joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431156
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 0x20], 0
and dword [ecx + 0x24], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret
Function at 0x43148c
Capabilities:
Check os version
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x464628]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x11c], ebx
mov ecx, ebx
movzx eax, byte [ecx + str.cw]
mov byte [eax + 0x469c50], cl
inc ecx
cmp ecx, 0x100
jb 0x4314ac
movzx edi, byte [ebx + str.cw]
mov eax, edi
mov ecx, edi
and al, 0x80
movzx esi, al
neg esi
lea eax, [edi + edi]
sbb esi, esi
shl ecx, 8
and esi, 0x1b
xor esi, eax
and esi, 0xff
mov edx, esi
xor edx, edi
mov eax, edx
shl eax, 8
or eax, edi
shl eax, 8
or eax, edi
shl eax, 8
or eax, esi
mov dword [ebx*4 + 0x46ad50], eax
mov eax, ecx
or ecx, esi
or eax, edi
shl eax, 8
or eax, esi
shl ecx, 8
shl esi, 8
or ecx, edx
or esi, edx
shl eax, 8
or eax, edx
shl esi, 8
or esi, edi
shl ecx, 8
mov dword [ebx*4 + 0x46b150], eax
or ecx, edi
shl esi, 8
or esi, edi
mov dword [ebx*4 + 0x46b550], ecx
movzx edi, byte [ebx + 0x469c50]
mov dword [ebx*4 + 0x46b950], esi
mov eax, edi
and al, 0x80
mov ebx, 0xff
movzx esi, al
neg esi
lea eax, [edi + edi]
sbb esi, esi
and esi, 0x1b
xor esi, eax
and esi, ebx
mov eax, esi
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [esi + esi]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, ebx
mov eax, ecx
and al, 0x80
movzx edx, al
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x1b
xor edx, eax
and edx, ebx
mov dword [ebp - 0x120], edx
mov ebx, edx
mov eax, dword [ebp - 0x120]
xor edx, esi
xor eax, ecx
xor ebx, edi
mov ecx, eax
mov dword [ebp - 0x120], eax
xor edx, edi
xor ecx, edi
mov edi, eax
mov eax, edx
shl eax, 8
xor edi, esi
mov esi, dword [ebp - 0x11c]
or eax, ecx
shl eax, 8
or eax, ebx
shl eax, 8
or eax, edi
mov dword [esi*4 + 0x469d50], eax
mov eax, ecx
shl eax, 8
or eax, ebx
shl eax, 8
or eax, edi
shl eax, 8
or eax, edx
mov dword [esi*4 + 0x46a150], eax
mov eax, ebx
shl eax, 8
or eax, edi
shl edi, 8
or edi, edx
shl eax, 8
shl edi, 8
or eax, edx
or edi, ecx
shl eax, 8
shl edi, 8
or eax, ecx
or edi, ebx
mov dword [esi*4 + 0x46a550], eax
mov ebx, esi
mov dword [ebx*4 + 0x46a950], edi
inc ebx
mov dword [ebp - 0x11c], ebx
cmp ebx, 0x100
jb 0x4314c2
lea eax, [ebp - 0x118]
mov dword [0x46cf6c], 0x43213d
push eax
mov dword [0x46cf74], 0x432197
mov dword [0x46cf70], 0x432233
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop edi
pop esi
pop ebx
test eax, eax
je 0x4316ac
cmp dword [ebp - 0x114], 5
sbb eax, eax
inc eax
je 0x4316ac
lea ecx, [ebp - 0x140]
call fcn.004083a0
test eax, eax
je 0x4316ac
mov eax, dword [ebp - 0x128]
shr eax, 0x19
and eax, 1
je 0x4316ac
mov dword [0x46cf6c], 0x432e9e
mov dword [0x46cf74], 0x432ef6
mov dword [0x46cf70], 0x433027
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437670
mov esp, ebp
pop ebp
ret
Function at 0x4316ba
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x4316f0
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x4316e3
cmp esi, ecx
jae 0x4317dc
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x43176e
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
and eax, 0xff
shr ecx, 8
and ecx, 0xff
movzx eax, byte [eax + str.cw]
movzx ecx, byte [ecx + str.cw]
or edx, eax
mov eax, dword [ebp - 8]
shl edx, 8
movzx eax, byte [eax + 0x458250]
xor ecx, eax
or ecx, edx
jmp 0x4317c2
cmp edi, 6
jbe 0x4317c2
cmp edx, 4
jne 0x4317c2
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x431702
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x433eb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x450049
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x464628]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0x18
call fcn.0043855d
add esp, 4
mov dword [edi + 0x20], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x34], 0
lea esi, [edi + 0x24]
mov dword [esi], 0
xor eax, eax
mov byte [esi + 4], 0
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov dword [esp + 0x10], esi
mov word [esi + 8], ax
mov byte [esp + 0x34], 2
lea ecx, [esp + 0x14]
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x14], 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
push 0x458360
mov byte [edi + 8], al
mov dword [edi + 0x18], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x1c], eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], eax
mov word [esp + 0x1c], ax
call fcn.00403829
mov byte [esp + 0x34], 3
sub esp, 8
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.00434800
mov byte [esp + 0x34], 2
cmp dword [esp + 0x28], 8
jb 0x433f94
push dword [esp + 0x14]
call fcn.0043850d
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x34], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x4344d0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
mov edi, ecx
push ecx
lea esi, [edi + 4]
mov ecx, esi
call fcn.0040f0c1
test al, al
je 0x432aa8
pop edi
xor al, al
pop esi
ret
push 0xc
call fcn.0043855d
pop ecx
test eax, eax
je 0x432abf
push edi
push ecx
mov ecx, eax
call fcn.00434280
jmp 0x432ac1
xor eax, eax
push eax
mov ecx, esi
call fcn.00432b72
mov ecx, esi
call fcn.0040844f
pop edi
mov ecx, eax
pop esi
jmp 0x4344d0
push 0xffffffffffffffff
push 0x450178
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x464628]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x464628]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x434512
xor al, al
jmp 0x4345d7
add edi, 0x20
mov dword [esp + 0x14], edi
je 0x434528
mov eax, dword [edi]
test eax, eax
je 0x434528
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x24], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x4345b2
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea ebx, [esi + 4]
push 1
push ebx
call ebp
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x433fd0
push 0
push 0
call fcn.0044e6ee
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
je 0x43459b
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x434586
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x43459b
mov bl, 1
jmp 0x4345b4
push 0xffffffffffffffff
push ebx
call ebp
dec eax
jne 0x4345aa
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.00434170
xor bl, bl
mov dword [esp + 0x24], 0xffffffff
test edi, edi
je 0x4345d5
mov eax, dword [edi]
test eax, eax
je 0x4345cd
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00437670
add esp, 0x14
ret
Function at 0x43519e
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x4502e5
call fcn.0043b538
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x435296
cmp byte [esi + 0x46], bl
je 0x435296
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x4351da
xor al, al
jmp 0x435298
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.004354ab
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x435207
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x43522e
dec eax
je 0x435232
dec eax
dec eax
je 0x435284
xor bl, bl
jmp 0x435286
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x435242
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x43526a
cmp eax, 0x10
jae 0x435251
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.0043cb63
add esp, 0x10
cmp ebx, eax
jne 0x43522a
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x435284
test ebx, ebx
jne 0x4351fb
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.0043544a
jmp 0x4351f5
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040161a
mov al, bl
jmp 0x435298
mov al, 1
call fcn.0043b4e7
ret
Function at 0x435845
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x450268
call fcn.0043b538
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, 0xffff
cmp si, bx
jne 0x435867
xor eax, eax
jmp 0x4359ef
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x435893
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x435893
dec dword [edx]
mov ax, bx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x4359ef
cmp dword [edi + 0x50], 0
je 0x4359ec
mov ecx, edi
call fcn.004353da
xor ecx, ecx
cmp dword [edi + 0x40], ecx
jne 0x4358c6
push dword [edi + 0x50]
push ebx
call fcn.00434e0d
pop ecx
pop ecx
test al, al
je 0x4359ec
movzx esi, bx
jmp 0x4359ec
push ecx
movzx eax, bx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0xf
call fcn.004354ab
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jae 0x4358f9
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp ecx, 0x10
jae 0x435907
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [edi + 0x40]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov edx, dword [ecx]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x32]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [edi + 0x48]
push eax
call dword [edx + 0x1c]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x4359e0
cmp eax, 1
jg 0x4359c4
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jb 0x435954
mov dword [ebp - 0x2c], eax
jmp 0x43595a
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
je 0x43598c
cmp ecx, 0x10
jae 0x43596d
lea eax, [ebp - 0x28]
push dword [edi + 0x50]
push edx
push 1
push eax
call fcn.0043cb63
mov edx, dword [ebp - 0x2c]
add esp, 0x10
cmp edx, eax
jne 0x4359bc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
lea ebx, [ebp - 0x34]
mov byte [edi + 0x46], 1
cmp dword [ebp - 0x3c], ebx
mov ebx, dword [ebp + 8]
jne 0x4359b9
test edx, edx
jne 0x4358f1
cmp dword [ebp - 0x18], 0x20
jae 0x4359bf
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.0043544a
jmp 0x4358e8
movzx esi, bx
movzx esi, si
movzx esi, si
jmp 0x4359dd
cmp eax, 3
jne 0x4359e0
push dword [edi + 0x50]
push dword [ebp - 0x34]
call fcn.00434e0d
pop ecx
pop ecx
test al, al
je 0x4359dd
movzx esi, bx
movzx esi, si
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040161a
mov ax, si
call fcn.0043b4e7
ret 4
Function at 0x4497c8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x464628]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0043de28
mov dword [ebp - 0x14], eax
cmp dword [0x469688], esi
jne 0x4498bb
push 0x800
push esi
push 0x456a7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x449848
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x44999b
push esi
push esi
push 0x456a7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x44999b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44999b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x469688], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x46968c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x469690], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x469698], eax
test eax, eax
je 0x4498b8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x469694], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4498e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4498d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4498f5
push 4
pop eax
jmp 0x44999d
cmp dword [ebp - 0x14], esi
je 0x4498f5
push dword [0x469688]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4498da
mov eax, dword [0x469694]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x449953
cmp dword [0x469698], edi
je 0x449953
push eax
call ebx
push dword [0x469698]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x449953
test eax, eax
je 0x449953
call ecx
test eax, eax
je 0x449948
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x449948
test byte [ebp - 8], 1
jne 0x449953
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x449983
mov eax, dword [0x46968c]
cmp eax, edi
je 0x449980
push eax
call ebx
test eax, eax
je 0x449980
call eax
mov esi, eax
test esi, esi
je 0x449980
mov eax, dword [0x469690]
cmp eax, edi
je 0x449980
push eax
call ebx
test eax, eax
je 0x449980
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x469688]
call ebx
test eax, eax
je 0x44999b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x44999d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437670
mov esp, ebp
pop ebp
ret
Function at 0x10026fcf
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0xc]
je 0x1001b1ee
cmp bh, 0xcc
bt ecx, 0x18
cmp ebx, 2
call fcn.10029811
insb byte es:[edi], dx
pop ecx
inc esi
sub bh, al
imul edx, dword [edx + 0x2b902b9], 0xfb78530d
in al, dx
daa
das
rcr ah, cl
in eax, 0xb9
int1
and eax, 0xb8046d76
add ecx, eax
imul dword [esi + 0x58]
mov eax, 0x1cefb023
pop es
sbb eax, 0x8b646302
insb byte es:[edi], dx
mov eax, dword [0x1ff5fda]
sub dword [edx], 0x995ec928
pop esi
cdq
loop 0x1001b0f7
jno 0x1001b17e
and eax, 0x8392280
into
sbb byte [ebx], al
jecxz 0x1001b129
jbe 0x66cf91a6
in al, dx
mov cl, 0xa7
mov esp, 0x93e84bc0
ror dword [0x3ea4c0db], 1
sbb byte [eax - 0x358bb63e], 0xa0
aas
adc eax, 0x3506f8af
cmovp edx, dword [ecx - 0x6c]
jae 0x1001b19c
in eax, dx
sti
bound edi, qword [eax - 0x2b50d731]
loop 0x1001b135
mov cl, 0xcd
cmc
pop ebx
invalid
fucomi st(3)
jl 0x1001b16d
cmp al, 0x17
inc ecx
pop es
out 0, al
add byte [eax - 0x7a9907ff], ch
in eax, 0x2c
xor al, ch
push ebx
mov ecx, 0xff660000
dec di
cmp ebx, 1
mov byte [esp], ah
jmp 0x1001b0d9

Function at 0x1002830f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
cmp al, 0x9b
mov edi, dword [edi + ecx*4]
test al, bl
test bh, 0x2d
test edi, edi
pushfd
jmp 0x100241fc
Function at 0x402ca6
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1710]
mov eax, 0x1790
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, ebp
mov dword [ebp + 0x170c], eax
cmp dword [ebp + 0x1724], 0
xorps xmm0, xmm0
mov edx, dword [ebp + 0x1718]
mov eax, dword [ebp + 0x171c]
push ebx
push esi
push edi
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], eax
movlpd qword [ebp - 0x70], xmm0
jl 0x402dfc
jg 0x402cfe
cmp dword [ebp + 0x1720], 0
jbe 0x402dfc
mov edi, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x70]
mov eax, dword [ebp + 0x1720]
mov ecx, dword [ebp + 0x1724]
sub eax, ebx
sbb ecx, edi
js 0x402d2a
jg 0x402d1f
cmp eax, 0x1770
jbe 0x402d2a
and dword [ebp - 0x7c], 0
mov eax, 0x1770
jmp 0x402d2d
mov dword [ebp - 0x7c], ecx
push 0
lea ecx, [ebp - 0x68]
push ecx
push eax
lea eax, [ebp - 0x64]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402dde
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x402dde
cmp byte [ebp + 0x1728], 0
je 0x402d6b
xor ecx, ecx
test eax, eax
je 0x402d6b
xor byte [ebp + ecx - 0x64], 0x88
inc ecx
cmp ecx, eax
jb 0x402d61
xor esi, esi
test eax, eax
je 0x402d97
push 0
lea ecx, [ebp - 0x6c]
sub eax, esi
push ecx
push eax
lea eax, [ebp - 0x64]
add eax, esi
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402dbf
add esi, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
cmp esi, eax
jb 0x402d71
add ebx, eax
adc edi, 0
call fcn.00403b03
test al, al
jne 0x402dfc
cmp edi, dword [ebp + 0x1724]
jg 0x402dfc
jl 0x402db7
cmp ebx, dword [ebp + 0x1720]
jae 0x402dfc
mov edx, dword [ebp - 0x78]
jmp 0x402d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x68]
sub eax, esi
push eax
push str.WriteFile_failed__d__d
call fcn.0040f0d0
add esp, 0xc
push 2
pop eax
jmp 0x402dfe
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x68]
push str.ReadFile_failed__d__d__I64d
call fcn.0040f0d0
xor eax, eax
add esp, 0x14
inc eax
jmp 0x402dfe
xor eax, eax
mov ecx, dword [ebp + 0x170c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c4b
add ebp, 0x1710
leave
ret
Function at 0x403029
Capabilities:
Create directory

Disassembly:
mov eax, 0x177c
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, esp
mov dword [esp + 0x1778], eax
push ebx
push ebp
push esi
push edi
push str.extracting_files
call fcn.0040f3f5
mov dword [esp], 0x7d2
call fcn.004015c7
mov esi, eax
push esi
push str.Included_files:__d
call fcn.0040f3f5
add esp, 0xc
test esi, esi
jne 0x403089
cmp byte [esp + 0x1790], 0
je 0x4031fb
mov byte [0x4623a0], 0
jmp 0x4031fb
cmp byte [esp + 0x1790], 0
je 0x403098
call fcn.0041189b
call fcn.00402c4f
push 0
push 0
push dword [0x456748]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x7d3
call fcn.00401614
mov ebp, eax
mov dword [esp], 0x4410e4
xor eax, eax
push ebp
mov dword [esp + 0x18], eax
call fcn.0041f984
mov edi, eax
pop ecx
pop ecx
test esi, esi
jle 0x4031cd
test edi, edi
je 0x4031cd
push edi
call fcn.0041f750
pop ecx
test eax, eax
je 0x4031cd
push edi
push 0x4623a0
lea eax, [esp + 0x20]
push 0x4410e8
push eax
call fcn.00403394
push 0x5c
push edi
call fcn.004147b0
add esp, 0x18
mov dword [esp + 0x14], eax
test eax, eax
je 0x40317e
push 0x4623a0
call fcn.0041f750
pop ecx
mov ecx, dword [esp + 0x14]
inc eax
sub ecx, edi
add eax, ecx
cmp eax, 0x1770
jae 0x403234
mov byte [esp + eax + 0x18], 0
lea eax, [esp + 0x18]
push eax
push str.creating_directory__S
call fcn.0040f3f5
pop ecx
pop ecx
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40317e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40317e
lea eax, [esp + 0x18]
push eax
push str.failed_to_create_directory__S
call fcn.0040f0d0
pop ecx
pop ecx
push edi
push 0x4623a0
lea eax, [esp + 0x20]
push 0x4410e8
push eax
call fcn.00403394
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.0040323a
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x403216
inc dword [esp + 0x10]
push 0x4410e4
push eax
call fcn.0041f984
pop ecx
pop ecx
mov edi, eax
call fcn.00403b03
test al, al
jne 0x4031fb
cmp dword [esp + 0x10], esi
jl 0x4030db
push 1
push ebp
call fcn.004137e6
pop ecx
pop ecx
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
mov dword [0x45674c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.extracting_files_done
call fcn.0040f3f5
pop ecx
xor eax, eax
mov ecx, dword [esp + 0x1788]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413c4b
add esp, 0x177c
ret
lea eax, [esp + 0x18]
push eax
push str.Failed_to_extract__S
call fcn.0040f0d0
push 1
push ebp
call fcn.004137e6
add esp, 0x10
mov eax, edi
jmp 0x4031fd
call fcn.00413b70
int3
Function at 0x4039fe
Capabilities:
Delete directory
Terminate process

Disassembly:
push 0x34
mov eax, 0x43ec5d
call fcn.00413caf
cmp byte [0x463b1d], 0
jne 0x403a87
mov esi, 0x4623a0
push esi
call fcn.0041f750
pop ecx
test eax, eax
je 0x403a87
lea ecx, [ebp - 0x40]
call fcn.004035b2
and dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.004035b2
push 1
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.00403fe5
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x403a77
push esi
lea ecx, [ebp - 0x28]
call fcn.00403581
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00403b26
lea ecx, [ebp - 0x28]
call fcn.004035bf
lea ecx, [ebp - 0x34]
call fcn.004035c4
lea ecx, [ebp - 0x40]
call fcn.004035c4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]