joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004217ac

Function at 0x4039b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4039c5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403a04
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403a00
lea ebx, [ebx]
cmp esi, edx
jae 0x403a04
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4039f0
cmp esi, edx
jb 0x403a09
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40cdd8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5a6f30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5aa1d0]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x40ce24
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40ce41
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x5aa1d0], eax
jmp 0x40ce2d
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x40ce41
push 0x800
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40ceae
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40ce5c
xor eax, eax
jmp 0x40ceae
lea eax, [ebp - 0x210]
push eax
call fcn.00529716
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x40ce8d
push 0x551584
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0052a2cb
add esp, 0xc
test eax, eax
jne 0x40ce58
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0052a2cb
add esp, 0xc
test eax, eax
jne 0x40ce58
lea eax, [ebp - 0x210]
push eax
call fcn.00411bd8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0052710c
leave
ret

Function at 0x40d676
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], esi
je 0x40d6bb
call fcn.0040a033
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40d6bb
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40d6d7
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00429fba
mov ebx, eax
test edi, edi
je 0x40d6d5
test esi, esi
je 0x40d6d5
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x412c8a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x53fce5
call fcn.0052981f
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x6c], esi
jne 0x412cb0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x412d04
call fcn.0041359d
push eax
lea ecx, [ebp - 0x10]
call fcn.004022c0
mov ecx, dword [edi + 0x6c]
lea edx, [ebp - 0x10]
mov eax, dword [ecx]
push edx
mov dword [ebp - 4], esi
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0052972f
push eax
call fcn.00403a50
add esp, 0x14
test edi, edi
je 0x412cf7
push edi
call fcn.00529716
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004022f0
mov eax, esi
call fcn.005297ed
ret 8

Function at 0x415f76
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x415fc0
call fcn.0040a033
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x415fbd
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x415ff9
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test edi, edi
je 0x415fe2
push dword [ebp + 0x10]
mov edx, dword [eax]
push edi
push dword [ebp + 8]
mov ecx, eax
call dword [edx + 0x20]
mov ebx, eax
test esi, esi
je 0x415fe2
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x68]
test ecx, ecx
je 0x415ff7
mov eax, dword [ecx]
push dword [ebp + 0x10]
call dword [eax + 0xa0]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x421808
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0040a033
mov ebx, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42183f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0042185e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x42a768
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5a6f30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x20], eax
mov eax, dword [0x5aa5dc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
test eax, eax
jne 0x42a7c1
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42a7de
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x5aa5dc], eax
jmp 0x42a7ca
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x42a7de
mov eax, dword [ebp - 0x20]
push ebx
push edi
push eax
push dword [ebp + 8]
call esi
jmp 0x42a91b
mov eax, dword [ebp - 0x20]
and dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov ebx, ecx
push 7
lea eax, [ebp - 0x14]
and ecx, 0xfc00
and ebx, 0x3ff
push eax
or ecx, ebx
push ecx
call fcn.0053f0c8
lea eax, [ebp - 0x14]
push eax
call fcn.00529716
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push edi
call fcn.005296ba
push 7
lea eax, [ebp - 0x14]
push eax
push ebx
lea edi, [esi + 1]
call fcn.0053f0c8
lea eax, [ebp - 0x14]
push eax
call fcn.00529716
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.005296ba
add esp, 0x38
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
mov ebx, ecx
push 7
lea eax, [ebp - 0x14]
and ecx, 0xfc00
and ebx, 0x3ff
push eax
or ecx, ebx
push ecx
call fcn.0053f0c8
lea eax, [ebp - 0x14]
push eax
call fcn.00529716
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.005296ba
push 7
lea eax, [ebp - 0x14]
push eax
push ebx
add edi, esi
call fcn.0053f0c8
lea eax, [ebp - 0x14]
push eax
call fcn.00529716
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
mov ebx, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
lea ecx, [ebx + edi*2]
push ecx
call fcn.005296ba
push 7
lea eax, [ebp - 0x14]
push eax
push 0x800
add edi, esi
call fcn.0053f0c8
add esp, 0x44
lea eax, [ebp - 0x14]
push eax
call fcn.00529716
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
lea ecx, [ebx + edi*2]
push ecx
call fcn.005296ba
lea eax, [edi + esi]
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052710c
leave
ret
Function at 0x4350e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4350f8
call fcn.0040a033
mov esi, dword [eax + 0xc]
push 0x55490c
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x43514e
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43514d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x43512e
xor esi, esi
jmp 0x435144
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.00435154
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x492417
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
mov ecx, dword [esi + 4]
push eax
push dword [ebp + 0xc]
call fcn.0041290d
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x492453
call fcn.00492632
mov dword [esi + 0xc], 1
jmp 0x492458
call fcn.00492632
cmp dword [esi], 0
je 0x4924a1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x49247b
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0040d72c
jmp 0x49248c
push 0xff
mov ecx, esi
call fcn.00402020
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040fa5b
jmp 0x4924c5
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4924c5
push dword [esi]
push dword [ebp - 4]
call fcn.0042ae5e
pop esi
leave
ret 0xc

Function at 0x492589
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00492632
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4925d1
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040d72c
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040fa5b
jmp 0x4925dc
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0042ae5e
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4b396e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test byte [esi + 4], 1
push edi
mov dword [ebp - 4], ebx
je 0x4b3988
mov edi, dword [esi + 0xc]
jmp 0x4b39c8
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4b39a1
call fcn.00422df4
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4b39b6
call fcn.00422df4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4b39c8
call fcn.00422df4
call fcn.0040a033
cmp dword [eax + 0x3c], 0
je 0x4b39dd
push edi
mov ecx, ebx
call fcn.004b328a
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004b3ba0
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x7c]
test ecx, ecx
je 0x4b3a00
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x7c], 0
test ebx, ebx
je 0x4b3a09
mov edi, ebx
mov dword [eax + 0x7c], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4f163e
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0052306a
call fcn.0040a087
cmp dword [eax + 0x14], 0
jne 0x4f1659
mov ecx, esi
pop esi
jmp fcn.004f0a5d
pop esi
ret

Function at 0x4ffbaf
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004b7083
call fcn.0040a087
cmp dword [eax + 0x14], 0
jne 0x4ffbca
mov ecx, esi
pop esi
jmp fcn.004ff4a2
pop esi
ret
Function at 0x539c05
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a6f30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0052ec62
mov dword [ebp - 0x14], eax
cmp dword [0x5aed1c], edi
jne 0x539cf6
push 0x800
push edi
push 0x57da30
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x539c83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x539dd6
push 0x57da30
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x539dd6
push 0x57da48
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x539dd6
push eax
call ebx
push 0x57da54
push esi
mov dword [0x5aed1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x57da64
push esi
mov dword [0x5aed20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x5aed24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5aed2c], eax
test eax, eax
je 0x539cf3
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5aed28], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x539d1b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x539d0e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x539d30
push 4
pop eax
jmp 0x539dd8
cmp dword [ebp - 0x14], edi
je 0x539d30
push dword [0x5aed1c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x539d15
mov eax, dword [0x5aed28]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x539d8e
cmp dword [0x5aed2c], esi
je 0x539d8e
push eax
call ebx
push dword [0x5aed2c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x539d8e
test eax, eax
je 0x539d8e
call ecx
test eax, eax
je 0x539d83
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x539d83
test byte [ebp - 8], 1
jne 0x539d8e
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x539dbe
mov eax, dword [0x5aed20]
cmp eax, esi
je 0x539dbb
push eax
call ebx
test eax, eax
je 0x539dbb
call eax
mov edi, eax
test edi, edi
je 0x539dbb
mov eax, dword [0x5aed24]
cmp eax, esi
je 0x539dbb
push eax
call ebx
test eax, eax
je 0x539dbb
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x5aed1c]
call ebx
test eax, eax
je 0x539dd6
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x539dd8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052710c
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, reloc.msvcrt.dll_rand
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401d00
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x497040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
lea edx, [edi + 4]
test edx, edx
je 0x401d7d
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401d23
sub ecx, esi
lea eax, [ecx - 1]
mov esi, eax
test eax, eax
js 0x401d5a
nop word [eax + eax]
mov cl, byte [eax + edx]
cmp cl, 0x5c
je 0x401e08
cmp cl, 0x2f
je 0x401e08
sub eax, 1
jns 0x401d40
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401d60
sub ecx, esi
push edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0043dfab
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x401d9f
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401df6
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push dword [edi + 0x108]
push dword [edi + 0x140]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x401e28
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f4a5
mov esp, ebp
pop ebp
ret
sub esi, eax
inc edx
add eax, edx
push esi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00430a10
mov byte [ebp + esi - 0x108], 0
jmp 0x401d7a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0042f4a5
mov esp, ebp
pop ebp
ret

Function at 0x402310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
imul edx, dword [ebp + 8], 0x13c
mov eax, dword [ecx + 0x2a0]
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [edx + eax + 0x100]
mov esi, eax
shr esi, 2
test al, 3
je 0x402336
inc esi
shl esi, 2
push esi
call fcn.0042f4e2
push esi
mov ebx, eax
push 0
push ebx
call fcn.00431510
mov eax, esi
add esp, 0x10
cdq
and edx, 3
add edx, eax
xor eax, eax
sar edx, 2
test edx, edx
jle 0x4023bf
cmp edx, 8
jb 0x4023b7
mov ecx, edx
and ecx, 0x80000007
jns 0x402372
dec ecx
or ecx, 0xfffffff8
inc ecx
mov esi, edx
xorps xmm2, xmm2
sub esi, ecx
xorps xmm1, xmm1
nop dword [eax]
movups xmm0, xmmword [ebx + eax*4]
xorps xmm2, xmm0
movups xmm0, xmmword [ebx + eax*4 + 0x10]
add eax, 8
xorps xmm1, xmm0
cmp eax, esi
jl 0x402380
xorps xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movd edi, xmm1
cmp eax, edx
jge 0x4023bf
xor edi, dword [ebx + eax*4]
inc eax
cmp eax, edx
jl 0x4023b7
push ebx
call fcn.0042f4eb
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x402450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 8]
mov byte [esi + 0x11c], 0
cmp ecx, 0xffffffff
je 0x4025f4
cmp byte [esi + 4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x4025f4
mov eax, dword [esi + 0x2a4]
mov edx, dword [esi + 0x2a0]
sub eax, edx
sar eax, 2
imul eax, eax, 0x613716af
mov dword [esp + 0x14], eax
cmp dword [esi + 0x110], eax
je 0x40255a
cmp dword [esi + 0x10c], 0xa
jg 0x402514
xor edi, edi
test eax, eax
jle 0x402503
xor ebx, ebx
nop dword [eax]
mov eax, dword [esi + 0x2a0]
add eax, ebx
mov dword [esp + 0x10], eax
cmp dword [eax + 0x100], 0
je 0x4024e7
push edi
mov ecx, esi
call fcn.00402310
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x114], eax
inc edi
add ebx, 0x13c
cmp edi, dword [esp + 0x14]
jl 0x4024c0
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x2a0]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [esi + 0x118], 1
mov dword [esi + 0x10c], 0xb
mov eax, dword [esi + 0x2a4]
sub eax, edx
push 0
sar eax, 2
imul eax, eax, 0x613716af
push 0
push 0
push ecx
mov dword [esi + 0x110], eax
call fcn.00402070
mov ecx, dword [esi + 8]
cmp ecx, 0xffffffff
je 0x40255a
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x110
lea eax, [esi + 0xc]
push eax
push ecx
call ebx
cmp byte [esi + 4], 0
jne 0x4025f4
cmp byte [esi + 0x118], 0
je 0x4025f4
push 0
push 0
push dword [esi + 0x114]
push dword [esi + 8]
call fcn.00402070
mov edx, dword [esi + 8]
cmp edx, 0xffffffff
je 0x4025bc
mov ecx, dword [esi + 0x2a0]
lea eax, [esp + 0x14]
push 0
push eax
mov eax, dword [esi + 0x2a4]
sub eax, ecx
mov dword [esp + 0x1c], 0
sar eax, 2
imul eax, eax, 0x613716af
imul eax, eax, 0x13c
push eax
push ecx
push edx
call ebx
push 0
push 0
push 0
push dword [esi + 8]
mov byte [esi + 0x118], 0
call fcn.00402070
mov ecx, dword [esi + 8]
cmp ecx, 0xffffffff
je 0x4025f4
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x110
lea eax, [esi + 0xc]
push eax
push ecx
call ebx
mov eax, dword [esi + 0x2a0]
cmp eax, dword [esi + 0x2a4]
je 0x402608
mov dword [esi + 0x2a4], eax
lea ecx, [esi + 0x2ac]
call fcn.00408c50
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x402629
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret