joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e2c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x1003800c]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [0x100386e8], 0
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.100026e0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x1000e324
test eax, 0x68000
jne 0x1000e324
mov eax, dword [esp + 0x22]
test eax, eax
je 0x1000e3b0
cmp eax, 5
je 0x1000e374
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.100026e0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x1000e358
test eax, 0x68000
jne 0x1000e358
mov ecx, dword [esp + 0x22]
jmp 0x1000e35b
or ecx, 0xffffffff
mov eax, dword [0x100386e8]
add eax, ecx
add esi, eax
mov dword [0x100386e8], eax
cmp eax, 5
jl 0x1000e2e5
jmp 0x1000e381
mov eax, dword [0x100386e8]
add eax, 4
mov dword [0x100386e8], eax
push eax
call fcn.1002ad40
add esp, 4
mov dword [0x100386f0], eax
mov dword [0x100386ec], edi
push 0x40
push 0x3000
push dword [0x100386e8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000e3c5
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1002a7ae
mov esp, ebp
pop ebp
ret 8
push dword [0x100386e8]
push edi
push dword [0x100386f0]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [0x100386e8]
push dword [0x100386f0]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x100386e8]
mov eax, edi
sub eax, esi
mov byte [esp + 0x20], 0xe9
sub eax, 5
add esp, 0xc
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + esi], eax
mov al, byte [esp + 0x18]
mov byte [ecx + esi + 4], al
lea eax, [esp + 0x1c]
push eax
push 0x40
push dword [0x100386e8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x100386e8], 5
mov cl, 5
jle 0x1000e451
mov eax, 5
nop dword [eax + eax]
inc cl
mov byte [eax + edi], 0x90
movzx eax, cl
cmp eax, dword [0x100386e8]
jl 0x1000e440
mov eax, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov al, byte [esp + 0x18]
mov byte [edi + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [0x100386e8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1002a7ae
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.10019dd0
mov ecx, dword [0x10038940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001a076
cmp byte [0x1004936c], 0
je 0x1001a076
push dword [0x10048ffc]
push dword [0x10048ff8]
push dword [0x10048ff4]
push dword [0x10048ff0]
call fcn.10019770
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call esi
test al, 1
je 0x1001a095
cmp byte [0x100386f6], 0
sete al
mov byte [0x100386f6], al
jmp 0x1001a09a
mov al, byte [0x100386f6]
test al, al
je 0x1001a211
push 1
call esi
test al, 1
je 0x1001a0b3
mov byte [0x10038d83], 1
jmp 0x1001a0c3
push 1
call esi
and al, 1
neg al
sbb al, al
and byte [0x10038d83], al
push 2
call esi
test al, 1
je 0x1001a0d4
mov byte [0x10038d81], 1
jmp 0x1001a0e4
push 2
call esi
and al, 1
neg al
sbb al, al
and byte [0x10038d81], al
push 1
call esi
test ax, ax
je 0x1001a0f6
mov byte [0x10038d91], 1
jmp 0x1001a105
push 1
call esi
neg ax
sbb al, al
and byte [0x10038d91], al
push 2
call esi
test ax, ax
je 0x1001a117
mov byte [0x10038d82], 1
jmp 0x1001a126
push 2
call esi
neg ax
sbb al, al
and byte [0x10038d82], al
cmp byte [0x100493a1], 0
je 0x1001a140
mov ecx, 0x100386e4
call fcn.10006ad0
mov byte [0x100493a1], 0
cmp byte [0x100493a0], 0
je 0x1001a15a
mov ecx, 0x100386e4
call fcn.10009210
mov byte [0x100493a0], 0
push dword [0x10048fec]
mov ecx, 0x10038700
push dword [0x10048fe8]
push dword [0x10048fe4]
push dword [0x10048fe0]
call fcn.10014350
push dword [0x100499ec]
push dword [0x100499e4]
call fcn.10025ba0
mov esi, dword [0x10048ff0]
xor eax, eax
mov edx, dword [0x10048ff4]
test esi, esi
mov edi, dword [0x10038ab0]
mov ebx, dword [0x10038aac]
cmovs esi, eax
test edx, edx
mov ecx, ebx
cmovs edx, eax
sub ecx, dword [0x10048ff8]
mov eax, edi
sub eax, dword [0x10048ffc]
cmp esi, eax
cmovg esi, eax
cmp edx, ecx
mov dword [0x10048ff0], esi
cmovg edx, ecx
mov ecx, dword [0x10048fe0]
xor eax, eax
mov dword [0x10048ff4], edx
test ecx, ecx
cmovs ecx, eax
mov eax, dword [0x10048fe4]
xor edx, edx
test eax, eax
cmovs eax, edx
sub edi, dword [0x10048fe8]
sub ebx, dword [0x10048fec]
cmp ecx, edi
cmovg ecx, edi
cmp eax, ebx
mov dword [0x10048fe0], ecx
cmovg eax, ebx
mov dword [0x10048fe4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001a6b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x67
xor eax, eax
nop
mov dl, byte [edi + eax + 0x6b32a658]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001a6dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x1001a6c0
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001a7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xd2
xor eax, eax
nop
mov dl, byte [edi + eax - 0x57d4a2c6]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001a7ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001a7d0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001a800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 1
xor eax, eax
nop
mov dl, byte [edi + eax - 0x239182a4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001a82d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001a810
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001a970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 7
xor eax, eax
nop
mov dl, byte [edi + eax - 0x631a8993]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001a99d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x1001a980
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x1b
xor eax, eax
nop
mov dl, byte [edi + eax - 0x22048303]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001ab4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x1001ab30
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ab60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
nop
mov dl, byte [edi + eax - 0x7632c59d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001ab8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x1001ab70
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001aba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xd
xor eax, eax
nop
mov dl, byte [edi + eax + 0x758d2da1]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001abcd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001abb0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ae40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x42
xor eax, eax
nop
mov dl, byte [edi + eax + 0x3ec9ae8c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001ae6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001ae50
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001ae80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x52
xor eax, eax
nop
mov dl, byte [edi + eax - 0x5b1bf00c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001aead
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x16
jl 0x1001ae90
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001aec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x3d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x760f49be]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001aeed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x1001aed0
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c580
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x1003800c]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x28], 1
push esi
mov esi, dword [esp + 0x28]
jne 0x1001c6ae
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov ecx, 0xa4
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x1003440c]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x1001c5cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1001c5b0
push 0x1001c450
lea eax, [esp + 0x14]
mov byte [esp + 0x20], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x72657375
push eax
mov dword [esp + 0x14], 0x642e3233
mov word [esp + 0x18], 0x6c6c
mov byte [esp + 0x1a], 0
call fcn.10001750
push eax
call fcn.100010f0
mov dword [0x10038c68], eax
mov ecx, 0x10
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + str.WtfPagexjIuh]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x1001c63d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1001c620
push 0x1001c4a0
lea eax, [esp + 0x14]
mov byte [esp + 0x20], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x72657375
push eax
mov dword [esp + 0x14], 0x642e3233
mov word [esp + 0x18], 0x6c6c
mov byte [esp + 0x1a], 0
call fcn.10001750
push eax
call fcn.100010f0
push 0x104
push 0x10038c70
push esi
mov dword [0x10038c64], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push esi
push 0x1001b530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100386e4], esi
mov ecx, dword [esp + 0x20]
mov eax, 1
pop esi
xor ecx, esp
call fcn.1002a7ae
add esp, 0x20
ret 0xc
Function at 0x100231b0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov dword [edi + 0xd60], 0
mov dword [0x2438ff74], 0xffffffff
mov dword [0x243b2ef8], 0
cmp byte [0x10049399], 0
je 0x100231f5
push 0x45
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100231f5
cmp byte [0x10049399], 0
jne 0x10023225
mov ecx, dword [esi + 8]
cmp ecx, dword [esi]
jne 0x10023218
mov eax, dword [esi + 4]
inc eax
add ecx, eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
mov dword [esi + 4], 0
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
Function at 0x100257a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x1003800c]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x10025842
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10025100
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x10025851
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.10025100
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
pop esi
xor ecx, esp
call fcn.1002a7ae
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403e59
pop dword [ebp - 0x3c]
mov eax, 0x403e59
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x28469290
add dword [ebp - 0x4c], 0x260bb2bb
mov dword [ebp - 0x48], 0x9bab8f20
add dword [ebp - 0x48], 0x9687bd25
mov dword [ebp - 0x44], 0x54e04944
sub dword [ebp - 0x44], 0x8940516
mov dword [ebp - 0x40], 0xada99305
add dword [ebp - 0x40], 0x52566cfb
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xe07eeccb
sub eax, 0xe03e6c3f
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x1ba7e2b9
sub dword [ebp - 0x4c], 0xa7357963
mov dword [ebp - 0x48], 0xc6f324f4
sub dword [ebp - 0x48], 0x8586c37f
mov dword [ebp - 0x44], 0xd422b299
add dword [ebp - 0x44], 0x8f4cb9d3
mov dword [ebp - 0x40], 0x63acd196
add dword [ebp - 0x40], 0x9c532e6a
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ace9
push 0
call eax
mov ecx, 0xe175f77c
add ecx, 0x1e8a60c1
xor ebx, ebx
add ebx, eax
mov edx, 0x411000
add edx, dword [ebp - 0x3c]
mov edi, 0x42c8b8b1
add edi, 0x564b85f4
sub dword [ebp - 0x1c], 0xe3aa1553
mov esi, dword [edx]
add esi, edi
xor dword [ebp - 8], eax
mov dword [ebx], esi
xor dword [ebp - 0x2c], eax
add ebx, 4
add edx, 0x164f58c2
sub edx, 0x164f58be
loop 0x403f6d
add eax, 0xd650cf1e
add eax, 0x29b084a9
mov ebx, eax
add eax, 0xa9729ca5
sub eax, 0xa9729ca0
mov ecx, 0x15eb7cdf
sub ecx, 0x15ab7cdf
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4028d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
movzx eax, word [0x409b58]
cmp eax, dword [0x409b5c]
jb 0x40294c
mov eax, dword [0x408274]
mov eax, dword [eax]
mov edx, 0x8000
call fcn.00403b64
mov edx, eax
mov eax, dword [0x409b50]
call fcn.00403c8c
mov dword [0x409b5c], eax
mov eax, dword [0x4082ec]
mov ax, word [eax + 8]
and ax, 1
cmp ax, 1
jne 0x402943
mov esi, dword [0x409b5c]
dec esi
test esi, esi
jl 0x402943
inc esi
xor ebx, ebx
call fcn.004054bc
mov edx, dword [0x409b50]
xor byte [edx + ebx], al
mov eax, dword [0x409b50]
mov al, byte [eax + ebx]
call fcn.004053e4
inc ebx
dec esi
jne 0x402924
mov word [0x409b58], 0
cmp dword [0x409b5c], 0
jne 0x40296d
mov eax, dword [0x408274]
xor edx, edx
mov dword [eax], edx
mov word [0x409b58], 0
or eax, 0xffffffff
pop esi
pop ebx
ret
movzx eax, word [0x409b58]
mov edx, dword [0x409b50]
movzx eax, byte [edx + eax]
inc word [0x409b58]
pop esi
pop ebx
ret

Function at 0x4029d4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, esp
mov ebp, 0x409b54
mov eax, dword [0x409b48]
mov dword [edi], eax
mov ax, word [0x409b4c]
mov word [esp + 4], ax
mov bx, word [0x409b60]
mov si, word [esp + 4]
and si, 7
lea ecx, [esp + 4]
mov edx, edi
mov eax, esi
call fcn.004029c8
lea ecx, [esp + 4]
mov edx, edi
mov ax, 0x10
call fcn.004029a4
mov si, word [edi]
and si, 0xffff
lea ecx, [esp + 4]
mov edx, edi
mov ax, 0x10
call fcn.004029c8
lea ecx, [esp + 4]
mov edx, edi
mov ax, 0x10
call fcn.004029a4
mov ax, word [edi]
not ax
and ax, 0xffff
cmp si, ax
je 0x402a5e
mov word [0x409b60], 0
lea ecx, [esp + 4]
mov edx, edi
mov ax, 0x10
call fcn.004029c8
test si, si
je 0x402ad8
dec esi
lea ecx, [esp + 4]
mov edx, edi
mov ax, 8
call fcn.004029a4
movzx eax, bx
mov edx, dword [ebp]
mov cl, byte [edi]
mov byte [edx + eax], cl
inc ebx
cmp bx, 0x8000
jne 0x402ac4
push 0
lea eax, [esp + 0xc]
push eax
movzx eax, bx
push eax
mov eax, dword [ebp]
push eax
mov eax, dword [0x4082a4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile
mov ecx, dword [0x408264]
movzx edx, bx
mov eax, dword [ebp]
call fcn.00403b40
xor ebx, ebx
lea ecx, [esp + 4]
mov edx, edi
mov ax, 8
call fcn.004029c8
test si, si
jne 0x402a72
mov word [0x409b60], bx
mov eax, dword [edi]
mov dword [0x409b48], eax
mov ax, word [esp + 4]
mov word [0x409b4c], ax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x403938
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, 0x409b44
mov word [0x409b58], 0
xor eax, eax
mov dword [0x409b5c], eax
mov word [0x409b60], 0
mov word [0x409b4c], 0
xor eax, eax
mov dword [0x409b48], eax
xor ebx, ebx
xor eax, eax
mov dword [0x409b50], eax
xor eax, eax
mov dword [0x409b54], eax
mov eax, 0x8002
call fcn.004010d0
mov dword [0x409b50], eax
mov eax, 0x8002
call fcn.004010d0
mov dword [0x409b54], eax
xor eax, eax
push ebp
push 0x403a63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x409b64], eax
xor eax, eax
mov dword [0x409b68], eax
xor eax, eax
push ebp
push 0x403a37
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [esi], 0
lea eax, [ebp - 4]
call fcn.00403898
cmp bx, word [esi]
jae 0x4039dc
mov bx, word [esi]
cmp dword [ebp - 4], 0
je 0x4039c7
cmp word [0x409b60], 0
jbe 0x403a2d
push 0
lea eax, [ebp - 8]
push eax
movzx eax, word [0x409b60]
push eax
mov eax, dword [0x409b54]
push eax
mov eax, dword [0x4082a4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile
mov ecx, dword [0x408264]
movzx edx, word [0x409b60]
mov eax, dword [0x409b54]
call fcn.00403b40
mov word [0x409b60], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x403a41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a6a
mov eax, dword [0x409b50]
call fcn.004010e8
mov eax, dword [0x409b54]
call fcn.004010e8
ret

Function at 0x403b6c
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [0x408274]
mov eax, dword [edi]
mov edx, 0x8000
call fcn.00403b64
add eax, 2
call fcn.004010d0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x403c52
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jle 0x403c3c
mov eax, dword [edi]
mov edx, 0x8000
call fcn.00403b64
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00403c8c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [edi], eax
mov eax, dword [0x4082ec]
mov ax, word [eax + 8]
and ax, 1
cmp ax, 1
jne 0x403c07
mov esi, dword [ebp - 4]
dec esi
test esi, esi
jb 0x403c07
inc esi
xor ebx, ebx
call fcn.004054bc
mov edx, dword [ebp - 8]
mov dl, byte [edx + ebx]
xor al, dl
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov eax, dword [ebp - 8]
mov al, byte [eax + ebx]
call fcn.004053e4
inc ebx
dec esi
jne 0x403be5
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4082a4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile
mov ecx, dword [0x408264]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00403b40
cmp dword [edi], 0
jg 0x403ba9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403c59
mov eax, dword [ebp - 8]
call fcn.004010e8
ret
Function at 0x403d74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00401d94
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x403d8d
test al, 0x10
jne 0x403d91
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x403d98
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00401d94
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
setne al
pop ebx
ret

Function at 0x40404c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40418b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xd], 0
push 0
mov eax, dword [0x4082c8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetFileSize
mov ebx, eax
mov eax, dword [0x408294]
sub ebx, dword [eax]
cmp ebx, 0x10016
jbe 0x404098
mov ebx, 0x10016
cmp ebx, 0x16
jbe 0x40415a
mov eax, ebx
call fcn.004010d0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x404153
push dword fs:[eax]
mov dword fs:[eax], esp
mov dx, 1
xor eax, eax
call fcn.00403c60
mov edi, eax
mov eax, ebx
neg eax
mov dx, 2
call fcn.00403c60
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00403c8c
mov esi, eax
xor edx, edx
mov eax, edi
call fcn.00403c60
cmp ebx, esi
jne 0x40413d
mov edi, ebx
sub edi, 0x16
test edi, edi
jb 0x40413d
inc edi
xor ebx, ebx
mov esi, dword [ebp - 0xc]
add esi, ebx
mov eax, dword [esi]
mov edx, dword [0x4082ac]
cmp eax, dword [edx]
jne 0x404139
push 0
mov eax, dword [0x4082c8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetFileSize
movzx edx, word [esi + 0x14]
add edx, dword [ebp - 8]
add edx, ebx
add edx, 0x16
cmp eax, edx
jne 0x404139
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 8]
add eax, ebx
mov dword [ebp - 4], eax
jmp 0x40413d
inc ebx
dec edi
jne 0x4040fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40415a
mov eax, dword [ebp - 0xc]
call fcn.004010e8
ret
cmp byte [ebp - 0xd], 0
jne 0x404175
lea edx, [ebp - 0x14]
mov eax, 0x3ee
call fcn.00403ae8
mov eax, dword [ebp - 0x14]
call fcn.00406154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404192
lea eax, [ebp - 0x14]
call fcn.00401a1c
ret