joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ed9f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 4
mov eax, 0x1023522
call fcn.01022c81
push 0x10084b0
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x101edd1
mov eax, 0x80004005
jmp 0x101ee55
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x101edc7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x101edc7
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, ebx
je 0x101edc7
mov dword [ebp + 8], ebx
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
mov edx, edi
mov byte [ebp - 4], 1
call fcn.0101f9b8
test eax, eax
jge 0x101ee27
mov byte [ebp - 4], bl
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x101edc7
add eax, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x101edc7
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
add esi, 8
mov eax, dword [esi]
push 0x1001e14
push esi
call dword [eax]
mov edi, eax
mov byte [ebp - 4], bl
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp edi, ebx
jge 0x101ee53
mov eax, edi
jmp 0x101ee55
xor eax, eax
call fcn.01022d35
ret 0xc

Function at 0x102003a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x102b004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0101ff7b
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10200ad
cmp dword [ebp - 0x94], 5
jb 0x10200ce
jmp 0x10200ca
cmp dword [ebp - 0x88], 1
jne 0x10200ce
cmp dword [ebp - 0x94], 4
ja 0x10200ca
jne 0x10200ce
cmp dword [ebp - 0x90], 0
jbe 0x10200ce
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10016a0
call fcn.0100a177
test eax, eax
jge 0x10200ef
mov byte [0x102c5d0], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0102045a
leave
ret
Function at 0x1020fce
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [0x102ba68], ebx
jne 0x10210a6
cmp dword [0x102ba64], ebx
jne 0x10210a6
push esi
cmp dword [0x102ba70], ebx
je 0x1021094
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x102ba88]
cmp esi, ebx
je 0x102101c
mov edx, dword [0x102ba8c]
mov ecx, eax
sub ecx, edx
cmp ecx, esi
jb 0x1021094
mov ecx, dword [0x102b0a8]
cmp ecx, 0xffffffff
je 0x1021030
sub eax, ecx
cmp eax, 0xc8
jb 0x102109e
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
push 3
mov esi, 0x113
push esi
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
mov dword [0x102ba68], 1
call edi
push 3
push esi
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call edi
push ebx
push ebx
push 0x8000
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x102ba64], eax
mov dword [0x102ba68], ebx
pop edi
cmp eax, ebx
jne 0x1021087
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102b0a8], eax
jmp 0x102109e
mov dword [0x102ba64], 1
mov eax, dword [0x102ba64]
pop esi
jmp 0x10210a8
xor eax, eax
pop ebx
leave
ret 4
Function at 0x10210f0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [0x102ba60], esi
jne 0x102117a
cmp dword [0x102ba64], esi
jne 0x102117a
cmp edi, 0x10
je 0x1021260
cmp edi, 0x8000
je 0x102123d
cmp dword [0x102ba68], esi
jne 0x102117a
mov eax, 0x104
cmp edi, eax
ja 0x102118f
je 0x10211d2
cmp edi, 0x18
je 0x102116f
cmp edi, 0x1c
je 0x102116b
cmp edi, 0x20
je 0x102115f
cmp edi, 0x48
je 0x102115a
cmp edi, 0x100
jmp 0x10211d0
cmp ebx, 3
jmp 0x10211d0
push esi
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
inc eax
jmp 0x1021188
cmp ebx, esi
jmp 0x10211d0
cmp ebx, esi
je 0x102117a
push esi
call dword [sym.imp.USER32.dll_SetCursor]
push dword [ebp + 0x14]
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, edi
sub eax, 0x200
je 0x10211e1
dec eax
je 0x10211d2
sub eax, 3
je 0x10211d2
sub eax, 3
je 0x10211d2
sub eax, 0x11
jne 0x102117a
cmp ebx, esi
je 0x1021166
cmp ebx, 5
jbe 0x10211d2
cmp ebx, 8
jbe 0x10211cc
cmp ebx, 0xa
je 0x102117a
cmp ebx, 0x12
je 0x10211cc
cmp ebx, 0x8013
jne 0x10211d2
jmp 0x102117a
test byte [ebp + 0x14], 1
jne 0x102117a
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x102117a
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 8]
sub ecx, dword [0x102c6a8]
je 0x10211fc
cmp ecx, esi
jge 0x10211fc
neg ecx
mov eax, dword [ebp - 4]
sub eax, dword [0x102c6ac]
je 0x102120d
cmp eax, esi
jge 0x102120d
neg eax
add eax, ecx
cmp eax, dword [0x102b0a4]
jbe 0x102117a
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 8]
mov dword [0x102c6a8], eax
mov eax, dword [ebp - 4]
mov dword [0x102c6ac], eax
jmp 0x102117a
cmp dword [0x102ba84], esi
je 0x102117a
mov eax, dword [0x102ba70]
cmp eax, esi
je 0x1021166
push dword [ebp + 8]
call eax
jmp 0x1021188
cmp dword [0x102ba84], esi
je 0x102117a
push dword [ebp + 8]
call fcn.01020fce
test eax, eax
jne 0x102117a
push 0x102c6a8
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
jmp 0x1021188
Function at 0x1021293
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x102ba84], esi
je 0x102133a
cmp dword [0x102ba6c], esi
je 0x10212b7
call fcn.010210b2
lea eax, [ebp - 4]
push eax
push 1
push esi
push 0x1001790
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102133a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.ScreenSaveUsePassword
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1021331
cmp dword [ebp - 0xc], esi
je 0x1021331
push str.PASSWORD.CPL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x102ba6c], eax
cmp eax, esi
je 0x1021331
push str.VerifyScreenSavePwd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x102ba70], eax
cmp eax, esi
je 0x102132c
push 1
call fcn.01020d3d
jmp 0x1021331
call fcn.010210b2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x1021be5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x102ba94], 0
push esi
jne 0x1021b53
call fcn.01021a4a
test eax, eax
je 0x1021b96
mov eax, dword [0x102ba94]
cmp eax, 1
jne 0x1021b74
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1021b96
pop esi
ret
push eax
call dword [0x102ba9c]
test eax, eax
jne 0x1021bde
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1021b9a
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x102ba94]
call dword [0x102ba9c]
mov edi, eax
test edi, edi
je 0x1021bbf
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1021bdb
mov edi, esi
add esi, 0xff0
push edi
push dword [0x102ba94]
call dword [0x102ba98]
add edi, 0x10
cmp edi, esi
jb 0x1021bc7
mov eax, edi
pop edi
pop esi
ret
jmp 0x1021b40
Function at 0x1022084
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x102b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
xor esi, esi
push esi
push dword [0x102b0b8]
xor edi, edi
push 0x80000002
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10221c7
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x10221ab
mov dword [ebp - 0x214], esi
cmp dword [ebp - 0x218], esi
jbe 0x10221b9
cmp edi, esi
jl 0x10221b9
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
mov dword [ebp - 0x220], 0x104
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1022183
mov ecx, dword [ebp - 0x21c]
push 4
lea eax, [ebp - 0x20c]
push eax
call fcn.01021f23
jmp 0x102218f
jle 0x102218f
and eax, 0xffff
or eax, 0x80070000
inc dword [ebp - 0x214]
mov edi, eax
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x218]
jb 0x1022115
jmp 0x10221b9
jle 0x10221b7
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10221d7
cmp eax, 2
jne 0x10221d0
xor edi, edi
jmp 0x10221d7
call fcn.01022031
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0102045a
leave
ret 4

Function at 0x10222c2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x102b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x1001a98
lea eax, [ebp - 0x61c]
push 0x208
push eax
mov byte [ebp - 0x62d], 0
call fcn.0100bf6a
add esp, 0x10
test eax, eax
jl 0x10223a2
and dword [ebp - 0x634], 0
lea eax, [ebp - 0x634]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10223a2
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x638]
push eax
push 0
push 0x10075bc
push dword [ebp - 0x634]
mov dword [ebp - 0x638], 1
mov dword [ebp - 0x63c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1022396
cmp dword [ebp - 0x638], 1
jne 0x1022396
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x1022396
mov byte [ebp - 0x62d], 1
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x62d]
xor ecx, ebp
call fcn.0102045a
leave
ret 4
Function at 0x1022797
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push ecx
push 0x102275c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x10227ef
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x10227df
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10227df
mov esi, dword [ebp - 4]
jmp 0x10227e6
call fcn.01022031
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10227f6
call fcn.01022031
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x2e40a6d
Capabilities:
Encode data using xor

Disassembly:
push dword [edi]
pop dword [esp + 8]
bt bx, cx
pushfd
cmp edi, ebx
call fcn.02e4d574
xchg ebp, eax
sahf
mov esi, 0x2f052d09
popal
xchg ebx, eax
xor esi, dword [ecx + ecx*8 + 0x5c3eee6c]
mov edi, 0x5d801af0
jg 0x2e40a7a
stosb byte es:[edi], al
fnstsw word [ebx + 0xde9325]
pushal
or ebp, dword [ecx + 0x40e5cd9c]
je 0x2e40b1c
mov eax, dword [0x47253810]
dec esp
insw word es:[edi], dx
mov eax, esp
adc byte [edi - 0x5f], bh
in al, dx
adc byte [esi + 0x572505de], bh
push esp
push 0x6c
add ax, 0x4d27
jae 0x2e40ab5
sbb eax, 0x2e868464
xchg ebx, eax
cli
std
test ah, bh
and dl, byte [edi - 0x6d]
adc bh, byte [esi]
sbb byte [eax + 0x6f], al
push ebx
enter 0x527e, 0x2d
fabs
stosd dword es:[edi], eax
sbb dword [eax + edi*2 - 0x45], ecx
or byte [ecx + edx*2], ch
jp 0x2e40abc
dec ecx
invalid
add eax, 0x5f4cd4ea
xchg ah, bl
add byte [eax + 0x2b], ah
dec edx
adc byte [ebp - 0x78], dl
sub al, 0x24
cmp ecx, dword [edx + 0x14]
call fcn.02e3ad3e
call fcn.038f0217

Function at 0x2e4d3d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol ax, 0xe
test dh, dl
mov eax, dword [ebp + 8]
cmp edi, 0xd624d274
cmc
stc
test eax, eax
push dword [esp]
mov byte [esp], dl
lea esp, [esp + 8]
je 0x2e42772
jmp 0x38ef116
xadd esi, edx
mov esi, dword [eax + 0x3c]
shl dl, 4
rcr dx, cl
add esi, eax
sbb dl, 5
sar dh, cl
and dh, ah
shld dx, cx, cl
mov edx, dword [esi + 0x78]
pushal
test ah, ah
test ah, 0xf2
jmp 0x38ef47d
Function at 0x3d33b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x3d33f0
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x3ddf2c]
test eax, eax
jne 0x3d3414
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0x522321a7
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3ddf2c], eax
call eax
mov ebx, eax
mov eax, dword [0x3ddaf8]
test eax, eax
jne 0x3d343c
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0xb27f9f0b
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3ddaf8], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x3d34f2
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x3d34e2
cmp ebx, 8
jb 0x3d34c7
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x3d3486
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x3d34c7
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x3d34a0
cmp edx, ebx
jae 0x3d34e2
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x3d34d0
mov edx, dword [esp + 0x18]
test edx, edx
je 0x3d34f0
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3d3560
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x3d3589
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x3ddf2c]
test eax, eax
jne 0x3d35ad
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0x522321a7
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3ddf2c], eax
call eax
mov edi, eax
mov eax, dword [0x3ddaf8]
test eax, eax
jne 0x3d35d5
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0xb27f9f0b
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3ddaf8], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x3d3655
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x3d364a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x3d3610
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x3d3660
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x3d368a
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x3ddf2c]
test eax, eax
jne 0x3d36ae
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0x522321a7
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3ddf2c], eax
call eax
mov edi, eax
mov eax, dword [0x3ddaf8]
test eax, eax
jne 0x3d36d6
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0xb27f9f0b
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3ddaf8], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x3d3742
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x3d373a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x3d3710
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x3d3c50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], 0xd417
xor dword [esp + 4], 0xfe7518b6
add dword [esp + 4], 0xffff66fd
xor dword [esp + 4], 0xfe75339e
mov dword [esp], 0xc20a
or dword [esp], 0xac700
shr dword [esp], 2
or dword [esp], 0x597d730f
xor dword [esp], 0x360881cc
or dword [esp], 0x27d50529
add dword [esp], 0xfc7f
xor dword [esp], 0x6ff873ac
push ebx
mov dword [esp + 4], 0x7ffe
mov ebx, ecx
shl dword [esp + 4], 9
xor dword [esp + 4], 0xfffc10
cmp byte [ebx], 0
je 0x3d3d5e
push esi
push edi
jmp 0x3d3cd0
mov edi, dword [esp + 0x10]
lea ebx, [ebx + 1]
mov dword [esp + 0xc], 0xc20a
or dword [esp + 0xc], 0xac700
shr dword [esp + 0xc], 2
or dword [esp + 0xc], 0x597d730f
xor dword [esp + 0xc], 0x360881cc
or dword [esp + 0xc], 0x27d50529
add dword [esp + 0xc], 0xfc7f
xor dword [esp + 0xc], 0x6ff873ac
movzx ecx, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], 0x7ffe
shl dword [esp + 0xc], 9
xor dword [esp + 0xc], 0xfffc10
shl esi, cl
movzx ecx, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
movsx eax, byte [ebx - 1]
mov dword [esp + 0x10], eax
add dword [esp + 0x10], esi
shl edx, cl
add dword [esp + 0x10], edx
sub dword [esp + 0x10], edi
cmp byte [ebx], 0
jne 0x3d3cd0
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret
Function at 0x3d3ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x3d3efc
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.003d3c50
xor eax, 0x1616ce02
cmp eax, dword [esp + 0x10]
je 0x3d3f06
inc esi
cmp esi, dword [edi + 0x18]
jb 0x3d3ee0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x3d3f34
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x3d3f34
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x3d40b0
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x3d40d6
cmp al, 0x2e
je 0x3d40d3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x3d40c3
jmp 0x3d40d6
mov byte [edx], 0
mov eax, dword [0x3dde6c]
test eax, eax
jne 0x3d40fa
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0xe12e7135
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3dde6c], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x3d4141
mov eax, dword [0x3dddcc]
test eax, eax
jne 0x3d412b
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0xc93d75ee
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3dddcc], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x3d4141
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.003d3c50
xor eax, 0x1616ce02
mov ecx, edi
mov edx, eax
call fcn.003d3ea0
pop edi
pop esi
add esp, 0x104
ret
Function at 0x3d3f40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov ecx, dword [eax + 0xc]
add ecx, 0xc
push esi
push edi
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx]
cmp ebx, ecx
je 0x3d409a
mov edx, dword [ebx + 0x30]
mov dword [esp + 0x14], 0xd417
xor dword [esp + 0x14], 0xfe7518b6
add dword [esp + 0x14], 0xffff66fd
xor dword [esp + 0x14], 0xfe75339e
mov dword [esp + 0x10], 0xc20a
or dword [esp + 0x10], 0xac700
shr dword [esp + 0x10], 2
or dword [esp + 0x10], 0x597d730f
xor dword [esp + 0x10], 0x360881cc
or dword [esp + 0x10], 0x27d50529
add dword [esp + 0x10], 0xfc7f
xor dword [esp + 0x10], 0x6ff873ac
mov dword [esp + 0x10], 0x7ffe
shl dword [esp + 0x10], 9
xor dword [esp + 0x10], 0xfffc10
cmp word [edx], 0
je 0x3d4081
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], 0xc20a
or dword [esp + 0x10], 0xac700
shr dword [esp + 0x10], 2
or dword [esp + 0x10], 0x597d730f
xor dword [esp + 0x10], 0x360881cc
or dword [esp + 0x10], 0x27d50529
add dword [esp + 0x10], 0xfc7f
xor dword [esp + 0x10], 0x6ff873ac
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], 0x7ffe
shl dword [esp + 0x10], 9
xor dword [esp + 0x10], 0xfffc10
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edi, dword [esp + 0x14]
movzx eax, word [edx]
shl edi, cl
cmp eax, 0x41
jb 0x3d4060
cmp eax, 0x5a
ja 0x3d4060
add eax, 0x20
mov dword [esp + 0x14], eax
add edx, 2
add dword [esp + 0x14], esi
add dword [esp + 0x14], edi
sub dword [esp + 0x14], ebp
cmp word [edx], 0
jne 0x3d3fe4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor eax, 0x36f387d6
cmp eax, dword [esp + 0x1c]
je 0x3d40a4
mov ebx, dword [ebx]
cmp ebx, ecx
jne 0x3d3f65
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebx + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret