joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4120e0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov edx, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp edx, ebx
push esi
push edi
je 0x4121e9
cmp dword [ebp + 0xc], ebx
je 0x4121e9
push ebx
push 0x8000001
push 3
push ebx
push 1
push 0x80000000
xor eax, eax
mov byte [esp + 0x38], bl
mov ecx, 0x41
lea edi, [esp + 0x39]
push edx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x2f], 1
rep stosd dword es:[edi], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41214a
mov dword [esp + 0x18], 0x4f5
jmp 0x4121f1
push 1
push ebx
push 0x20
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x104
lea edx, [esp + 0x2c]
push edx
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x4121b6
cmp dword [esp + 0x1c], 0x104
jne 0x4121b6
xor eax, eax
lea ecx, [ecx]
xor byte [esp + eax + 0x20], 0x16
inc eax
cmp eax, 0x104
jl 0x412180
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x20]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x412198
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x530474
lea edx, [esp + 0x18]
push ebx
push edx
mov dword [esp + 0x20], 0x530cb8
mov dword [esp + 0x24], 0x513
call fcn.0041ce50
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x18], 0x4d8
push 0x530474
lea eax, [esp + 0x18]
push ebx
push eax
mov dword [esp + 0x20], 0x530cb8
call fcn.0041ce50
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412e80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 1
push 0
push 0
push eax
mov edi, ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov esi, eax
cmp esi, 0xffffffff
jne 0x412ea3
pop edi
xor al, al
pop esi
ret 0x10
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [edi + 0x1c]
push 0
sub esi, ebp
mov ebp, dword [esp + 0x20]
push ebp
push ebx
push ecx
call fcn.00419b60
add esp, 0x10
test al, al
jne 0x412ece
pop ebp
pop ebx
pop edi
pop esi
ret 0x10
test ebp, ebp
jbe 0x412eee
mov ecx, ebx
sub esi, ebx
xor edx, edx
lea eax, [esi + ecx]
div dword [edi + 0x18]
mov eax, dword [edi + 0x14]
mov dl, byte [edx + eax]
xor byte [ecx], dl
inc ecx
dec ebp
jne 0x412ed6
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
test esi, esi
je 0x412f04
push esi
push ebp
push ebx
call fcn.00419aa0
add esp, 0xc
mov word [esi], ax
pop ebp
pop ebx
pop edi
mov al, 1
pop esi
ret 0x10

Function at 0x414be0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
mov cl, 0x1b
jbe 0x414c07
mov edx, dword [esp + 8]
push ebx
mov bl, byte [eax + edx]
xor bl, cl
xor cl, 0xa1
shr cl, 1
add cl, al
mov byte [eax + edx], bl
inc eax
cmp eax, esi
jb 0x414bf2
pop ebx
pop esi
ret
Function at 0x4161a0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x46c
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x10]
mov ebx, dword [esp + 0x480]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x416214
push 0x400
lea ecx, [esp + 0x80]
push ecx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.004163e0
lea edx, [esp + 0x88]
push edx
push ebx
push 0x531264
push 1
push esi
call fcn.00414c10
add esp, 0x20
mov edi, 4
jmp 0x416397
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41626a
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x41626a
push 0x400
lea ecx, [esp + 0x80]
push ecx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.004163e0
lea edx, [esp + 0x88]
push edx
push ebx
push 0x53122c
push 1
push esi
call fcn.00414c10
mov edi, 1
jmp 0x41638d
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41628d
push ebx
push 0x5311fc
push 1
push esi
call fcn.00414c10
add esp, 0x10
mov edi, 8
jmp 0x416390
push edi
push 0
call dword [sym.imp.kernel32.dll_GlobalAlloc]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x4162e3
push 0x400
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.004163e0
lea ecx, [esp + 0x88]
push ecx
push 0x5311d0
push 0x1001
push esi
call fcn.00414c10
add esp, 0x1c
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x46c
ret 4
push 0
lea edx, [esp + 0x14]
push edx
push edi
push eax
push ebp
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x416359
cmp dword [esp + 0x10], edi
jne 0x416359
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0xc]
push edi
push eax
call fcn.00414be0
mov ecx, dword [esi + 0xc]
add esp, 8
push edi
push ecx
mov ecx, esi
call fcn.00415f40
test eax, eax
je 0x41634a
push eax
push ebx
lea edx, [esp + 0x20]
push 0x5311a0
push edx
call dword [sym.imp.user32.dll_wsprintfA]
lea eax, [esp + 0x28]
push eax
push 1
push esi
call fcn.00414c10
add esp, 0x1c
mov edi, 0xb
jmp 0x416397
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x46c
ret 4
push 0x400
lea ecx, [esp + 0x80]
push ecx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.004163e0
lea edx, [esp + 0x88]
push edx
push ebx
push 0x531164
push 1
push esi
call fcn.00414c10
mov edi, 9
add esp, 0x20
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x1c]
push eax
push 0
push 2
call dword [esi + 0x18]
mov edx, dword [esi]
add esp, 0xc
mov ecx, esi
call dword [edx + 0x10]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x46c
ret 4

Function at 0x4166c0
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [0x566d44]
mov ecx, dword [eax]
push 0
push 0
push edx
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push edx
push eax
call dword [ecx + 0x54]
test eax, eax
jge 0x4166f0
push 0x5312d8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor eax, eax
ret
mov eax, 1
ret
Function at 0x416a00
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x7c
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 4]
mov ecx, dword [esp + 0x98]
mov eax, dword [0x566d44]
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0x94]
or ecx, 0x40
push 0
mov dword [esp + 0x8c], ecx
lea edi, [esi + 0x48]
push edi
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x6c
mov dword [esp + 0x30], 7
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebp
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
test eax, eax
mov dword [esp + 0x10], eax
jge 0x416a87
push 0x531364
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov edx, dword [esp + 0x10]
push edx
call fcn.00416590
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x7c
ret 0x10
push ebp
push ebx
push 0
lea ecx, [esi + 0x54]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebp
call fcn.0041ebe0
test eax, eax
je 0x416acd
push 0x530474
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x1c], 0x53134c
mov dword [esp + 0x20], 0xcc
call fcn.0041ce50
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x7c
ret 0x10
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esp + 0x9c]
and ebx, 0xfffffffe
cmp ecx, 0xffffffff
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ebx
mov eax, ebx
je 0x416b2a
or eax, 1
lea edx, [esp + 0x18]
push edx
mov dword [esi + 0x3c], eax
mov eax, dword [edi]
push 8
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
mov esi, eax
test esi, esi
jge 0x416b2a
push 0x531328
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00416590
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x7c
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x7c
ret 0x10

Function at 0x416b40
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x6c
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 4]
xor eax, eax
mov ecx, 0x1b
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x78]
test eax, eax
mov dword [esp + 8], 0x6c
jne 0x416b7b
mov dword [esp + 0xc], 1
mov dword [esp + 0x70], 0x200
jmp 0x416b8f
mov dword [esp + 0xc], 0x21
mov dword [esp + 0x70], 0x218
mov dword [esp + 0x1c], eax
mov eax, dword [0x566d44]
mov ecx, dword [eax]
push 0
add esi, 0x48
push esi
lea edx, [esp + 0x10]
push edx
push eax
call dword [ecx + 0x18]
mov edi, eax
test edi, edi
jge 0x416bd3
push 0x53138c
mov dword [0x566d50], 0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call fcn.00416590
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x6c
ret 4
mov eax, dword [esi]
pop edi
mov dword [0x566d50], eax
mov eax, 1
pop esi
add esp, 0x6c
ret 4
Function at 0x416bf0
Capabilities:
Print debug messages

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [0x566d50]
add esi, 0x48
push esi
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 4
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov esi, eax
test esi, esi
jge 0x416c34
push 0x5313ac
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00416590
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
mov eax, 1
pop esi
pop ecx
ret

Function at 0x416c40
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x24]
mov edx, dword [ebx + 8]
push ebp
push esi
sub edx, dword [ebx]
mov esi, dword [ebx + 4]
add edx, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0xc]
mov ebp, ecx
mov ecx, dword [esp + 0x28]
sub eax, esi
add eax, ecx
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
lea ebx, [ebx]
mov al, byte [ebp + 0x3c]
mov edx, dword [ebp + 0x48]
mov ecx, dword [edi]
test al, 1
push 0
lea eax, [esp + 0x14]
je 0x416c99
push 0x1008000
jmp 0x416c9e
push 0x1000000
push ebx
push edx
push eax
push edi
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jge 0x416cdd
cmp esi, 0x887601c2
jne 0x416cfe
mov eax, dword [ebp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
mov esi, eax
test esi, esi
jl 0x416cec
mov eax, dword [0x566d50]
mov edx, dword [eax]
push eax
call dword [edx + 0x6c]
mov esi, eax
test esi, esi
jl 0x416cf3
cmp esi, 0x887601c2
je 0x416c80
jmp 0x416cfe
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 0x10
push 0x5313e0
jmp 0x416cf8
push 0x5313c8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00416590
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
Function at 0x416d20
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov eax, dword [0x566d50]
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x20
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
mov esi, eax
test esi, esi
jge 0x416d7e
push 0x5313f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00416590
add esp, 4
xor eax, eax
pop esi
add esp, 0x20
ret
mov edx, dword [esp + 0x14]
xor al, al
test dl, 1
mov byte [0x566d08], al
jne 0x416d9e
mov edi, edi
shr edx, 1
inc al
test dl, 1
je 0x416d90
mov byte [0x566d08], al
mov eax, dword [esp + 0x18]
xor cl, cl
test al, 1
mov byte [0x566d0c], dl
mov byte [0x566d09], cl
jne 0x416dc2
shr eax, 1
inc cl
test al, 1
je 0x416db4
mov byte [0x566d09], cl
mov ecx, dword [esp + 0x1c]
push ebx
xor bl, bl
test cl, 1
mov byte [0x566d0d], al
mov byte [0x566d0a], bl
jne 0x416def
lea esp, [esp]
shr ecx, 1
inc bl
test cl, 1
je 0x416de0
mov byte [0x566d0a], bl
cmp dword [esp + 0x14], 0x10
mov byte [0x566d0e], cl
pop ebx
ja 0x416e27
cmp dl, 0x1f
sete dl
add dl, 2
cmp al, 0x1f
sete al
add al, 2
cmp cl, 0x1f
sete cl
add cl, 2
mov byte [0x566d10], dl
mov byte [0x566d11], al
mov byte [0x566d12], cl
mov eax, 1
pop esi
add esp, 0x20
ret

Function at 0x416e40
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x416ea4
mov edx, dword [ecx + 0x48]
test edx, edx
je 0x416ea4
push esi
xor edx, edx
mov esi, eax
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edx
mov dword [eax], 0x20
mov ecx, dword [ecx + 0x48]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x54]
mov esi, eax
test esi, esi
jge 0x416e9b
push 0x5313f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00416590
add esp, 4
xor eax, eax
pop esi
ret 4
mov eax, 1
pop esi
ret 4
xor eax, eax
ret 4
Function at 0x416eb0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xe0
push ebx
mov ebx, dword [esp + 0xec]
push ebp
push esi
xor esi, esi
cmp ebx, esi
push edi
mov edi, ecx
jne 0x416efb
mov eax, dword [edi + 0x48]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0x6c
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
lea ebx, [esp + 0x10]
mov edx, dword [esp + 0xf4]
mov ebp, dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov dword [esp + 0x8c], 0x64
mov dword [esp + 0xdc], edx
lea ebx, [ebx]
mov eax, dword [edi + 0x48]
mov ecx, dword [eax]
lea edx, [esp + 0x8c]
push edx
push 0x1000400
push 0
push 0
push ebx
push eax
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jge 0x416f75
push 0x531410
call ebp
push esi
call fcn.00416590
add esp, 4
cmp esi, 0x887601c2
jne 0x416f66
mov eax, dword [edi + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
test eax, eax
jge 0x416f20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe0
ret 8
test ebx, ebx
jne 0x416f81
lea ecx, [edi + 0x54]
call fcn.0041e470
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xe0
ret 8

Function at 0x416fd0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x566d50]
mov ecx, dword [eax]
push esi
push 1
push 0
push eax
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
jge 0x417014
cmp esi, 0x887601c2
jne 0x41701b
mov eax, dword [0x566d50]
mov edx, dword [eax]
push eax
call dword [edx + 0x6c]
mov esi, eax
test esi, esi
jl 0x417033
mov eax, dword [0x566d50]
mov ecx, dword [eax]
push 1
push 0
push eax
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
jl 0x416fe6
mov eax, 1
pop esi
ret
push 0x531444
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00416590
add esp, 4
xor eax, eax
pop esi
ret
push 0x531420
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00416590
add esp, 4
xor eax, eax
pop esi
ret

Function at 0x4171c0
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x48]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x44]
mov esi, eax
test esi, esi
jge 0x417207
lea esp, [esp]
cmp esi, 0x887601c2
jne 0x41721d
mov eax, dword [edi + 0x48]
mov edx, dword [eax]
push eax
call dword [edx + 0x6c]
mov esi, eax
test esi, esi
jl 0x417212
mov eax, dword [edi + 0x48]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x44]
mov esi, eax
test esi, esi
jl 0x4171e0
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
push 0x531488
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.00416590
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x417230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52b6e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004165d0
xor ebx, ebx
mov dword [esi], 0x5314a8
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], ebx
mov dword [esp + 0x14], ebx
mov byte [esi + 8], bl
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 1
call fcn.0041e3e0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x418a30
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
mov esi, ecx
mov dword [esp + 0x34], 0x46464952
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x45564157
mov dword [esp + 0x40], 0x20746d66
mov dword [esp + 0x44], ebx
mov dword [esp + 0x2c], 0x61746164
mov dword [esp + 0x30], ebx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x418ac5
mov ecx, dword [esi + 0x3c8]
push ecx
call fcn.0051c16d
lea edx, [esi + 0xf8]
push edx
mov dword [esi + 0x3c8], ebx
call fcn.0050ca00
add esp, 8
or eax, edi
pop edi
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
pop esi
pop ebx
add esp, 0x20
ret 0xc
push ebp
mov ebp, dword [esp + 0x3c]
push ebx
push ebx
lea eax, [ebp + 0x1c]
push eax
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [esi + 0x3dc], ebx
mov dword [esp + 0x3c], ebx
mov ebx, dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, esi
call fcn.00418370
test eax, eax
mov dword [esp + 0x10], eax
jl 0x418bb8
mov edx, dword [esi + 0x3d4]
mov eax, dword [esi + 0x3c8]
push 0
lea ecx, [esp + 0x38]
push ecx
push edx
push eax
push edi
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x418b39
mov eax, dword [esi + 0x3dc]
test eax, eax
je 0x418ae7
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x3c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0xc
push 1
push 0
push 0
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub eax, 8
push 0
mov dword [esp + 0x24], eax
push 0
sub eax, ebp
push 0
sub eax, 0x14
push edi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x28], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 0
lea ecx, [esp + 0x38]
push ecx
push 0x14
lea edx, [esp + 0x28]
push edx
push edi
call ebx
mov ecx, dword [esp + 0x38]
push 0
lea eax, [esp + 0x38]
push eax
push ebp
push ecx
push edi
call ebx
push 0
lea edx, [esp + 0x38]
push edx
push 8
lea eax, [esp + 0x20]
push eax
push edi
call ebx
push edi
mov dword [esi + 0x3dc], 1
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x3c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0xc
mov ecx, esi
call fcn.00418210
push edi
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x3c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0xc

Function at 0x419b60
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edi
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x419ba2
cmp dword [esp + 8], esi
jne 0x419ba2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x419b9c
push eax
push esi
push edi
call fcn.00419aa0
add esp, 0xc
pop edi
mov al, 1
pop esi
pop ecx
ret
call dword [sym.imp.kernel32.dll_GetLastError]
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x419bb0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edi
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x419bf2
cmp dword [esp + 8], esi
jne 0x419bf2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x419bec
push eax
push esi
push edi
call fcn.00419aa0
add esp, 0xc
pop edi
mov al, 1
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x41b280
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
mov esi, ecx
movzx ecx, word [esi + 0x10]
push 0x41b120
push eax
push ecx
push 0xfffffffffffffffa
push eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.user32.dll_GetWindowLongA]
push eax
call dword [sym.imp.user32.dll_CreateDialogParamA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x41b2dd
push 0x530474
push eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0x5317f4
mov dword [esp + 0x28], 0x296
call fcn.0041ce50
add esp, 0xc
xor al, al
pop esi
pop ecx
ret 0x14
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.user32.dll_MoveWindow]
mov eax, dword [esi + 0xc]
push 1
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov al, 1
pop esi
pop ecx
ret 0x14
Function at 0x41c660
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x404
push ebx
mov ebx, dword [esp + 0x40c]
cmp ebx, 0xffffffff
push edi
je 0x41c72c
mov edi, dword [esp + 0x414]
test edi, edi
je 0x41c72c
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c690
sub eax, edx
cmp eax, 0x400
mov dword [esp + 8], eax
jbe 0x41c6ac
mov dword [esp + 8], 0x400
push ebp
mov ebp, dword [esp + 0x41c]
push ebp
push 4
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00419bb0
add esp, 0x10
test al, al
jne 0x41c6d5
pop ebp
pop edi
xor al, al
pop ebx
add esp, 0x404
ret
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
jbe 0x41c6f7
lea ecx, [esp + 0x14]
sub edi, ecx
lea ecx, [esp + eax + 0x14]
mov dl, byte [edi + ecx]
xor dl, 0x53
inc eax
cmp eax, esi
mov byte [ecx], dl
jb 0x41c6e6
push ebp
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.00419bb0
add esp, 0x10
test al, al
pop esi
je 0x41c6c9
mov eax, dword [esp + 0x420]
test eax, eax
je 0x41c720
mov ecx, dword [esp + 0xc]
add ecx, 4
mov dword [eax], ecx
pop ebp
pop edi
mov al, 1
pop ebx
add esp, 0x404
ret
pop edi
xor al, al
pop ebx
add esp, 0x404
ret

Function at 0x41cb00
Capabilities:
Get file size

Disassembly:
push ecx
push ebp
push 0x567580
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x567598]
or ebp, 0xffffffff
test eax, eax
je 0x41cbbf
push edi
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41cbd4
push 2
push 0
push 0
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 0
push edi
mov ebp, edi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xa00000
jae 0x41cbbe
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x14]
push esi
shl eax, 0x10
push eax
push ecx
lea esi, [esp + 0x18]
call fcn.0041c740
add esp, 8
test al, al
pop esi
pop ebx
je 0x41cbbe
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push eax
push 0x566d80
call fcn.0051d04d
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x566d80
push edi
call fcn.0041c660
add esp, 0x1c
test al, al
je 0x41cbbe
lea eax, [esp + 8]
mov ecx, edi
call fcn.0041ca10
pop edi
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x567580
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop ebp
pop ecx
ret
or ebp, 0xffffffff
jmp 0x41cbbe