joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100240e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.10004680
mov eax, dword [esp + 0x40]
push ebx
xor ebx, ebx
dec eax
push ebp
push esi
cmp eax, 0x29
push edi
mov dword [esp + 0x10], ebx
jl 0x10024278
mov ecx, dword [esp + 0x4c]
mov edi, eax
sub edi, ecx
jns 0x10024116
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
lea ebp, [eax - 0x14]
push 0x7a
sub esi, edi
push str..crypto_rsa_rsa_oaep.c
push ebp
add esi, 0x14
call fcn.1000ea00
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10024158
push 0x7d
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.10008b20
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push ebp
push esi
lea eax, [esp + 0x1c]
push 0x14
push eax
call fcn.100242b0
add esp, 0x10
cmp edi, 0x14
mov eax, edi
jge 0x1002418b
mov edx, dword [esp + 0x48]
mov ecx, eax
sub ecx, edi
mov cl, byte [ecx + edx]
mov dl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x10024170
lea edx, [esp + 0x14]
push 0x14
push edx
push ebp
push ebx
call fcn.100242b0
add esp, 0x10
test ebp, ebp
jle 0x100241b3
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x100241a6
push 0
call fcn.100147c0
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x30]
push 0
push edx
push eax
push ecx
call fcn.10014590
add esp, 0x18
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x10024278
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10024278
mov eax, 0x14
cmp ebp, eax
jle 0x10024209
cmp byte [eax + ebx], 0
jne 0x10024209
inc eax
cmp eax, ebp
jl 0x100241fe
cmp byte [eax + ebx], 1
jne 0x10024278
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x10024278
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x1002424e
push 0x9b
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call fcn.10008b20
add esp, 0x14
or ebp, 0xffffffff
push ebx
call fcn.1000ec80
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
lea esi, [eax + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1000ec80
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.10008b20
add esp, 0x14
test ebx, ebx
je 0x1002429d
push ebx
call fcn.1000ec80
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x1002c990
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.10004680
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push edi
test ebp, ebp
jne 0x1002c9ae
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x1002ca5c
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1002ca2d
mov ecx, dword [ebx + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], edi
call fcn.1001a1d0
add esp, 8
test eax, eax
je 0x1002c9e9
mov eax, dword [eax + 8]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
mov esi, 0x10055424
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1002ca15
test cl, cl
je 0x1002ca11
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1002ca15
add eax, 2
add esi, 2
test cl, cl
jne 0x1002c9f1
xor eax, eax
jmp 0x1002ca1a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop esi
jne 0x1002ca2d
push ebp
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
jne 0x1002ca66
mov ecx, dword [ebx + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebp
call fcn.1001a1d0
add esp, 8
test eax, eax
je 0x1002c9a5
mov eax, dword [eax + 8]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push ebp
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1003cf90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x40
call fcn.10004680
push ebx
push ebp
push esi
mov esi, dword [esp + 0x5c]
xor eax, eax
push edi
test esi, esi
je 0x1003cfb5
mov ebx, dword [esp + 0x54]
mov eax, 1
mov dword [ebx], esi
jmp 0x1003cfc1
mov ebx, dword [esp + 0x54]
mov ecx, dword [ebx]
mov dword [esp + 0x60], ecx
mov esi, ecx
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x1003d0f6
mov edi, dword [esi + 0x40]
cmp edi, 0x40
jbe 0x1003cfe9
push str.j___sizeof_ctx__key
push 0x52
push str..cryptohmachmac.c
call fcn.100105f0
add esp, 0xc
mov ebp, dword [esp + 0x5c]
cmp edi, ebp
jge 0x1003d01f
mov edx, dword [esp + 0x64]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.10014250
mov eax, dword [esp + 0x64]
push ebp
push eax
push edi
call fcn.10014380
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.100143a0
add esp, 0x24
jmp 0x1003d054
cmp ebp, 0x40
jbe 0x1003d038
push str.len___sizeof_ctx__key
push 0x5c
push str..cryptohmachmac.c
call fcn.100105f0
add esp, 0xc
mov esi, dword [esp + 0x58]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x40
je 0x1003d076
mov ecx, 0x40
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0x60]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x40
jl 0x1003d07c
mov ebp, dword [esp + 0x64]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.10014250
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x1c]
push edx
push eax
push edi
call fcn.10014380
add esp, 0x18
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x40
jl 0x1003d0b0
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.10014250
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x1c]
push edx
push eax
push edi
call fcn.10014380
add esp, 0x18
lea ecx, [ebx + 0x14]
add ebx, 4
push ecx
push ebx
call fcn.10014420
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test eax, eax
je 0x1003d0de
jmp 0x1003d07a
Function at 0x1003e200
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xcc
call fcn.10004680
mov ecx, dword [esp + 0xd0]
push ebx
push ebp
push esi
lea esi, [ecx + 0x14]
lea eax, [ecx + 0x54]
push edi
lea edi, [esp + 0x5c]
mov ecx, dword [esi + 0x3c]
xor ebp, ebp
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x9c]
sub ecx, eax
sub edi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
sub esi, eax
mov ebx, dword [esp + 0xe4]
mov edx, dword [eax]
xor ecx, ecx
mov dword [edi + eax - 0x40], edx
mov cl, byte [ebx + ebp]
mov ebx, dword [esp + 0x14]
xor edx, ecx
mov dword [edi + eax], ecx
mov dword [ebx + eax], edx
mov edx, dword [esp + 0x10]
xor ecx, edx
add eax, 4
mov edx, dword [ecx*4 + str._.C]
mov ecx, dword [esi + eax - 4]
xor ecx, edx
inc ebp
mov dword [esi + eax - 4], ecx
cmp ebp, 0x10
mov dword [esp + 0x10], ecx
jl 0x1003e23d
xor ecx, ecx
xor esi, esi
lea eax, [esp + 0x20]
mov edx, 6
mov ecx, dword [ecx*4 + str._.C]
mov edi, dword [eax - 4]
xor edi, ecx
mov ecx, edi
mov dword [eax - 4], edi
mov ebp, dword [eax]
add eax, 0x20
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [eax - 0x20], ebp
mov ebx, dword [eax - 0x1c]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [eax - 0x1c], ebx
mov edi, dword [eax - 0x18]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [eax - 0x18], edi
mov ebp, dword [eax - 0x14]
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov dword [eax - 0x14], ebp
mov ebx, dword [eax - 0x10]
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov dword [eax - 0x10], ebx
mov edi, dword [eax - 0xc]
mov ecx, dword [ecx*4 + str._.C]
xor edi, ecx
mov ecx, edi
mov dword [eax - 0xc], edi
mov ebp, dword [eax - 8]
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
dec edx
mov dword [eax - 8], ebp
mov ecx, ebp
jne 0x1003e28c
add ecx, esi
and ecx, 0xff
inc esi
cmp esi, 0x12
jl 0x1003e283
mov edi, dword [esp + 0x18]
mov ecx, 0x10
lea esi, [esp + 0x1c]
lea edx, [esp + 0x1c]
push 0xc0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.10013280
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
Function at 0x10040640
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
cmp esi, 0x80
mov byte [eax], 0
jle 0x1004065c
mov esi, 0x80
mov ecx, dword [esp + 0x20]
test ecx, ecx
jle 0x1004066c
cmp ecx, 0x400
jle 0x10040671
mov ecx, 0x400
test esi, esi
jle 0x10040688
mov edi, dword [esp + 0x1c]
mov edx, eax
sub edi, eax
mov ebp, esi
mov bl, byte [edi + edx]
mov byte [edx], bl
inc edx
dec ebp
jne 0x1004067f
xor edx, edx
cmp esi, 0x80
mov dl, byte [eax + esi - 1]
jge 0x100406ba
mov edi, eax
sub edi, esi
mov bl, byte [edi + esi]
add ebx, edx
xor edx, edx
and ebx, 0xff
inc esi
cmp esi, 0x80
mov dl, byte [ebx + 0x1006faec]
mov byte [esi + eax - 1], dl
jl 0x1004069a
lea esi, [ecx + 7]
mov edx, 0x80
neg ecx
sar esi, 3
and ecx, 7
mov edi, 0xff
sub edx, esi
sar edi, cl
xor ecx, ecx
mov cl, byte [edx + eax]
and edi, ecx
xor ecx, ecx
mov cl, byte [edi + 0x1006faec]
mov edi, edx
mov byte [edx + eax], cl
dec edx
test edi, edi
je 0x1004070a
lea edi, [edx + eax]
lea ebp, [edx + 1]
xor edx, edx
mov dl, byte [edi + esi]
xor edx, ecx
xor ecx, ecx
dec ebp
dec edi
mov cl, byte [edx + 0x1006faec]
mov byte [edi + 1], cl
test ebp, ebp
ja 0x100406f2
lea esi, [eax + 0xfc]
mov ecx, 0x7f
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx + eax - 1]
mov bh, byte [ecx + eax]
and edx, 0xffff
sub esi, 4
or edx, ebx
sub ecx, 2
mov dword [esi + 4], edx
jns 0x10040715
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100443ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x100444bc
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x1004445a
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10042400
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1004442c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10044563
call 0x1004446c
pop edx
lea ecx, [edx + 0x108]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x1004450c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10042400
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100444c9
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10044563
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10042400
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x10044561
jmp 0x10044563
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10044594
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x1004466d
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1004460b
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100441a4
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100445dd
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x10044714
call 0x1004461d
pop edx
lea ecx, [edx + 0x108]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x100446bd
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100442c8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1004467a
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x10044714
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100442c8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x10044712
jmp 0x10044714
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10047820
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
mov edx, 0xfb100481
add dword [eax + edx], 0x1004868a
dec esi
je 0x10047864
insb byte es:[edi], dx
push esp
push 0x64616572
add byte [edi], cl
Function at 0x10047be3
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
sete byte [eax]
push ebx
push ebp
cld
cmp byte [0x10047c10], 0
je 0x10047bee
ret
mov eax, 0x10047c11
cmp byte [eax], 0
je 0x1004786b
push 0x40
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x10047c10], 0
je 0x10047bfc
ret

Function at 0x100481ba
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
or eax, 0x1000
push 0x40
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
leave
ret 8
Function at 0x40fe8d
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [0x419d80], 0
push ebx
je 0x40ffd3
push esi
push edi
push 0x5c
mov edi, 0x419d80
push edi
call dword [sym.imp.msvcrt.dll_strrchr]
mov dword [0x419d70], eax
pop ecx
pop ecx
test eax, eax
jne 0x40fecf
push 0x3a
push edi
call dword [sym.imp.msvcrt.dll_strrchr]
pop ecx
pop ecx
test eax, eax
jne 0x40fecf
mov eax, edi
jmp 0x40fed0
inc eax
xor ebx, ebx
mov dword [0x419d70], eax
push ebx
push 0x8000000
push 3
push ebx
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41001f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x419d68], eax
cmp eax, 0xffffffff
jne 0x40ff16
push edi
push 0x405ddc
jmp 0x410025
cmp eax, 0xffff0000
jbe 0x40ff29
push edi
push 0x405e10
push ebx
jmp 0x410027
test eax, eax
jne 0x40ff35
push edi
push 0x405e38
jmp 0x40ff23
mov ecx, eax
call fcn.004128dd
push ebx
lea ecx, [ebp - 4]
mov dword [0x419e84], eax
push ecx
push dword [0x419d68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ff63
push edi
push 0x405e60
jmp 0x410025
mov eax, dword [0x419d68]
cmp dword [ebp - 4], eax
jne 0x41002c
push 0x419e88
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x419d70]
call dword [sym.imp.msvcrt.dll__strupr]
pop ecx
mov ecx, dword [0x419d70]
call fcn.0040e503
pop edi
pop esi
test eax, eax
jne 0x40ffb4
push dword [0x419d70]
push 0x405ee0
jmp 0x40ff23
mov ecx, dword [0x419d70]
call fcn.0040e5d3
test eax, eax
jne 0x41001c
push dword [0x419d70]
push 0x405f18
jmp 0x40ff23
cmp dword [0x419f50], 0
mov ecx, 0x405f60
mov dword [0x419d70], 0x405f50
jne 0x40fff0
mov ecx, 0x405fe8
mov dword [0x419e84], ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fff9
mov eax, dword [0x419f90]
sub ecx, edx
mov dword [0x419e88], eax
mov eax, dword [0x419f94]
mov dword [0x419d68], ecx
mov dword [0x419e8c], eax
pop ebx
leave
ret
push edi
push 0x405db4
push 0xffffffffffffffff
call fcn.00412682
push eax
push dword [ebp - 4]
push edi
push 0x405e88
push ebx
call fcn.00412682
int3
Function at 0x411676
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push eax
push 0x8000000
push 3
push eax
push 1
push 0x80000000
push esi
mov ebx, edx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x411720
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x4116c2
push esi
push 0x406918
jmp 0x411726
test eax, eax
jne 0x4116d0
push esi
push 0x406950
push 0
jmp 0x411728
cmp eax, 0x1fffe00
ja 0x411718
cmp dword [ebp - 4], 0
jne 0x411718
mov ecx, eax
call fcn.004128dd
push 0
lea ecx, [ebp - 8]
mov dword [ebx + 0xc], eax
push ecx
push dword [ebx + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411704
push esi
push 0x4069b0
jmp 0x411726
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 8]
jne 0x41172d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
push esi
push 0x40697c
jmp 0x4116cc
push esi
push 0x4068e8
push 0xffffffffffffffff
call fcn.00412682
push dword [ebx + 8]
push eax
push esi
push 0x4069e0
push 0
call fcn.00412682
int3

Function at 0x4125ed
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x100
mov dword [0x418e04], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x412619
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x418e20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x401414
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
push ebx
push edi
push 1
call fcn.00417c69
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_vfprintf]
add esp, 0xc
test esi, esi
je 0x412664
push ecx
lea edx, [ebp - 0x100]
mov ecx, esi
call fcn.00412798
push eax
push 0x402654
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
pop ecx
push 1
call fcn.00417c69
push eax
call dword [sym.imp.msvcrt.dll_fflush]
pop ecx
pop ecx
call fcn.00412771
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4133c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [0x418db0], ecx
imul ecx, ecx, 0x14
push edi
call fcn.00412965
mov ecx, dword [0x418db0]
shl ecx, 2
mov dword [0x418da8], eax
call fcn.00412965
xor edi, edi
mov dword [0x418dac], eax
cmp dword [0x418db0], edi
jbe 0x413452
push esi
xor esi, esi
call fcn.00412b3b
mov ecx, dword [0x418da8]
mov dword [esi + ecx + 4], eax
call fcn.00412b3b
mov edx, dword [0x418da8]
mov ecx, dword [0x418dac]
add edx, esi
mov dword [edx + 8], eax
mov dword [ecx + edi*4], eax
lea eax, [ebp - 4]
push eax
push 0
push edx
push 0x413390
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x418da8]
mov dword [esi + ecx], eax
test eax, eax
je 0x413455
inc edi
add esi, 0x14
cmp edi, dword [0x418db0]
jb 0x4133fa
pop esi
pop edi
leave
ret
push 0x407028
push 0xffffffffffffffff
call fcn.00412682
int3
Function at 0x416be5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
mov edx, ecx
test esi, esi
je 0x416c0f
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x407850]
inc edi
sub esi, 1
jne 0x416bf7
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x416c17
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x416c46
movzx eax, byte [edx]
movzx ecx, si
shr ecx, 8
xor ecx, eax
shl esi, 8
xor si, word [ecx*2 + 0x407650]
inc edx
movzx esi, si
sub edi, 1
jne 0x416c27
pop edi
mov ax, si
pop esi
pop ebp
ret 4

Function at 0x417934
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x417de0
call fcn.00417bf8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x417994
cmp eax, 0xffffffff
je 0x417994
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41798d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41798d
cmp edx, 0x10000000
jae 0x41798d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41798a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x417a00
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x417a3e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x417a36
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x417a40
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x417a26
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x417b10
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x417b41
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x417b41
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x417b41
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret