joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
shr eax, 3
test eax, eax
je 0x40126d
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
jmp 0x4011e0
mov dword [esp + 0x18], 0xc6ef379b
sub dword [esp + 0x18], 0x7b
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], 0x9e377a34
sub dword [esp + 0x1c], 0x7b
mov dword [esp + 0x18], 0x20
jmp 0x401210
mov edi, ecx
shr edi, 5
add edi, dword [esi + 0xc]
mov ebx, ecx
shl ebx, 4
add ebx, dword [esi + 8]
xor edi, ebx
lea ebx, [edx + ecx]
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
add edi, dword [esi + 4]
mov ebx, eax
shl ebx, 4
add ebx, dword [esi]
xor edi, ebx
lea ebx, [edx + eax]
sub edx, dword [esp + 0x1c]
xor edi, ebx
sub ecx, edi
mov edi, 1
sub dword [esp + 0x18], edi
jne 0x401210
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
mov dword [edx + 4], eax
add edx, 8
sub dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
jne 0x4011e0
pop edi
pop esi
pop ebx
pop ecx
ret 0xc

Function at 0x402020
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x418e6b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x420988]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040620b
push 4
mov dword [esp + 0x24], 0
call fcn.00406e95
mov edi, eax
add esp, 4
test edi, edi
je 0x4020a2
call fcn.00405e4b
mov dword [edi], eax
call fcn.00405c0a
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00405b3f
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x402097
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00405b67
jmp 0x4020a4
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x406e86
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420988]
jne 0x406e90
repz ret
jmp fcn.0040b42c

Function at 0x4151fe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420988]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040aed1
and dword [ebp - 0x14], 0
cmp dword [0x5346fc], 0
mov dword [ebp - 0x18], eax
jne 0x4152b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x415359
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x415359
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5346fc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x534700], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x534704], eax
call edi
push eax
call esi
mov dword [0x53470c], eax
test eax, eax
je 0x4152b1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x534708], eax
mov eax, dword [0x534708]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41530a
cmp dword [0x53470c], ecx
je 0x41530a
push eax
call esi
push dword [0x53470c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41530a
test ebx, ebx
je 0x41530a
call edi
test eax, eax
je 0x415301
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x415301
test byte [ebp - 8], 1
jne 0x41530a
or dword [ebp + 0x10], 0x200000
jmp 0x41533d
mov eax, dword [0x534700]
cmp eax, dword [ebp - 0x18]
je 0x41533d
push eax
call esi
test eax, eax
je 0x41533d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41533d
mov eax, dword [0x534704]
cmp eax, dword [ebp - 0x18]
je 0x41533d
push eax
call esi
test eax, eax
je 0x41533d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5346fc]
call esi
test eax, eax
je 0x415359
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41535b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406e86
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x42e001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x402bc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x403cf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push edi
mov eax, dword [ebx + 0x7c]
test eax, eax
jne 0x402c86
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f89
push 0
call edi
test eax, eax
mov dword [ebx + 0x7c], eax
jne 0x402c86
push esi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
push 0x104
push 0x104
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x402c74
push 0x6a
push esi
call edi
test eax, eax
je 0x402c6d
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [ebx + 0x7c], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402ca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push ebx
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x402d23
mov edx, dword [esp + 4]
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x124]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10c
ret
mov eax, ebx
pop ebx
add esp, 0x10c
ret
Function at 0x402d90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebp
mov ebp, dword [esp + 0x210]
test ebp, ebp
je 0x402f09
cmp byte [ebp], 0
je 0x402f09
mov ecx, dword [esp + 0x218]
mov eax, str.open
test ecx, ecx
je 0x402dc5
mov eax, 0x40639c
mov ecx, dword [esp + 0x214]
push ebx
push esi
push edi
push ecx
push 0
push 0
push ebp
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
cmp ebx, 0x20
ja 0x402efc
lea edx, [esp + 0x10]
push edx
push str..htm
push closesocket
call fcn.00402ca0
add esp, 0xc
test eax, eax
jne 0x402efc
mov edi, str._shellopencommand
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push closesocket
call fcn.00402ca0
add esp, 0xc
test eax, eax
jne 0x402efc
mov esi, dword [sym.imp.MSVCRT.dll__mbsstr]
lea edx, [esp + 0x10]
push str.__1_
push edx
call esi
mov edx, eax
add esp, 8
test edx, edx
jne 0x402e95
lea eax, [esp + 0x10]
push 0x406374
push eax
call esi
mov edx, eax
add esp, 8
test edx, edx
jne 0x402e95
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + ecx + 0xf]
jmp 0x402e98
mov byte [edx], 0
mov edi, 0x406370
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x220]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
add esp, 0x208
ret
mov eax, 0x24
pop ebp
add esp, 0x208
ret

Function at 0x4030e0
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov eax, dword [0x406614]
push ebx
push esi
push edi
push 0x40
push 0x3000
push eax
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x406614]
mov edi, eax
mov edx, ecx
add esi, 0x4da90
mov ebx, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test ebx, ebx
pop ebx
jne 0x403122
xor eax, eax
ret
push 0
push 0
push eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x402160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, esp
mov dword [esi + 8], ebp
lea eax, [ebp + 8]
mov edx, esp
mov dword [esi + 0x7c], edx
mov dword [esi + 0x88], 0xffffffff
lea edx, [esi + 0x80]
mov dword [esi + 0x84], 0x4081f0
mov edi, dword fs:[0]
mov dword [esi + 0x80], edi
mov dword fs:[0], edx
mov edx, eax
add edx, 0xc
mov dword [esi + 0xc], edx
add eax, 0x30
mov dword [esi + 0x10], eax
mov dword [esi + 0x78], ecx
mov byte [esi + 0x77], 1
mov byte [esi + 0x76], 1
mov dword [esi + 0x88], 1
mov eax, esp
mov dword [eax], 0x418d91
lea ecx, [esi + 0x5c]
call fcn.004082d0
sub esp, 4
jmp 0x4021e5
mov byte [esi + 0x5b], 0
mov dword [esi + 0x88], 2
mov eax, esp
mov dword [eax], str.yuwpuvzoshrocikhjkrwbxlbm
lea ecx, [esi + 0x40]
call fcn.004082d0
sub esp, 4
jmp 0x40220b
mov dword [esi + 0x3c], 0x9a4
mov dword [esi + 0x34], 0x40d064c0
mov dword [esi + 0x30], 0
mov dword [esi + 0x88], 3
mov eax, esp
mov dword [eax], str.uixfkz
lea ecx, [esi + 0x18]
call fcn.004082d0
sub esp, 4
jmp 0x402242
mov dword [esi + 0x14], 0x260
lea ecx, [esi + 0x18]
call fcn.00408390
lea ecx, [esi + 0x40]
call fcn.00408390
lea ecx, [esi + 0x5c]
call fcn.00408390
mov ecx, dword [esi + 0xc]
call fcn.00408390
mov ecx, dword [esi + 0x10]
call fcn.00408390
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
fld dword [0x418194]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x5c
Function at 0x402310
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
mov dword [esi + 8], ebp
lea eax, [ebp + 8]
mov dword [esi + 0xc], eax
mov edx, esp
mov dword [esi + 0x64], edx
mov dword [esi + 0x70], 0xffffffff
lea edx, [esi + 0x68]
mov dword [esi + 0x6c], 0x408210
mov edi, dword fs:[0]
mov dword [esi + 0x68], edi
mov dword fs:[0], edx
mov edx, dword [eax]
mov dword [esi + 0x10], edx
mov edx, eax
add edx, 0x10
mov dword [esi + 0x14], edx
mov edx, eax
add edx, 0x2c
mov dword [esi + 0x18], edx
mov edx, eax
add edx, 0x50
mov dword [esi + 0x1c], edx
add eax, 0x68
mov dword [esi + 0x20], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x5c], 0x40d7f7c0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0x40b77400
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0x40e37620
mov dword [esi + 0x48], 0
mov dword [esi + 0x70], 3
mov eax, esp
mov dword [eax], str.fkhwspzxcltffhtnfixxtrvpyouiltjnpiwlcdfcaayfjpriuhfrwfvwfkuqgkjcfmbzmbmfscwirsyjiltbqe
lea ecx, [esi + 0x30]
call fcn.004082d0
sub esp, 4
jmp 0x4023bd
vmovsd xmm0, qword [0x418198]
vmovsd qword [esi + 0x28], xmm0
mov dword [esi + 0x24], 0x22
cmp dword [esi + 0x24], 0
jle 0x4023e9
mov eax, dword [esi + 0x24]
add eax, 0xffffffff
mov dword [esi + 0x24], eax
jmp 0x4023d1
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x70], 4
mov eax, esp
mov dword [eax], str.rmkuitnqmoige
call fcn.004082d0
sub esp, 4
jmp 0x402408
lea ecx, [esi + 0x30]
call fcn.00408390
mov ecx, dword [esi + 0x14]
call fcn.00408390
mov ecx, dword [esi + 0x18]
call fcn.00408390
mov ecx, dword [esi + 0x1c]
call fcn.00408390
mov ecx, dword [esi + 0x20]
call fcn.00408390
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi + 0x68]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x80
Function at 0x4024f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov esi, esp
mov dword [esi + 0xc], ebp
lea eax, [ebp + 8]
mov edx, esp
mov dword [esi + 0x9c], edx
mov dword [esi + 0xa8], 0xffffffff
lea edx, [esi + 0xa0]
mov dword [esi + 0xa4], 0x408230
mov edi, dword fs:[0]
mov dword [esi + 0xa0], edi
mov dword fs:[0], edx
mov edx, eax
add edx, 4
mov dword [esi + 0x14], edx
mov edx, eax
add edx, 0x24
mov dword [esi + 0x18], edx
add eax, 0x40
mov dword [esi + 0x1c], eax
mov dword [esi + 0x98], ecx
mov dword [esi + 0xa8], 2
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x80]
call fcn.004082d0
sub esp, 4
jmp 0x40257e
mov dword [esi + 0x7c], 0x40dd4f80
mov dword [esi + 0x78], 0
mov dword [esi + 0x74], 0x40cbb200
mov dword [esi + 0x70], 0
mov dword [esi + 0xa8], 3
mov eax, esp
mov dword [eax], str.psfxaszgczajhymdkwftkwfrqvfayabhlyssalqazgusegiycskrcscfapcfelcdpjksjmzmpjounhzzwstyhulqplhtkohnf
lea ecx, [esi + 0x58]
call fcn.004082d0
sub esp, 4
jmp 0x4025bc
mov byte [esi + 0x57], 1
mov byte [esi + 0x56], 1
mov dword [esi + 0xa8], 4
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x3c]
call fcn.004082d0
sub esp, 4
jmp 0x4025e6
mov dword [esi + 0xa8], 5
mov eax, esp
mov dword [eax], str.wfgiykwqdsdqqegpdjvftklcevbzev
lea ecx, [esi + 0x24]
call fcn.004082d0
sub esp, 4
jmp 0x402608
lea ecx, [esi + 0x24]
lea eax, [esi + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004083c0
mov byte [esi + 0x13], al
lea ecx, [esi + 0x24]
call fcn.00408390
lea ecx, [esi + 0x3c]
call fcn.00408390
mov al, byte [esi + 0x13]
test al, 1
jne 0x40263d
jmp 0x402661
mov dword [esi + 0x20], 0x39
cmp dword [esi + 0x20], 0
jle 0x40265c
mov eax, dword [esi + 0x20]
add eax, 0xffffffff
mov dword [esi + 0x20], eax
jmp 0x402644
jmp 0x402661
lea ecx, [esi + 0x58]
call fcn.00408390
lea ecx, [esi + 0x80]
call fcn.00408390
mov ecx, dword [esi + 0x14]
call fcn.00408390
mov ecx, dword [esi + 0x18]
call fcn.00408390
mov ecx, dword [esi + 0x1c]
call fcn.00408390
mov eax, dword [esi + 0xa0]
mov dword fs:[0], eax
mov eax, 0x1016d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x68
Function at 0x403830
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
not edi
rcr edx, 0x6f
add esi, 0x8b
mov edx, 0x41
and edx, 0xc9
sbb eax, 0xc9
neg edi
imul edi
not edi
rol edi, 0x91
bswap edi
inc ebx
rcl ebx, 0x37
imul esi
rcr edx, 0xf1
imul eax
inc esi
rcl ebx, 0x8c
rol edi, 0x81
mov eax, 0x37
not esi
or edi, 0xeb
sub esi, 0x7b
rol esi, 0x24
ror edi, 0xde
not eax
or ebx, 0xe0
and ebx, 0x15
bswap edi
bswap edx
imul edx
bswap eax
bswap eax
sub edx, 0x91
rcr esi, 0x42
not esi
rcl ebx, 0xe3
neg edx
inc eax
rol edi, 0xa8
mov edi, 0x67
imul edx
dec eax
not ebx
rol ebx, 0x27
mov edi, 0x8e
rcl ebx, 0x6b
not esi
or ebx, 0x7c
neg edi
xor ecx, ecx
xor edi, edi
rcr esi, 0x42
imul esi
rcl edx, 0xe5
rol edi, 0x6a
ror esi, 0x93
dec edi
rcl edx, 0x9e
sub ebx, 0x96
neg eax
inc esi
inc edx
neg edi
and eax, 0x39
imul esi
bswap edi
bswap ebx
neg esi
and edx, 0xf7
ror esi, 0xca
dec edi
rcl edx, 0x5b
sub ebx, 0x2b
add edx, 0xd
inc edx
or eax, 0x2d
mov edx, 0xc3
not ebx
neg edx
bswap eax
inc eax
imul eax
neg edx
inc edx
or edi, 0x9c
add esi, 0xd4
rcr edx, 0x6b
neg esi
not esi
bswap edi
dec ebx
rcr esi, 0xba
neg esi
rol ebx, 0x2c
not esi
mov ebx, 0x4f
imul ebx
mov ebx, 0xd8
dec eax
inc eax
mov eax, 0xd3
mov ecx, dword [ebp + 0xc]
neg ebx
neg esi
not eax
rol edi, 0x32
bswap edx
bswap edi
rol eax, 0xd1
rcl esi, 0xba
add edi, 0x20
sbb edx, 0xc1
sub esi, 0xd
dec ebx
and esi, 0x9c
not eax
rcr edi, 0xce
dec eax
rcr edi, 0x39
not edx
bswap eax
not eax
inc edx
rol edx, 0x35
or edi, 0xef
neg edi
not eax
sub esi, 0x76
bswap ebx
not edi
not ebx
mov esi, 0x73
mov ebx, 0xf1
imul edx
dec eax
add eax, 0xc6
rcl ebx, 0x66
and edi, 0x13
not edi
inc ebx
inc eax
rcr edx, 0x76
rol eax, 0xfb
inc esi
and eax, 0x78
not edx
sub ebx, 8
or eax, 0xd3
add eax, 0x50
sbb eax, 0x23
or edx, 0x81
inc ebx
mov edi, dword [ebp + 8]
xor eax, esi
mov esi, esi
xor esi, esi
mov ebx, esi
xor eax, esi
xor ebx, ebx
xor esi, eax
xor ebx, ebx
mov eax, esi
xor esi, esi
xor ebx, ebx
mov eax, eax
not byte [edi]
mov eax, esi
mov ebx, eax
xor ebx, eax
mov ebx, eax
xor esi, esi
mov eax, esi
xor eax, esi
mov ebx, ebx
xor ebx, eax
sub byte [edi], 0x98
xor ebx, ebx
mov eax, ebx
mov esi, ebx
mov esi, ebx
xor ebx, esi
mov ebx, esi
mov ebx, eax
mov esi, eax
xor esi, eax
add byte [edi], 0x53
xor ebx, esi
mov esi, ebx
xor ebx, ebx
mov ebx, eax
mov eax, eax
xor ebx, ebx
xor esi, esi
mov ebx, eax
mov ebx, esi
imul byte [edi]
inc edi
loop 0x4039ec
pop esi
pop edi
pop ebx
pop ebp
ret