joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dadb9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x564d28]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4dadfd
cmp word [edx], bx
jne 0x4dadfd
or byte [edi + eax + 0x28], 4
jmp 0x4dae02
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4daf56
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4daf36
cmp ax, word [ebp - 0x10]
je 0x4dae3b
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4daf2b
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4dae61
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4dae51
push ecx
pop eax
push 4
jmp 0x4dae56
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4daf25
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4daf1c
cmp dword [ebp - 0x18], 0
je 0x4daf1c
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x564d28]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4daee8
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4daeac
mov word [esi], ax
jmp 0x4daee0
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x564d28]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x564d28]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x564d28]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4daf2b
cmp word [ebp - 4], ax
jne 0x4daefd
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4daefd
mov word [esi], ax
add esi, 2
jmp 0x4daf2b
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004dc915
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4daf28
jmp 0x4daf1f
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4dae1b
jmp 0x4daf56
mov ecx, dword [ecx*4 + 0x564d28]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4daf4d
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4daf56
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e2a00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004e3010
add esp, 8
test al, al
je 0x4e2a25
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4e2a25
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4e3010
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4e44c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e44eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e44eb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4e5ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x55b524]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x4e5ae0
mov esi, dword [esi]
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00491810
push 0x20a
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00491810
push esi
push 0x53cb9c
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00409c90
add esp, 0x28
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea eax, [ebp - 0x210]
push eax
push 0x51f758
push 0x53cba4
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.00409c90
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.00491810
lea eax, [ebp - 0x210]
push eax
push str.SoftwareClasses_s
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00409c90
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x41c]
push eax
push SysReAllocString
call fcn.004e70e0
push 0x20a
lea eax, [ebp - 0x834]
push 0
push eax
call fcn.00491810
add esp, 0x48
lea eax, [ebp - 0x210]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts_s
lea eax, [ebp - 0x834]
push 0x104
push eax
call fcn.00409c90
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x834]
push eax
push SysReAllocString
call fcn.004e70e0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x838]
push eax
call fcn.004e6930
push 0x104
lea eax, [ebp - 0x318]
push 0
push eax
call fcn.00491810
add esp, 0x30
mov dword [ebp - 0x840], 0
lea eax, [ebp - 0x83c]
mov dword [ebp - 0x83c], 0x104
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x840]
push eax
push str.ProgId
push dword [ebp - 0x838]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov edx, dword [ebp - 0x838]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4e5c86
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
pop esi
test bl, bl
pop ebx
jne 0x4e5ca2
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004e6060
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462c38
mov esp, ebp
pop ebp
ret 4
Function at 0x4e6de0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x55b524]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x20a
push 0
push eax
mov dword [ebp - 0x21c], ebx
call fcn.00491810
add esp, 0xc
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x51d334
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x4e6e72
push 0x51d334
push edi
push esi
call ebx
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00491810
add esp, 0xc
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push str.BiscuitZip_bak
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4e6f04
cmp word [ebp - 0x210], 0
je 0x4e6efb
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
push 1
push 0x51d334
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.BiscuitZip_bak
push edi
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462c38
mov esp, ebp
pop ebp
ret

Function at 0x4e70e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x55b524]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x20a
push 0
push eax
mov dword [ebp - 0x220], esi
call fcn.00491810
add esp, 0xc
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x51d334
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x21c], eax
mov eax, esi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e7160
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x51d334
push ebx
push edi
call esi
cmp dword [ebp - 0x21c], 0
jne 0x4e71c6
cmp word [ebp - 0x210], 0
je 0x4e71c6
push dword [ebp - 0x220]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4e71c6
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
push 1
push str.BiscuitZip_bak
push ebx
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462c38
mov esp, ebp
pop ebp
ret
Function at 0x4e7950
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x55b524]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00491810
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x51f758
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e79be
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00491810
add esp, 0xc
lea eax, [ebp - 0x20c]
push str.config.ini
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
push eax
push 0x526084
push str.linkA
push str.LinkType
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462c38
mov esp, ebp
pop ebp
ret
Function at 0x4e97b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x55b524]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x68
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x9c]
push 0
push eax
movlpd qword [ebp - 0xb4], xmm0
movlpd qword [ebp - 0xac], xmm0
movlpd qword [ebp - 0xc], xmm0
call fcn.00491810
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.00435980
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x9c]
push esi
push edi
push eax
call fcn.004359d0
lea eax, [ebp - 0x9c]
push eax
call fcn.004356b0
movups xmm0, xmmword [ebp - 0x44]
push 0x20
lea eax, [ebp - 0x34]
push eax
movups xmmword [ebp - 0xc4], xmm0
push esi
xorps xmm0, xmm0
push edi
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.00505320
push 0x400
lea eax, [ebp - 0x4c4]
push 0
push eax
call fcn.00491810
mov eax, esi
add esp, 0x40
and al, 4
cmp al, 1
sbb eax, eax
shr esi, 2
neg eax
lea ebx, [esi - 1]
add ebx, eax
cmp ebx, 1
jbe 0x4e99b6
test bl, 1
jne 0x4e99b6
lea ecx, [ebp - 0x4c4]
dec eax
push ecx
lea ecx, [ebp - 0xc4]
add eax, esi
push ecx
push eax
push edi
call fcn.004e9400
add esp, 0x10
test al, al
je 0x4e99b6
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.004e95c0
add esp, 0x10
test al, al
je 0x4e99b6
mov eax, dword [ebp - 0x4c4]
xor eax, dword [ebp - 0x4bc]
mov edi, dword [ebp - 0xa4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x4c0]
xor eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xa0], eax
add edi, 4
mov dl, byte [ebp + eax - 0x14]
lea ecx, [eax + 1]
cmp ecx, 8
jb 0x4e9904
xor bh, bh
jmp 0x4e9908
mov bh, byte [ebp + eax - 0x13]
cmp ecx, 8
sbb ecx, ecx
neg ecx
inc ecx
add eax, ecx
cmp eax, 8
jb 0x4e991b
xor bl, bl
jmp 0x4e9920
mov bl, byte [ebp + eax - 0x14]
inc eax
movzx edx, dl
mov ecx, edx
movzx esi, bh
shr ecx, 2
and edx, 3
shl edx, 4
movzx ecx, word [ecx*2 + 0x53cfc8]
mov word [edi - 4], cx
mov ecx, esi
shr ecx, 4
and esi, 0xf
or ecx, edx
shl esi, 2
movzx edx, bl
mov ebx, dword [ebp - 0xa0]
add ebx, 4
movzx ecx, word [ecx*2 + 0x53cfc8]
mov word [edi - 2], cx
mov ecx, edx
shr ecx, 6
and edx, 0x3f
or esi, ecx
mov dword [ebp - 0xa0], ebx
movzx ecx, word [esi*2 + 0x53cfc8]
mov word [edi], cx
movzx ecx, word [edx*2 + 0x53cfc8]
mov word [edi + 2], cx
add edi, 8
cmp eax, 8
jb 0x4e98f4
mov eax, dword [ebp - 0xa4]
pop edi
pop esi
mov dword [eax + ebx*2 - 2], 0x3d
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462c38
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462c38
mov esp, ebp
pop ebp
ret
Function at 0x505030
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x55b524]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x5051f8
test eax, eax
je 0x5051f8
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x5051f8
push ecx
push ebx
push eax
call fcn.00491810
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x5051f8
cmp edi, 0xffffffff
je 0x5051f1
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00435980
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x5051f1
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x505187
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x5051f1
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x505187
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x505120
cmp edi, esi
jae 0x505187
nop
sub esi, edi
sbb ecx, eax
js 0x505135
jg 0x505130
cmp esi, 0x400000
jb 0x505135
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x505187
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.004359d0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x50517b
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x505120
jg 0x505187
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x505120
lea eax, [ebp - 0x6c]
push eax
call fcn.004356b0
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x53eb2c
push 3
push edi
call fcn.00457b40
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x5051a0
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.0050b94c
add esp, 8
mov esi, 1
test ebx, ebx
je 0x5051dd
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x5051eb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462c38
mov esp, ebp
pop ebp
ret
Function at 0x401c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
lea ecx, [esp + 4]
lea eax, [esp + 0x14]
mov ebp, ecx
mov dword [ebp], 0
add ebp, 4
cmp ebp, eax
jne 0x401c61
mov edi, 0x4a60b4
mov edx, 0xe
mov dword [esp], ebp
mov esi, dword [esp + 0x28]
lea ebp, [edi + 4]
shl edx, 8
xor eax, eax
add edx, 0x4a60e0
movzx ebx, byte [esi + eax]
movzx ebx, byte [edx + ebx]
xor byte [ecx + eax], bl
add eax, 1
cmp eax, 4
jne 0x401c8e
add edi, 1
add esi, 4
cmp edi, ebp
je 0x401cb0
movzx edx, byte [edi]
jmp 0x401c83
add ecx, 4
cmp ecx, dword [esp]
je 0x401cc0
movzx edx, byte [edi]
jmp 0x401c7c
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 4]
mov dword [edi], eax
mov eax, dword [esp + 8]
mov dword [edi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 0xc], eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x401d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x20
mov dword [esp + 4], ecx
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x34]
lea edi, [esp + 0x20]
mov edx, esi
xor eax, eax
movzx ebx, byte [ecx + eax*4]
mov byte [edx + eax], bl
add eax, 1
cmp eax, 4
jne 0x401d8b
add edx, 4
add ecx, 1
cmp edi, edx
jne 0x401d89
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x3c]
lea edi, [esp + 0x10]
mov eax, dword [eax + 4]
mov ebp, eax
mov dword [esp + 8], eax
shl ebp, 4
add ecx, ebp
xor eax, eax
movzx ebx, byte [ecx + eax*4]
xor byte [edi + eax], bl
add eax, 1
cmp eax, 4
jne 0x401dc0
add edi, 4
add ecx, 1
cmp edx, edi
jne 0x401dbe
mov eax, dword [esp + 0x3c]
lea eax, [eax + ebp - 0x10]
mov ebx, eax
mov eax, dword [esp + 8]
sub eax, 1
mov dword [esp + 8], eax
je 0x401e89
mov dword [esp + 0xc], esi
mov esi, ebx
lea esi, [esi]
lea edx, [esp + 0x10]
lea ecx, [edx + 4]
movzx ebp, byte [edx]
add edx, 1
mov eax, ebp
and ebp, 0xf
shr al, 4
movzx eax, al
shl eax, 4
movzx eax, byte [ebp + eax + 0x4a6fe0]
mov byte [edx - 1], al
cmp ecx, edx
jne 0x401e07
cmp edi, ecx
mov edx, ecx
jne 0x401e04
lea eax, [esp + 0x10]
mov ecx, dword [esp + 4]
mov dword [esp], eax
call fcn.00401cf0
sub esp, 4
mov ecx, esi
lea edx, [esp + 0x10]
xor eax, eax
movzx ebx, byte [ecx + eax*4]
xor byte [edx + eax], bl
add eax, 1
cmp eax, 4
jne 0x401e4b
add edx, 4
add ecx, 1
cmp edi, edx
jne 0x401e49
lea eax, [esp + 0x10]
mov ecx, dword [esp + 4]
sub esi, 0x10
mov dword [esp], eax
call fcn.00401c50
sub esp, 4
sub dword [esp + 8], 1
jne 0x401e00
mov esi, dword [esp + 0xc]
lea edx, [esp + 0x10]
lea ecx, [edx + 4]
movzx ebp, byte [edx]
add edx, 1
mov eax, ebp
and ebp, 0xf
shr al, 4
movzx eax, al
shl eax, 4
movzx eax, byte [ebp + eax + 0x4a6fe0]
mov byte [edx - 1], al
cmp ecx, edx
jne 0x401e90
cmp edi, ecx
mov edx, ecx
jne 0x401e8d
lea eax, [esp + 0x10]
mov ecx, dword [esp + 4]
mov dword [esp], eax
call fcn.00401cf0
sub esp, 4
mov ecx, dword [esp + 0x3c]
lea ebx, [esp + 0x10]
xor eax, eax
movzx edx, byte [ecx + eax*4]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, 4
jne 0x401ed6
add ebx, 4
add ecx, 1
cmp edi, ebx
jne 0x401ed4
mov ecx, dword [esp + 0x38]
xor eax, eax
movzx edx, byte [esi + eax]
mov byte [ecx + eax*4], dl
add eax, 1
cmp eax, 4
jne 0x401ef5
add esi, 4
add ecx, 1
cmp edi, esi
jne 0x401ef3
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x402c10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
sub esp, 0x28
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], str.VirtualAllocExNuma
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x3e8
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
sete al
add esp, 0x28
movzx eax, al
pop ebx
ret
Function at 0x402c80
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
sub esp, 0x8c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
sub esp, 4
xor eax, eax
cmp dword [esp + 0x30], 1
jbe 0x402cca
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x40
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalMemoryStatusEx
sub esp, 4
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
shrd eax, edx, 0x1e
cmp eax, 1
seta al
movzx eax, al
add esp, 0x8c
ret
Function at 0x40cb20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4ec050
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x4ec048]
sub esp, 4
test ebx, ebx
je 0x40cb6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40cb64
test esi, esi
je 0x40cb64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40cb40
mov dword [esp], 0x4ec050
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40cd50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40cda0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40ce78
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40cdde
cmp eax, 4
jne 0x40ce00
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40cdee
cmp edx, 4
je 0x40cdee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040cd50

Function at 0x40d3f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x40d420
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x40d444
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sub.KERNEL32.dll_GetLastError