joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1f54
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b202b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b2048
push ebx
push 0x4b2058
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4b1fd6
mov ax, 0x83
call fcn.004b1b78
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004b1f28
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4b1fdf
call fcn.004b1f28
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2032
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4b2148
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4b2213
jmp 0x4b2207
cmp dword [esi + 0x10], 0x1000
jne 0x4b21f3
test byte [esi + 0x15], 1
jne 0x4b21f3
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4b21a4
cmp ebp, 2
je 0x4b21a4
cmp ebp, 0x10
je 0x4b21a4
cmp ebp, 0x20
jne 0x4b21c0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4b21c0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4b21d1
mov eax, dword [esi]
add eax, ebx
call fcn.004b2140
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4b21c4
cmp byte [esp + 4], 0
je 0x4b21f3
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4b2213
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4b2179
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10c1d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10c1d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10c1d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c1d06a
add dl, dl
jne 0x10c1d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c1d0dc
xor eax, eax
add dl, dl
jne 0x10c1d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c1d17d
add dl, dl
jne 0x10c1d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c1d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c1d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c1d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10c1d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10c1d075
mov eax, 1
add dl, dl
jne 0x10c1d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c1d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c1d0e1
sub eax, ebx
mov ebx, 1
jne 0x10c1d128
mov ecx, 1
add dl, dl
jne 0x10c1d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10c1d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c1d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c1d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10c1d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10c1d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c1d136
cmp eax, 0x7d00
jae 0x10c1d16d
cmp eax, 0x500
jb 0x10c1d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c1d075
cmp eax, 0x7f
ja 0x10c1d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c1d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10c1d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10c1d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x30003f0
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x76a97798
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x41f8c6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f8cc
ret

Function at 0x42b1d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b383
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405c72
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x42b39a
call fcn.004058ce
mov eax, ebx
call fcn.0041d1ca
mov edi, eax
dec edi
test edi, edi
jl 0x42b28a
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041d19e
mov edx, dword [0x4314d6]
call fcn.0040495e
test al, al
je 0x42b286
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041d19e
lea edx, [ebp - 0x14]
call fcn.0043887e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405c72
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405942
inc esi
dec edi
jne 0x42b238
mov al, byte [0x42b39e]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42b3aa
mov eax, dword [ebp - 0xc]
call fcn.0040ec42
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0040565a
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0043887e
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42b39a
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0043887e
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42b39a
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42b39a
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42b3b6
call fcn.0040adde
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b38a
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004055e6
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004055e6
lea eax, [ebp - 0x14]
call fcn.004055c2
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004055e6
ret
Function at 0x4ca630
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x4ca64d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ca63e
add dl, dl
jne 0x4ca658
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ca6a4
xor eax, eax
add dl, dl
jne 0x4ca665
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ca741
add dl, dl
jne 0x4ca674
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ca67f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ca68a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ca695
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4ca69f
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x4ca644
mov eax, 1
add dl, dl
jne 0x4ca6b2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ca6bd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ca6a9
sub eax, 2
jne 0x4ca6ec
mov ecx, 1
add dl, dl
jne 0x4ca6d2
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4ca6dd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ca6c9
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4ca644
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4ca703
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4ca70e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ca6fa
cmp eax, 0x7d00
jae 0x4ca731
cmp eax, 0x500
jb 0x4ca72c
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4ca644
cmp eax, 0x7f
ja 0x4ca734
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4ca644
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4ca75d
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4ca644
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x40f4b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
mov eax, dword [0xa37210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x728], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x724], ebx
push esi
mov esi, ecx
test eax, eax
jne 0x40f4f1
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b964
mov esp, ebp
pop ebp
ret 0x10
test ebx, ebx
je 0x40f4dd
push eax
push 1
lea eax, [ebp - 0x71d]
push 1
push eax
call fcn.0057d2a8
push 0x200
lea eax, [ebp - 0x604]
push 0
push eax
call fcn.0057c870
lea edx, [esi + 0x10]
add esp, 0x1c
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f524
push edi
sub ecx, esi
lea eax, [ebp - 0x604]
push ecx
push edx
push eax
call fcn.0057bdd0
push 0x100
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x71c]
push eax
call fcn.00410490
xor esi, esi
add esp, 0x18
mov dword [ebp - 0x72c], esi
cmp dword [ebp + 0x10], esi
jle 0x40f69a
mov edi, ebx
lea ebx, [ebx]
push dword [ebp - 0x728]
lea eax, [ebp - 0x404]
push 0x10
push 1
push eax
call fcn.0057d2a8
add esp, 0x10
cmp eax, 0x10
jne 0x40f6de
lea eax, [ebp - 0x404]
push eax
push eax
lea eax, [ebp - 0x71c]
push 0
push eax
call fcn.0040f7a0
lea ecx, [esi + 0xf]
add esp, 0x10
lea edx, [ebp - 0x3f5]
xor eax, eax
add ecx, ebx
cmp edi, edx
ja 0x40f5c6
lea edx, [ebp - 0x404]
cmp ecx, edx
jae 0x40f61d
movdqu xmm0, xmmword [ebp - 0x404]
mov eax, 0x10
xorps xmm1, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm2, xmmword [edi]
paddb xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
paddb xmm2, xmm0
movd ecx, xmm2
add byte [ebp + 0x14], cl
xor bl, bl
xor dl, dl
cmp eax, 0x10
jge 0x40f67f
mov ecx, 0x10
sub ecx, eax
cmp ecx, 2
jl 0x40f653
mov cl, byte [ebp + eax - 0x404]
mov byte [edi + eax], cl
add bl, cl
mov cl, byte [ebp + eax - 0x403]
mov byte [edi + eax + 1], cl
add dl, cl
add eax, 2
cmp eax, 0xf
jl 0x40f632
cmp eax, 0x10
jge 0x40f675
mov cl, byte [ebp + eax - 0x404]
add eax, dword [ebp - 0x724]
mov esi, dword [ebp - 0x72c]
mov byte [eax + esi], cl
mov eax, dword [ebp + 0x14]
add al, cl
jmp 0x40f678
mov eax, dword [ebp + 0x14]
add dl, bl
add al, dl
mov dword [ebp + 0x14], eax
mov ebx, dword [ebp - 0x724]
add esi, 0x10
add edi, 0x10
mov dword [ebp - 0x72c], esi
cmp esi, dword [ebp + 0x10]
jl 0x40f570
push dword [ebp - 0x728]
lea eax, [ebp - 0x71e]
push 1
push 1
push eax
call fcn.0057d2a8
mov al, byte [ebp - 0x71d]
add esp, 0x10
cmp al, byte [ebp - 0x71e]
jne 0x40f6ec
cmp al, byte [ebp + 0x14]
jne 0x40f6ec
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b964
mov esp, ebp
pop ebp
ret 0x10
push 0
push str.Error__
push str.fread_Error__
jmp 0x40f6f8
push 0
push str.Error__
push str.CheckCrc_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057b964
mov esp, ebp
pop ebp
ret 0x10
Function at 0x410230
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0xa37210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
lea ecx, [ecx]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x410250
mov esi, 1
mov edx, 0xa40190
lea esp, [esp]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0xa401b8
jl 0x410290
mov eax, 1
mov byte [0xa3df90], 0x63
mov byte [0xa3f0f3], 0
mov dword [ebp - 0x808], eax
mov edi, edi
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 0x808]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0xa3df90], bl
mov byte [ebx + 0xa3f090], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x4102d0
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
lea esp, [esp]
movzx edx, byte [esi + 0xa3df90]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0xa3f090]
mov dword [esi*4 + 0xa3e090], eax
rol eax, 8
mov dword [esi*4 + 0xa3e490], eax
rol eax, 8
mov dword [esi*4 + 0xa3e890], eax
rol eax, 8
mov dword [esi*4 + 0xa3ec90], eax
test ecx, ecx
je 0x410423
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x41042f
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0xa3f190], eax
rol eax, 8
mov dword [esi*4 + 0xa3f590], eax
rol eax, 8
mov dword [esi*4 + 0xa3f990], eax
rol eax, 8
mov dword [esi*4 + 0xa3fd90], eax
inc esi
cmp esi, 0x100
jl 0x410360
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057b964
mov esp, ebp
pop ebp
ret
Function at 0x410490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0xa37210]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub eax, 0x80
je 0x4104d4
sub eax, 0x40
je 0x4104cc
sub eax, 0x40
jne 0x410680
mov dword [edi], 0xe
jmp 0x4104da
mov dword [edi], 0xc
jmp 0x4104da
mov dword [edi], 0xa
push esi
push ecx
push edx
lea eax, [ebp - 0x11c]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.00410690
mov eax, dword [ebp - 0x11c]
add esp, 0xc
shl eax, 4
add eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
sub eax, 0x10
mov dword [esi + 0xc], ecx
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x410669
jmp 0x410530
movzx ecx, byte [eax + 3]
dec edi
movzx edx, byte [ecx + 0xa3df90]
movzx ecx, byte [eax + 2]
mov edx, dword [edx*4 + 0xa3fd90]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f990]
movzx ecx, byte [eax + 1]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f590]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f190]
mov dword [esi], edx
movzx ecx, byte [eax + 4]
movzx edx, byte [ecx + 0xa3df90]
movzx ecx, byte [eax + 7]
mov edx, dword [edx*4 + 0xa3f190]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3fd90]
movzx ecx, byte [eax + 6]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f990]
movzx ecx, byte [eax + 5]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f590]
mov dword [esi + 4], edx
movzx ecx, byte [eax + 8]
movzx edx, byte [ecx + 0xa3df90]
movzx ecx, byte [eax + 0xb]
mov edx, dword [edx*4 + 0xa3f190]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3fd90]
movzx ecx, byte [eax + 0xa]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f990]
movzx ecx, byte [eax + 9]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f590]
mov dword [esi + 8], edx
movzx ecx, byte [eax + 0xc]
movzx edx, byte [ecx + 0xa3df90]
movzx ecx, byte [eax + 0xf]
mov edx, dword [edx*4 + 0xa3f190]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3fd90]
movzx ecx, byte [eax + 0xe]
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f990]
movzx ecx, byte [eax + 0xd]
sub eax, 0x10
movzx ecx, byte [ecx + 0xa3df90]
xor edx, dword [ecx*4 + 0xa3f590]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x410530
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0057b964
mov esp, ebp
pop ebp
ret
Function at 0x412d00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0xa37210]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xa402c0], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
je 0x412d66
push eax
push dword [ebp + 0xc]
push ecx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0xa401c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0xa401c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x412ea5
int3
test eax, eax
je 0x412d85
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ecx
push str._s_line:_d__msg:_s_
push eax
call fcn.0057cecc
add esp, 0x14
jmp 0x412d9d
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ecx
push str._s_line:_d_
push eax
call fcn.0057cecc
add esp, 0x10
push 0xff
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
call fcn.0057c870
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x20e]
push eax
movzx eax, word [ebp - 0x212]
push eax
movzx eax, word [ebp - 0x214]
push eax
lea eax, [ebp - 0x104]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.0057cecc
add esp, 0x14
cmp dword [0xa40318], 0
jne 0x412ea5
push esi
push edi
push 0
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x412e71
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x104]
push 0x5ad1cc
push eax
call fcn.0057ccfb
mov esi, eax
add esp, 8
test esi, esi
je 0x412ea3
call fcn.00412340
push eax
lea eax, [ebp - 0x204]
push eax
push str._stime:_s_n
push esi
call fcn.0057cd55
push esi
call fcn.0057cbc0
add esp, 0x14
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b964
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp - 0x2a0]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x412e26
mov dword [0xa40318], 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b964
mov esp, ebp
pop ebp
ret
Function at 0x412ec0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0xa37210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x303]
push edi
mov edi, dword [ebp + 0x10]
push 0x1ff
push 0
push eax
mov byte [ebp - 0x304], 0
call fcn.0057c870
add esp, 0xc
lea eax, [ebp - 0x304]
test edi, edi
je 0x412f17
push edi
push dword [ebp + 0xc]
push esi
push str._s_line:_d__msg:_s_
push eax
call fcn.0057cecc
add esp, 0x14
jmp 0x412f29
push dword [ebp + 0xc]
push esi
push str._s_line:_d_
push eax
call fcn.0057cecc
add esp, 0x10
push 0xff
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
call fcn.0057c870
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x30e]
push eax
movzx eax, word [ebp - 0x312]
push eax
movzx eax, word [ebp - 0x314]
push eax
lea eax, [ebp - 0x104]
push str.._Log_Debug__4d_02d_02d.txt
push eax
call fcn.0057cecc
add esp, 0x14
cmp dword [0xa40560], 0
jne 0x41302d
push 0
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x412ffb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x104]
push 0x5ad1cc
push eax
call fcn.0057ccfb
mov esi, eax
add esp, 8
test esi, esi
je 0x41302d
call fcn.00412340
push eax
lea eax, [ebp - 0x304]
push eax
push str._stime:_s_n
push esi
call fcn.0057cd55
push esi
call fcn.0057cbc0
add esp, 0x14
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b964
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp - 0x3a0]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x412fb0
mov dword [0xa40560], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0057b964
mov esp, ebp
pop ebp
ret