joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cd4
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x150
push ebx
mov ebx, dword [esp + 0x15c]
push esi
mov esi, dword [esp + 0x15c]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00405bf6
mov dword [esp + 0x10], eax
test bl, 8
je 0x405d16
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4474a8], eax
jmp 0x405eb2
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x1c], ebp
je 0x405d33
test eax, eax
je 0x405e63
test bl, 2
je 0x405e63
push esi
push 0x43a228
call fcn.004060a1
test ebp, ebp
je 0x405d54
push str..
push 0x43a228
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x405d5a
push esi
call fcn.00406207
cmp byte [esi], 0
jne 0x405d68
cmp byte [0x43a228], 0x5c
jne 0x405d74
push 0x4082a0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push 0x43a228
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x405e53
lea ebp, [esp + 0x4c]
push 0x3f
mov eax, ebp
push eax
call fcn.00405bb9
cmp byte [eax], 0
je 0x405dc5
cmp byte [esp + 0x150], 0
lea eax, [esp + 0x150]
cmove eax, ebp
mov ebp, eax
cmp byte [ebp], 0x2e
jne 0x405ddc
mov al, byte [ebp + 1]
test al, al
je 0x405e30
cmp al, 0x2e
jne 0x405ddc
cmp byte [ebp + 2], 0
je 0x405e30
push ebp
push dword [esp + 0x14]
call fcn.004060a1
test byte [esp + 0x20], 0x10
je 0x405dff
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x405e30
push ebx
push esi
call fcn.00405cd4
jmp 0x405e30
push edi
push esi
call fcn.00405b48
test eax, eax
jne 0x405e28
test edi, edi
je 0x405e20
push esi
push 0xfffffffffffffff1
call fcn.004055de
push 0
push esi
call fcn.00405966
jmp 0x405e30
inc dword [0x4474a8]
jmp 0x405e30
push esi
push 0xfffffffffffffff2
call fcn.004055de
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405d9e
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x405e5f
mov eax, dword [esp + 0x10]
mov byte [eax - 1], 0
mov eax, dword [esp + 0x14]
test ebp, ebp
pop ebp
je 0x405eb2
test eax, eax
je 0x405ea2
push esi
call fcn.00405b92
test eax, eax
je 0x405eb2
push esi
call fcn.00405b1b
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00405b48
test eax, eax
jne 0x405eaa
test edi, edi
je 0x405ea2
push esi
push 0xfffffffffffffff1
call fcn.004055de
push 0
push esi
call fcn.00405966
jmp 0x405eb2
inc dword [0x4474a8]
jmp 0x405eb2
push esi
push 0xffffffffffffffe5
call fcn.004055de
pop edi
pop esi
pop ebx
add esp, 0x150
ret 8

Function at 0x405ef4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc
Function at 0x405f52
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
mov byte [esi], bl
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405fc4
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0x2000
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405fb3
cmp dword [ebp + 0x14], 1
je 0x405fb5
cmp dword [ebp + 0x14], 2
je 0x405fb5
mov byte [esi], bl
push dword [ebp - 4]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x405fe8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add byte [ebp + 0xa], dl
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x406027
test edi, edi
jne 0x405ff3
mov byte [esi], al
jmp 0x406029
mov eax, esi
pop edi
pop esi
pop ebp
ret 8

Function at 0x406110
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406132
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x4062f8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43ef6c], 0
push esi
jne 0x406330
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
dec esi
jne 0x406309
mov dword [ecx*4 + 0x43ef68], edx
inc ecx
cmp ecx, 0x100
jl 0x406304
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x40635a
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x43ef68]
inc esi
dec edx
jne 0x406342
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x439390
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x497b50]
sub esp, 0x190
test eax, eax
jne 0x4393d2
push edi
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [0x497b50], 1
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
neg eax
sbb eax, eax
pop edi
add esp, 0x190
ret
mov eax, 0xfffffffa
add esp, 0x190
ret

Function at 0x439410
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, 1
test ebp, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
je 0x43958d
mov esi, dword [esp + 0x30]
test esi, esi
je 0x43958d
push 4
call fcn.0043ed10
add esp, 4
mov dword [ebp], eax
mov dword [eax], 0xffffffff
push 6
push edi
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43946a
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 0x34]
xor eax, eax
mov dword [esp + 0x18], eax
push ecx
mov dword [esp + 0x20], eax
mov word [esp + 0x1c], 2
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call sub.WSOCK32.dll_htons
push esi
mov word [esp + 0x1e], ax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x4394d8
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4394b8
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x18
ret
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
lea edi, [esp + 0x1c]
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push ebx
call sub.WSOCK32.dll_ioctlsocket
cmp eax, 0xffffffff
jne 0x4394f7
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x18
ret
lea edx, [esp + 0x14]
push 4
push edx
push edi
push 6
push ebx
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x439516
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x18
ret
lea eax, [esp + 0x2c]
push 4
push eax
push 0x80
push 0xffff
mov dword [esp + 0x3c], 0
push ebx
mov word [esp + 0x40], di
mov word [esp + 0x42], 5
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x439550
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x18
ret
lea ecx, [esp + 0x18]
push 0x10
push ecx
push ebx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x43957b
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x43957b
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0x18
ret
mov edx, dword [ebp]
pop edi
pop esi
pop ebp
mov dword [edx], ebx
mov eax, 0xfffffffb
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x18
ret
Function at 0x4396b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4396e9
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4396e9
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4396e9
mov edx, dword [esp + 0xc]
push 0
push edx
push ecx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x4396ee
call sub.WSOCK32.dll_WSAGetLastError
sub eax, 0x2733
neg eax
sbb eax, eax
ret
mov eax, 0xfffffffe
ret

Function at 0x439750
Capabilities:
Get common file path

Disassembly:
push edi
mov ecx, 0x41
xor eax, eax
mov edi, 0x497d68
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
mov edi, 0x497b58
push 0x497b58
rep stosd dword es:[edi], eax
push 0x105
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
pop edi
mov eax, 0x497568
je 0x43978e
mov eax, 0x497b58
push esi
push str.assets
push 0x472a70
push eax
push 3
call fcn.0043e860
push 0x104
push eax
call fcn.0043e910
mov esi, 0x497d68
add esp, 0x18
mov ecx, eax
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x4397b8
push eax
call fcn.00460b8f
add esp, 4
mov eax, 0x497d68
pop esi
ret

Function at 0x4397e0
Capabilities:
Get common file path

Disassembly:
push edi
mov ecx, 0x41
xor eax, eax
mov edi, 0x497e70
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
mov edi, 0x497b58
push 0x497b58
rep stosd dword es:[edi], eax
push 0x105
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
pop edi
mov eax, 0x497568
je 0x43981e
mov eax, 0x497b58
push esi
push str.settings.ini
push 0x472a70
push eax
push 3
call fcn.0043e860
push 0x104
push eax
call fcn.0043e910
mov esi, 0x497e70
add esp, 0x18
mov ecx, eax
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x439848
push eax
call fcn.00460b8f
add esp, 4
mov eax, 0x497e70
pop esi
ret

Function at 0x43ed10
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.00461765
add esp, 4
test eax, eax
jne 0x43ed35
push str.Out_of_memory___the_application_will_now_close.
call fcn.00430510
add esp, 4
push 1
call fcn.00461672
ret

Function at 0x43ed40
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call fcn.0046189f
add esp, 8
test eax, eax
jne 0x43ed6a
push str.Out_of_memory___the_application_will_now_close.
call fcn.00430510
add esp, 4
push 1
call fcn.00461672
ret

Function at 0x43ed70
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call fcn.004619dc
add esp, 8
test eax, eax
jne 0x43ed9a
push str.Out_of_memory___the_application_will_now_close.
call fcn.00430510
add esp, 4
push 1
call fcn.00461672
ret
Function at 0x443060
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0x10
call fcn.0043ed10
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 4]
mov esi, eax
mov eax, dword [esp + 0xc]
push edx
push 0
push esi
push 0x4431c0
push 0
push 0
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4430ab
push esi
call fcn.00460b8f
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop ecx
ret

Function at 0x446190
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4462f8
cmp dword [esp + 8], 0x2c
jb 0x4462f8
xor ecx, ecx
xor edx, edx
mov ch, byte [eax + 3]
mov dl, byte [eax + 1]
mov cl, byte [eax + 2]
push esi
mov esi, dword [esp + 0x10]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dword [esi], ecx
mov dl, byte [eax + 5]
xor ecx, ecx
mov ch, byte [eax + 7]
mov cl, byte [eax + 6]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 4]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dword [esi + 4], ecx
mov dl, byte [eax + 9]
xor ecx, ecx
mov ch, byte [eax + 0xb]
mov cl, byte [eax + 0xa]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 8]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dword [esi + 8], ecx
mov dl, byte [eax + 0xd]
xor ecx, ecx
mov ch, byte [eax + 0xf]
mov cl, byte [eax + 0xe]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xc]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dword [esi + 0xc], ecx
mov dl, byte [eax + 0x11]
xor ecx, ecx
mov ch, byte [eax + 0x13]
mov cl, byte [eax + 0x12]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0x10]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dword [esi + 0x10], ecx
xor ecx, ecx
mov ch, byte [eax + 0x15]
mov cl, byte [eax + 0x14]
mov word [esi + 0x14], cx
mov dh, byte [eax + 0x17]
mov dl, byte [eax + 0x16]
xor ecx, ecx
mov word [esi + 0x16], dx
mov ch, byte [eax + 0x1b]
mov cl, byte [eax + 0x1a]
xor edx, edx
mov dl, byte [eax + 0x19]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0x18]
shl ecx, 8
or ecx, edx
mov dword [esi + 0x18], ecx
xor ecx, ecx
mov ch, byte [eax + 0x1f]
xor edx, edx
mov cl, byte [eax + 0x1e]
mov dl, byte [eax + 0x1d]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0x1c]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dword [esi + 0x1c], ecx
xor ecx, ecx
mov ch, byte [eax + 0x21]
mov cl, byte [eax + 0x20]
mov word [esi + 0x20], cx
mov dh, byte [eax + 0x23]
mov dl, byte [eax + 0x22]
xor ecx, ecx
mov word [esi + 0x22], dx
mov ch, byte [eax + 0x27]
mov cl, byte [eax + 0x26]
xor edx, edx
mov dl, byte [eax + 0x25]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0x24]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dword [esi + 0x24], ecx
mov dl, byte [eax + 0x29]
xor ecx, ecx
mov ch, byte [eax + 0x2b]
mov cl, byte [eax + 0x2a]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0x28]
mov eax, 1
shl ecx, 8
or ecx, edx
mov dword [esi + 0x28], ecx
pop esi
ret
xor eax, eax
ret
Function at 0x450440
Capabilities:
Check http status code

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x140
jne 0x45046a
mov eax, dword [esp + 8]
cmp eax, 0xc8
jne 0x450459
xor eax, eax
ret
cmp eax, 0xf0
jne 0x450641
mov eax, 1
ret
cmp eax, 0x190
jne 0x450486
mov eax, dword [esp + 8]
cmp eax, 0x100
jne 0x450592
mov eax, 2
ret
cmp eax, 0x200
jne 0x4504a2
mov eax, dword [esp + 8]
cmp eax, 0x180
jne 0x450536
mov eax, 3
ret
cmp eax, 0x280
jne 0x4504e5
mov eax, dword [esp + 8]
cmp eax, 0xc8
jne 0x4504ba
mov eax, 4
ret
cmp eax, 0x15e
jne 0x4504c7
mov eax, 5
ret
cmp eax, 0x190
jne 0x4504d4
mov eax, 6
ret
cmp eax, 0x1e0
jne 0x450641
mov eax, 7
ret
cmp eax, 0x320
jne 0x450500
cmp dword [esp + 8], 0x258
jne 0x450641
mov eax, 8
ret
cmp eax, 0x3c0
jne 0x45051b
cmp dword [esp + 8], 0x2d0
jne 0x450641
mov eax, 9
ret
cmp eax, 0x358
jne 0x450547
cmp dword [esp + 8], 0x1e0
jne 0x450641
mov eax, 0xa
ret
cmp eax, 0x100
jne 0x450641
mov eax, 0xb
ret
cmp eax, 0x400
jne 0x450562
cmp dword [esp + 8], 0x300
jne 0x450641
mov eax, 0xc
ret
cmp eax, 0x500
jne 0x45057a
mov eax, dword [esp + 8]
cmp eax, 0x400
jne 0x4505be
mov eax, 0xd
ret
cmp eax, 0x640
jne 0x4505a3
mov eax, dword [esp + 8]
cmp eax, 0x4b0
jne 0x4505cb
mov eax, 0xe
ret
cmp eax, 0x12c
jne 0x450641
mov eax, 0xf
ret
cmp eax, 0x480
jne 0x4505d8
cmp dword [esp + 8], 0x360
jne 0x450641
mov eax, 0x10
ret
cmp eax, 0x3c0
jne 0x450641
mov eax, 0x11
ret
cmp eax, 0x400
jne 0x450641
mov eax, 0x12
ret
cmp eax, 0x700
jne 0x4505ef
cmp dword [esp + 8], 0x540
jne 0x450641
mov eax, 0x13
ret
cmp eax, 0x740
jne 0x450606
cmp dword [esp + 8], 0x570
jne 0x450641
mov eax, 0x14
ret
cmp eax, 0x780
jne 0x45061d
cmp dword [esp + 8], 0x5a0
jne 0x450641
mov eax, 0x15
ret
cmp eax, 0x800
jne 0x450641
mov eax, dword [esp + 8]
cmp eax, 0x600
jne 0x450635
mov eax, 0x16
ret
cmp eax, 0x800
mov eax, 0x17
je 0x450646
mov eax, 0xff
ret
Function at 0x45e950
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
je 0x45e988
mov esi, dword [esp + 0xc]
test esi, esi
je 0x45e988
or eax, 0xffffffff
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x46e478]
xor eax, edx
inc ecx
dec esi
jne 0x45e965
pop ebx
pop esi
not eax
ret
xor eax, eax
pop esi
ret

Function at 0x45e990
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
push edi
je 0x45eace
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
jb 0x45eace
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov edx, ebx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
shr edx, 3
shl edx, 3
test edx, edx
mov dword [esp + 0x10], edx
jbe 0x45ea4c
dec edx
shr edx, 3
inc edx
mov dword [esp + 0x24], edx
xor edx, edx
mov dword [esp + 0x28], 0x20
mov ebx, ecx
mov ebp, ecx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, edx
and ebp, 3
add ebx, ecx
mov ebp, dword [edi + ebp*4]
add ebp, edx
sub edx, 0x61c88647
xor ebx, ebp
add eax, ebx
mov ebx, eax
mov ebp, eax
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, edx
shr ebp, 0xb
and ebp, 3
add ebx, eax
mov ebp, dword [edi + ebp*4]
add ebp, edx
xor ebx, ebp
add ecx, ebx
mov ebx, dword [esp + 0x28]
dec ebx
mov dword [esp + 0x28], ebx
jne 0x45e9e0
mov edx, dword [esi]
mov ebp, dword [esi + 4]
xor eax, edx
mov edx, dword [esp + 0x24]
xor ecx, ebp
mov dword [esi], eax
mov dword [esi + 4], ecx
add esi, 8
dec edx
mov dword [esp + 0x24], edx
jne 0x45e9d6
mov ebx, dword [esp + 0x2c]
and ebx, 7
mov dword [esp + 0x2c], ebx
jbe 0x45eace
mov edx, eax
xor eax, eax
mov ebx, 0x20
mov esi, ecx
mov ebp, ecx
shr esi, 5
shl ebp, 4
xor esi, ebp
mov ebp, eax
and ebp, 3
add esi, ecx
mov ebp, dword [edi + ebp*4]
add ebp, eax
sub eax, 0x61c88647
xor esi, ebp
add edx, esi
mov esi, edx
mov ebp, edx
shr esi, 5
shl ebp, 4
xor esi, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
add esi, edx
mov ebp, dword [edi + ebp*4]
add ebp, eax
xor esi, ebp
add ecx, esi
dec ebx
jne 0x45ea5e
mov esi, dword [esp + 0x2c]
xor eax, eax
test esi, esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
jbe 0x45eace
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
add ecx, edx
mov dl, byte [esp + eax + 0x14]
mov bl, byte [ecx + eax]
xor bl, dl
mov byte [ecx + eax], bl
inc eax
cmp eax, esi
jb 0x45eabd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x45ec50
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov esi, dword [esp + 0x14]
push edi
mov eax, 0xc6ef3720
mov edi, 0x20
mov ebx, edx
mov ebp, edx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
add ebx, edx
mov ebp, dword [esi + ebp*4]
add ebp, eax
add eax, 0x61c88647
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
mov ebp, ecx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
and ebp, 3
add ebx, ecx
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
sub edx, ebx
dec edi
jne 0x45ec6b
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret

Function at 0x45ecc0
Capabilities:
Generate random numbers via winapi

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x45ed13
mov esi, dword [esp + 0x10]
cmp esi, 1
jb 0x45ed13
push 0xf0000000
push 1
push 0
lea eax, [esp + 0x18]
push 0
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x45ed13
mov ecx, dword [esp + 0xc]
push edi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
push 0
jne 0x45ed18
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, 1
pop esi
ret
Function at 0x46328d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x473848
cmp edx, dword [eax]
je 0x4632af
add eax, 8
inc ecx
cmp eax, 0x4738d8
jl 0x4632a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x473848]
jne 0x4633dd
mov eax, dword [0x499818]
cmp eax, 1
je 0x4633b7
test eax, eax
jne 0x4632e0
cmp dword [0x4734b8], 1
je 0x4633b7
cmp edx, 0xfc
je 0x4633dd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x463317
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004694b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00468110
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x46335a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00468110
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x46ec30
push edi
call fcn.00469a20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004694b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004694c0
lea eax, [ebp - 0xa0]
push 0x472b40
push eax
call fcn.004694c0
push dword [esi + 0x47384c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004694c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00469994
add esp, 0x2c
pop edi
jmp 0x4633dd
lea eax, [ebp + 8]
lea esi, [esi + 0x47384c]
push 0
push eax
push dword [esi]
call fcn.00468110
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret