joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41577a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x415817
push ebx
push esi
call fcn.00415743
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004156d7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4157c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415816
push edi
push eax
call fcn.00411495
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4157e4
call fcn.0041145b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415815
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004156d7
add esp, 0x20
test eax, eax
jne 0x415803
push edi
call fcn.0041145b
jmp 0x41580b
push ebx
call fcn.0041145b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4164d3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x420278
push 0x420270
push str.FlsAlloc
push 0x1f
call fcn.004163ef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416507
push dword [ebp + 8]
mov ecx, esi
call dword [0x41e1e8]
call esi
jmp 0x41650d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x416551
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x420288
push 0x420280
push str.FlsGetValue
push 0x21
call fcn.004163ef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416588
push dword [ebp + 8]
mov ecx, esi
call dword [0x41e1e8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x416590
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x420290
push 0x420288
push str.FlsSetValue
push 0x22
call fcn.004163ef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4165ca
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41e1e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x41c060
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c08d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c08d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100381c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100381cf
pop dword [ebp - 8]
mov eax, 0x100381cf
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x57c9d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x42d9
xor edx, edx
add edx, eax
mov esi, 0x1059932e
sub esi, 0x49512e
add esi, dword [ebp - 8]
mov ebx, 0xeb3b513d
add ebx, 0x475300ac
sub dword [ebp - 4], 0x49fb633f
mov edi, dword [esi]
add dword [ebp - 4], esi
xor edi, ebx
sub dword [ebp - 4], ecx
mov dword [edx], edi
xor dword [ebp - 4], 0xe2c30523
add edx, 0x4c747c7c
sub edx, 0x4c747c78
add esi, 0x75ca3f3e
add esi, 0x8a35c0c6
loop 0x10038220
add eax, 0xfe37
xor ebx, ebx
add ebx, eax
add eax, 0x88e75bbc
add eax, 0x7718a449
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x10038e70
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100ef014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x10015094
mov edi, 8
lea esp, [esp]
push 0x27
lea eax, [ebp - 0x54]
push eax
push dword [esi - 4]
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov eax, dword [esi]
test eax, eax
je 0x10038ee4
lea ecx, [ebp - 0x58]
push ecx
push 0x20006
push 0
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10038ee4
push 0x100151a0
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x58]
push eax
push 0x20006
push 0
push 0x100151a0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10038f6d
lea eax, [ebp - 0x5c]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10038f64
push 0x100151e8
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x100151d8
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [esi], 0
je 0x10038f4e
push 0x100151c8
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0x14
sub edi, 1
jne 0x10038e90
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100396b0
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x1000e5e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000e5f2
pop dword [ebp - 0x28]
mov eax, 0x1000e5f2
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x3142e113
sub dword [ebp - 0x38], 0xe2f09bc8
mov dword [ebp - 0x34], 0x5ffb7372
sub dword [ebp - 0x34], 0x2dc8272d
mov dword [ebp - 0x30], 0x9d9bf7b5
sub dword [ebp - 0x30], 0x514fb387
mov dword [ebp - 0x2c], 0x42ac5378
add dword [ebp - 0x2c], 0xbd53ac88
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xe0076f78
sub dword [ebp - 0x38], 0x6b950622
mov dword [ebp - 0x34], 0x5b13410b
add dword [ebp - 0x34], 0xe659206a
mov dword [ebp - 0x30], 0x2a1e6a02
sub dword [ebp - 0x30], 0xc6aefd96
mov dword [ebp - 0x2c], 0xdfa737d0
add dword [ebp - 0x2c], 0x2058c830
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x3423d518
add eax, 0xdbdd5ad0
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x37704
push 0
call eax
mov ecx, 0x657c1490
add ecx, 0x9a8436f0
xor ebx, ebx
add ebx, eax
mov esi, 0x40a938e6
add esi, 0xcf58511a
add esi, dword [ebp - 0x28]
mov edi, 0x96fa78dc
add dword [ebp - 4], edx
mov edx, dword [esi]
xor edx, edi
mov dword [ebp - 8], 0x6c7d1ee5
mov dword [ebx], edx
add dword [ebp - 0x14], 0x595f9c4a
add ebx, 4
add esi, 4
loop 0x1000e706
add eax, 0xe5c5aaf9
add eax, 0x1a3b75da
xor ebx, ebx
add ebx, eax
add eax, 0x446f24c6
add eax, 0xbb90db3f
mov ecx, 0xf1c66316
add ecx, 0x1e399cea
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x1001408
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x100144b
push esi
lea ecx, [eax + 8]
call dword [sym.imp.ulib.dll_public:_class_WSTRING____thiscall_PATH::QueryFullPathString_void_const]
mov esi, eax
cmp esi, ebx
je 0x100144a
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1001442
cmp word [eax], bx
je 0x1001442
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001442
test ah, 0x10
je 0x1001442
mov bl, 1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
mov al, bl
pop ebx
ret 4

Function at 0x1006427
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x100643c
popal
leave
ret 0xc
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408b8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x408b9d
pop dword [ebp - 0xc]
mov eax, 0xbbb84c52
add eax, 0x44883f4b
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x39e9c
push 0
mov eax, 0xe531a01f
sub eax, 0xe4f0bf47
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xb7ed65b2
add ecx, 0x4812e522
xor edi, edi
add edi, eax
mov edx, 0x7f817fdd
sub edx, 0x7f404419
add edx, dword [ebp - 0xc]
mov esi, 0xce845a6e
sub esi, 0xb4ad127c
sub dword [ebp - 4], ebx
mov ebx, dword [edx]
mov dword [ebp - 4], 0x3cf80566
sub ebx, esi
xor dword [ebp - 4], 0x3a8f9f6d
mov dword [edi], ebx
xor dword [ebp - 8], ecx
add edi, 0x53d9edeb
sub edi, 0x53d9ede7
add edx, 0x934f3b6b
add edx, 0x6cb0c499
loop 0x408bfe
add eax, 0xb876e135
sub eax, 0xb875c312
mov ebx, eax
add eax, 0xb35a66ea
add eax, 0x4ca5991b
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x8af058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008af1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8af07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8af06a
add dl, dl
jne 0x8af089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8af0dc
xor eax, eax
add dl, dl
jne 0x8af096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8af17d
add dl, dl
jne 0x8af0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8af0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8af0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8af0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8af0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8af075
mov eax, 1
add dl, dl
jne 0x8af0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8af0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8af0e1
sub eax, ebx
mov ebx, 1
jne 0x8af128
mov ecx, 1
add dl, dl
jne 0x8af10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8af119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8af105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8af075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8af13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8af14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8af136
cmp eax, 0x7d00
jae 0x8af16d
cmp eax, 0x500
jb 0x8af168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8af075
cmp eax, 0x7f
ja 0x8af170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8af075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8af19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8af075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x43a3ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x43a3cd
xor eax, eax
jmp 0x43a470
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x43a40c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x43a46e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0043a36a
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x43a46c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x43a470
jmp 0x43a403
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.2980fcc1
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x2980fcc1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2980fcd0
pop dword [ebp - 0x2c]
mov eax, 0x16daa841
sub eax, 0xed59ab71
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x99c67e15
sub dword [ebp - 0x3c], 0x4b7438ca
mov dword [ebp - 0x38], 0x52d50d50
add dword [ebp - 0x38], 0xdf5e3ef5
mov dword [ebp - 0x34], 0x4d891dbc
add dword [ebp - 0x34], 0xfec32672
mov dword [ebp - 0x30], 0x88cbdb0c
sub dword [ebp - 0x30], 0x88cbdb0c
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x48f7b1f8
add eax, 0xe08dbec8
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xb0d3a05f
sub dword [ebp - 0x3c], 0x3c613709
mov dword [ebp - 0x38], 0x1cf2d514
add dword [ebp - 0x38], 0x24798c61
mov dword [ebp - 0x34], 0xec77577b
add dword [ebp - 0x34], 0x76f814f1
mov dword [ebp - 0x30], 0xc71a6767
sub dword [ebp - 0x30], 0xc71a6767
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x9685a343
sub eax, 0x6d00328b
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x47ba3
push 0
call eax
mov ecx, 0x2d54d5b3
add ecx, 0xd2ab7148
mov edi, eax
mov edx, 0xdcc54c05
sub edx, 0xb33be805
add edx, dword [ebp - 0x2c]
mov esi, 0x44250772
sub esi, 0xd661c73b
add dword [ebp - 0x18], 0x35eac0a6
mov ebx, dword [edx]
xor dword [ebp - 0x20], edi
sub ebx, esi
mov dword [edi], ebx
add edi, 0x50038b36
sub edi, 0x50038b32
add edx, 4
loop 0x2980fdf2
add eax, 0xc031bfcf
add eax, 0x3fcf4ef0
mov ebx, eax
add eax, 0x7028e0fb
add eax, 0x8fd71f0a
mov ecx, 0xd14b9cc7
sub ecx, 0xa7cb9cc7
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2980fcc1
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.2980fcc1
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2980fcc1
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2980fcc1
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2980fcc1
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2980fcc1
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10