcn.0029281f
mov edi, eax
cmp edi, 0xffffffff
je 0x283e77
mov ecx, 0x32e98f77
jmp 0x283e2c
mov ecx, 0x282704b2
jmp 0x283e2c
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebp
push ecx
push ebx
push ebp
push dword [esp + 0x54]
mov edx, dword [esp + 0x30]
push dword [esp + 0x78]
mov ecx, dword [esp + 0x60]
call fcn.0029b7b5
add esp, 0x20
mov ecx, 0x3aa6c900
test eax, eax
cmovne esi, ebp
cmp ecx, 0x7f8d9d0
jne 0x283e2c
jmp 0x283e77