joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10213d04
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
lea edx, [ebp - 0x50]
rcl cx, cl
shr cl, cl
shld eax, ebp, 0x87
mov dword [ebp - 0x2c], edx
and ax, di
mov eax, dword [ebp - 0x2c]
btr cx, ax
shrd ecx, ebp, 6
lea eax, [eax + 1]
inc dl
and dl, 0x87
mov dword [ebp - 0x230], eax
shl dl, cl
call fcn.100792e1
je 0x1026b755
mov eax, dword [ebp - 8]
movsx cx, dh
movsx ecx, byte [eax]
test ecx, ecx
jmp 0x10215278
je 0x1026b755
mov edx, dword [ebp - 0xc]
clc
cmp edx, dword [ebp - 0x14]
jae 0x1026b755
mov eax, dword [ebp - 0x218]
and cx, 0x3183
mov ecx, dword [ebp - 8]
mov dl, byte [ecx]
mov byte [ebp + eax - 0x83c], dl
mov eax, dword [ebp - 0x218]
sal ecx, cl
or cl, 0x3d
add eax, 1
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0xc]
xchg dh, dl
add ecx, 1
bt edx, ecx
mov dword [ebp - 0xc], ecx
add edx, 0xbd0fb7a8
sbb dx, bx
mov edx, dword [ebp - 8]
cmp cx, 0x65a4
stc
test bh, 0x1c
add edx, 1
jmp 0x1023245b
mov byte [ebp - 0x184], 0x74
mov byte [ebp - 0x183], 0x20
jmp 0x10250683
je 0x1006a04a
mov byte [ebp - 0x18c], 0x43
mov byte [ebp - 0x18b], 0x6f
mov byte [ebp - 0x18a], 0x75
cwde
mov dh, dh
xchg dx, dx
mov byte [ebp - 0x189], 0x6c
rdtsc
mov byte [ebp - 0x188], 0x64
bswap ax
mov byte [ebp - 0x187], 0x20
lahf
movsx dx, bl
mov byte [ebp - 0x186], 0x6e
mov byte [ebp - 0x185], 0x6f
jmp 0x1021b2d5
mov dword [ebp - 8], edx
jmp 0x10268ffd
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
cmp ebp, 0xbc923a23
cmp eax, 0xa
jmp 0x1027f460
call fcn.100a26f1
add esp, 0xc
cmp ah, 0xf
clc
cmp ebx, ebp
test eax, eax
jmp 0x1022b06b
mov byte [ebp - 0x182], 0x6c
cbw
movzx edx, bx
mov byte [ebp - 0x181], 0x6f
lahf
mov byte [ebp - 0x180], 0x61
mov byte [ebp - 0x17f], 0x64
mov byte [ebp - 0x17e], 0x20
cwde
cbw
mov byte [ebp - 0x17d], 0x53
cwde
mov edx, ebx
mov byte [ebp - 0x17c], 0x6c
mov dx, sp
jmp 0x10014b5f
jne 0x1026b7cd
mov ecx, dword [ebp - 0x28]
shr dx, 0x33
movsx edx, cx
shl ah, cl
sub ecx, dword [ebp - 0x228]
cdq
lahf
mov dword [ebp - 0x22c], ecx
cdq
xchg ah, dh
mov edx, dword [ebp - 0x22c]
push edx
lea eax, [ebp - 0x50]
movzx ecx, sp
not cl
push eax
lea ecx, [ebp - 0x83c]
push ecx
jmp 0x1023a51a
jmp 0x10234256
mov byte [ebp - 0x50], 0x46
test ebp, edx
mov byte [ebp - 0x4f], 0x69
rdtsc
bswap cx
mov byte [ebp - 0x4e], 0x6c
ror ah, 0x8c
mov byte [ebp - 0x4d], 0x65
cmp si, 0xa534
mov byte [ebp - 0x4c], 0x4e
mov byte [ebp - 0x4b], 0x61
shr ax, 0x1a
mov byte [ebp - 0x4a], 0x6d
mov byte [ebp - 0x49], 0x65
sal cx, 0xae
add ecx, edx
btc cx, 0x23
mov byte [ebp - 0x48], 0x3d
sbb dx, 0x917
mov byte [ebp - 0x47], 0
bt ax, 0x39
adc dl, 2
sal ecx, cl
lea eax, [ebp - 0x50]
mov dword [ebp - 0x28], eax
add dx, 0xb4b0
cmc
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx + 1]
or al, cl
mov dword [ebp - 0x228], ecx
inc edx
or edx, 0xf854415
shl al, cl
mov edx, dword [ebp - 0x28]
mov al, byte [edx]
mov byte [ebp - 0x16], al
add dword [ebp - 0x28], 1
cmp byte [ebp - 0x16], 0
jmp 0x102629e8
je 0x1026b755
mov ecx, dword [ebp - 8]
mov dx, 0xae12
movsx edx, byte [ecx]
test esp, eax
stc
cmc
cmp edx, 0xd
jmp 0x10213d09
Function at 0x1022017b
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
mov ebx, dword [esp + ebx - 0x15cb2944]
mov dword [esp + 0xc], 0x62f83a5
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.10078f37
je 0x10210cf8
mov byte [ebp - 0x1fc], 0x43
cbw
jmp loc.10038372

Function at 0x102397bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
call fcn.10213426
mov ecx, 0xcc893423
push edx
mov ecx, dword [ebp - 4]
jmp loc.10061ce9

Function at 0x10240eb5
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0xa
jmp 0x10250001
mov dword [ebp - 8], eax
jmp 0x10203a37
mov byte [ebp - 0x44], 0x44
rcl cx, cl
mov byte [ebp - 0x43], 0x65
or edx, 0x8a87b0be
xor ah, dh
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x41], 0x61
ror ecx, cl
bts ax, di
mov byte [ebp - 0x40], 0x79
mov al, ch
bsr eax, ebx
mov byte [ebp - 0x3f], 0x3d
mov byte [ebp - 0x3e], 0
mov dx, 0x1f09
not dl
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x38], ecx
dec cl
sbb eax, ebp
mov edx, dword [ebp - 0x38]
and ax, dx
add edx, 1
adc al, 0xb8
rcl ax, 0xad
and cl, bl
mov dword [ebp - 0x24c], edx
add ax, dx
mov eax, dword [ebp - 0x38]
mov cl, byte [eax]
cmc
test esi, ecx
mov byte [ebp - 0x1a], cl
cmc
test dx, 0x7a99
add dword [ebp - 0x38], 1
test cl, 0xbb
cmp byte [ebp - 0x1a], 0
jmp loc.10011605
mov dword [esp + 4], 0x630ed9f
lea esp, [esp + 4]
call fcn.10078f37
jae 0x1022d5a8
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 8]
mov al, byte [edx]
cmp esp, edx
bt dx, 0xac
mov byte [ebp + ecx - 0x100c], al
btc ax, dx
rol ecx, cl
mov ecx, dword [ebp - 0x210]
cwde
clc
sal al, 0x35
lea ecx, [ecx + 1]
bt dx, 0xf
mov dword [ebp - 0x210], ecx
rol ax, cl
sar dx, cl
btr ax, cx
mov edx, dword [ebp - 0xc]
ror ax, cl
not eax
add edx, 1
shld ax, si, 0xf
test ebp, 0x7cabcea4
xchg al, al
mov dword [ebp - 0xc], edx
bswap eax
btr eax, 3
movzx eax, di
mov eax, dword [ebp - 8]
add eax, 1
jmp 0x1021563b
je 0x1022d5a8
mov edx, dword [ebp - 8]
bsr eax, eax
btc ax, bp
movsx eax, byte [edx]
cmp bx, si
jmp loc.1007e00e

Function at 0x10245841
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check http status code

Disassembly:
mov edx, 0x3c2fe02e
pushfd
xor dx, dx
call fcn.102397bd

Function at 0x1024946e
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr dx, 0xe7
imul edx, edx
imul edx, edx
inc eax
ror edx, 0xf6
btr edx, edx
neg eax
mov ecx, edx
imul ecx, ecx
ror eax, 3
add ecx, 0xc9aa119
sal dx, 0x86
lea eax, [eax + edx + 0x76e2a0ed]
sbb cx, cx
xor ebx, eax
add esi, eax
mov dx, word [edi + edx - 0x4cc42d40]
or ecx, ecx
dec ecx
movzx eax, cx
mov cl, byte [eax + edi - 0xfffd]
idiv al
lea edi, [edi + eax*2]
imul eax, eax
shr dx, cl
neg eax
mov word [edi], dx
lea ecx, [eax + eax + 0x7e044f00]
adc ax, cx
dec eax
jmp esi
adc esi, edx
xadd cx, ax
lea edx, [eax*2 + 0x5f2db203]
neg cx
mov edi, dword [edi + edx - 0x52ffb20d]
jae 0x1022c1de
pop eax
pop eax
jbe fcn.100624c9
Function at 0x10253319
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x62f279c
call fcn.10078f37
movsx eax, bx

Function at 0x102541ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, ecx
add esi, ecx
lea ecx, [eax*8 + 0x2c839603]
movzx cx, byte [edi + edx*4 - 0x4e349004]
call fcn.1024dcd9
Function at 0x1027d9b5
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Terminate process

Disassembly:
ror eax, 1
dec eax
inc dl
shl edx, cl
neg eax
bts cx, 0x8b
rol eax, 1
neg eax
bswap eax
lea ecx, [edx*8 + 0x4dab6c13]
shl dword [esp + ecx - 0x7dcb6c13], cl
xor ebx, eax
bswap ecx
add esi, eax
imul dx, cx
mov edx, edi
imul ecx, dword [esp + ecx*4 - 0x4db32df4]
movsx eax, byte [esp]
mov dword [edi + eax - 4], edx
movzx edx, ax
btr ecx, eax
shl eax, 0xdf
lea edi, [edi + eax - 4]
sar cl, 0x87
xchg dword [esp + eax], ecx
pop edx
jns fcn.100624c9
not dl
mov word [edi + ecx - 0x20000000], dx
mov dword [esp + ecx - 0x20000000], 0x9f00200b
sar byte [esp + ecx*4 - 0x7ffffffd], 0x81
shl cl, 0xc1
mov eax, dword [ebp + ecx*2 - 0x40000005]
lea edx, [ecx + ecx*8 + 0x69b3f980]
xor cl, dh
xor ecx, dword [esp + ecx - 0x200000f9]
sbb ebp, 5
xor eax, ebx
jmp 0x10237b03
Function at 0x401122
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
jmp 0x40377f
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x20]
push edi
call fcn.00404dc4
pop ecx
test eax, eax
jne 0x403fd5
cmp ebp, 5
ja 0x403fd5
mov esi, dword [edi + 0x1c]
xor ecx, ecx
cmp dword [edi + 0xc], ecx
je 0x403fcd
cmp dword [edi + 4], ecx
je 0x4037c1
cmp dword [edi], ecx
je 0x403fcd
cmp dword [esi + 4], 0x29a
jne 0x4037d3
cmp ebp, 4
jne 0x403fcd
cmp dword [edi + 0x10], ecx
je 0x403841
mov edx, dword [esi + 0x28]
mov dword [esi + 0x28], ebp
cmp dword [esi + 0x14], ecx
je 0x4037fa
push edi
call fcn.0040550b
pop ecx
xor ecx, ecx
cmp dword [edi + 0x10], ecx
je 0x403fc5
mov ebx, dword [esi + 4]
jmp 0x403830
mov ebx, dword [esi + 4]
cmp dword [edi + 4], ecx
jne 0x403830
xor eax, eax
cmp edx, 4
push 9
pop ecx
cmovg eax, ecx
add edx, edx
sub edx, eax
xor ecx, ecx
cmp ebp, 4
push 9
mov eax, dword [str.stream_error]
mov dword [edi + 0x18], eax
push 0xfffffffffffffffe

Function at 0x40138e
Capabilities:
Terminate process

Disassembly:
jmp 0x40e9c8
cmp dword [esp + 4], 0
mov edx, str.error_unpacking_archive
cmovne edx, dword [esp + 4]
cmp byte [edx], 0x40
lea eax, [edx + 1]
cmovne eax, edx
push eax
push 0x4258e0
push dword [ecx + 0x68]
call fcn.0040146a
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x401b80
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xc40db94
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0xc40db94]
cmp eax, dword [0xc40db9c]
jne 0x401bb8
mov ecx, dword [0xc40db98]
cmp ecx, dword [0xc40dba0]
jne 0x401bb8
mov dword [0xc40dbbc], 0
jmp 0x401bc2
mov dword [0xc40dbbc], 1
push 0xc40db9c
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0xc40db94
mov edx, dword [0xc40dbc4]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [0xc40dbc4]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x401c16
mov ecx, dword [0xc40da78]
mov edx, dword [ecx]
mov eax, dword [0xc40da78]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov edx, dword [0x840d65c]
mov eax, dword [edx]
mov ecx, dword [0x840d65c]
push ecx
mov edx, dword [eax + 0x1c]
call edx
push 0xc40da80
push 0x100
mov eax, dword [0xc40da78]
mov ecx, dword [eax]
mov edx, dword [0xc40da78]
push edx
mov eax, dword [ecx + 0x24]
call eax
push 0xc40db80
push 0x10
mov ecx, dword [0x840d65c]
mov edx, dword [ecx]
mov eax, dword [0x840d65c]
push eax
mov ecx, dword [edx + 0x24]
call ecx
mov dword [ebp - 4], 0
jmp 0x401c5f
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x100
jge 0x401ca0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xc40da80]
and ecx, 0x80
je 0x401c94
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xc40d878]
test eax, eax
jne 0x401c94
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc40d978], 1
jmp 0x401c9e
mov edx, dword [ebp - 4]
mov byte [edx + 0xc40d978], 0
jmp 0x401c56
mov dword [ebp - 8], 0
jmp 0x401cb2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x401ce5
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0xc40da80]
and edx, 0x80
je 0x401cd9
mov eax, dword [ebp - 8]
mov byte [eax + 0xc40d878], 1
jmp 0x401ce3
mov ecx, dword [ebp - 8]
mov byte [ecx + 0xc40d878], 0
jmp 0x401ca9
mov dword [0xc40dbb4], 0
mov dword [0xc40dbb8], 0
cmp dword [0xc40db88], 0
jge 0x401d0e
mov dword [0xc40dbb8], 1
jmp 0x401d21
cmp dword [0xc40db88], 0
jle 0x401d21
mov dword [0xc40dbb4], 1
mov edx, 1
imul eax, edx, 0
movzx ecx, byte [eax + 0xc40db8c]
and ecx, 0x80
je 0x401d56
cmp dword [0xc40dba4], 0
jne 0x401d56
cmp dword [0xc40db98], 0
jle 0x401d56
mov dword [0xc40dbac], 1
jmp 0x401d60
mov dword [0xc40dbac], 0
mov edx, 1
shl edx, 0
movzx eax, byte [edx + 0xc40db8c]
and eax, 0x80
je 0x401d94
cmp dword [0xc40dba8], 0
jne 0x401d94
cmp dword [0xc40db98], 0
jle 0x401d94
mov dword [0xc40dbb0], 1
jmp 0x401d9e
mov dword [0xc40dbb0], 0
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [edx + 0xc40db8c]
and eax, 0x80
je 0x401dc0
mov dword [0xc40dba4], 1
jmp 0x401dca
mov dword [0xc40dba4], 0
mov ecx, 1
shl ecx, 0
movzx edx, byte [ecx + 0xc40db8c]
and edx, 0x80
je 0x401ded
mov dword [0xc40dba8], 1
jmp 0x401df7
mov dword [0xc40dba8], 0
cmp dword [0xc40db94], 0
jg 0x401e0a
mov dword [0xc40db94], 0
cmp dword [0xc40db94], 0x500
jl 0x401e20
mov dword [0xc40db94], 0x500
cmp dword [0xc40db98], 0
jg 0x401e33
mov dword [0xc40db98], 0
cmp dword [0xc40db98], 0x2d0
jl 0x401e49
mov dword [0xc40db98], 0x2d0
mov esp, ebp
pop ebp
ret
Function at 0x403a60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0xc40dbc8], eax
mov ecx, dword [0xc40dbc8]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.00403d60
add esp, 8
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [0x40d0ac]
push ecx
mov edx, dword [0x40d0b0]
push edx
push Ordinal_1
push Ordinal_1
push 0xcb0000
push str.Frame
push 0x409a68
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [0xc40dbc4], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.004014b0
push 0
push 0xf
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, 1
test edx, edx
je 0x403b2f
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x403b2d
cmp dword [ebp - 0x1c], 0x12
jne 0x403b19
jmp 0x403b2f
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x403af2
call fcn.004018c0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4052d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x4052fc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x4053e2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x405393
jg 0x405325
cmp dword [ebp + 0xc], 0
jbe 0x405393
cmp dword [ebp - 8], 0
jl 0x405393
jg 0x405333
cmp dword [ebp - 0xc], 0
jbe 0x405393
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x405351
jl 0x405345
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x405351
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.00406860
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x4053d6
jg 0x4053a1
cmp dword [ebp + 0xc], 0
jbe 0x4053d6
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x4053d6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4053f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x405410
jl 0x405407
cmp dword [ebp + 0xc], 0
ja 0x405410
xor eax, eax
xor edx, edx
jmp 0x40554d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x405433
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x40554d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4054a5
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00405560
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00406860
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x40553e
mov ecx, dword [ebp - 8]
call fcn.004060c0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x405516
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x405514
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x40554d
jmp 0x4054c1
cmp dword [ebp - 4], 0
jbe 0x40553e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x40d078]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x406177
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40617e
mov al, 1
jmp 0x40625b
call fcn.004067c0
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.004067c0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00406820
add esp, 8
movzx eax, al
test eax, eax
je 0x4061ba
xor al, al
jmp 0x40625b
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4061f7
cmp dword [ebp - 0x30], 1
je 0x4061fe
cmp dword [ebp - 0x30], 3
je 0x40624e
jmp 0x406259
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x40622e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x40622e
xor al, al
jmp 0x40625b
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x406242
mov dword [ebp - 0x38], 1
jmp 0x406249
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x40625b
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x40625b
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407105
mov esp, ebp
pop ebp
ret
Function at 0x408476
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x408485
pop dword [ebp - 0x48]
mov eax, 0xbb42000b
add eax, 0x44fe847a
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x54a43
push 0
mov eax, 0xd09df49a
add eax, 0x2fa6be22
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x5a55
xor esi, esi
add esi, eax
mov edi, 0x75954f4b
sub edi, 0x754cd14b
add edi, dword [ebp - 0x48]
mov ebx, 0xd2825bcd
add ebx, 0x6a974405
sub dword [ebp - 0x1c], esi
mov edx, dword [edi]
xor dword [ebp - 0x10], ecx
sub edx, ebx
xor dword [ebp - 0x3c], edi
mov dword [esi], edx
add esi, 0x5f7df59c
add esi, 0xa0820a68
add edi, 0xb1472b71
sub edi, 0xb1472b6d
loop 0x4084e0
add eax, 0x8cffa54a
sub eax, 0x8cfe4923
xor ebx, ebx
add ebx, eax
add eax, 0x49a3c554
add eax, 0xb65c3ab1
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret