joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401350
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.004b7ac0
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x1008], eax
push esi
mov esi, dword [esp + 0x1014]
cmp dword [esi], 0xffffffff
jne 0x40138d
xor al, al
pop esi
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.004b6da3
add esp, 0x100c
ret
mov eax, dword [esi + 0x1440]
test eax, eax
je 0x4013b4
mov ecx, dword [esp + 0x1018]
cmp byte [ecx], 0x21
je 0x4013b4
mov ecx, dword [esi + 0x1444]
cmp ecx, eax
ja 0x401375
inc ecx
mov dword [esi + 0x1444], ecx
cmp dword [esi + 0x1c], 0
push ebx
lea ebx, [esi + 4]
mov dword [esp + 8], ebx
je 0x4013c9
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x101c]
push ebp
push edi
lea edx, [esp + 0x1028]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004b7aa3
add esp, 0xc
lea edx, [esi + 0x1020]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esi + 0x102e]
movzx edx, word [esi + 0x102c]
lea eax, [esp + 0x18]
push eax
movzx eax, word [esi + 0x102a]
push ecx
movzx ecx, word [esi + 0x1028]
push edx
push eax
push ecx
push 0x50d014
lea edi, [esi + 0x20]
call fcn.004045b0
add esp, 4
push eax
push edi
call fcn.004b79a8
mov eax, edi
add esp, 0x1c
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401440
sub eax, edx
cmp dword [esi + 0x143c], 0
mov ebp, eax
je 0x40147e
test ebp, ebp
jle 0x401490
mov eax, edi
mov ecx, ebp
mov edx, 2
add dword [esi + 0x143c], edx
mov bl, byte [esi + 0x143c]
add bl, 0x43
xor byte [eax], bl
inc eax
sub ecx, 1
jne 0x401461
mov ebx, dword [esp + 0x10]
jmp 0x401490
push edi
push edi
lea edx, [esi + 0x1034]
push ebp
push edx
call fcn.004aa750
add esp, 0x10
mov ecx, dword [esi]
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx + 0x18], 0
pop edi
pop ebp
je 0x4014b1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1010]
pop ebx
pop esi
xor ecx, esp
mov al, 1
call fcn.004b6da3
add esp, 0x100c
ret
Function at 0x4032a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
push edi
mov edi, dword [esp + 0x14]
cmp esi, edi
sete al
mov ebx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x40332c
push ebp
lea ebp, [eax - 1]
shr ebp, 3
inc ebp
cmp dword [esp + 0x14], 0
je 0x4032e0
lea ecx, [esi + 4]
push ecx
push esi
mov ecx, ebx
call fcn.00402a90
add esi, 8
jmp 0x403326
movzx edx, byte [esi]
mov byte [edi], dl
mov al, byte [esi + 1]
mov byte [edi + 1], al
movzx ecx, byte [esi + 2]
mov byte [edi + 2], cl
movzx edx, byte [esi + 3]
mov byte [edi + 3], dl
movzx ecx, byte [esi + 4]
lea eax, [edi + 4]
mov byte [eax], cl
movzx edx, byte [esi + 5]
mov byte [edi + 5], dl
movzx ecx, byte [esi + 6]
mov byte [edi + 6], cl
movzx edx, byte [esi + 7]
push eax
push edi
mov ecx, ebx
mov byte [edi + 7], dl
call fcn.00402a90
add esi, 8
add edi, 8
sub ebp, 1
jne 0x4032c8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x403510
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov eax, 0x1004
call fcn.004b7ac0
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push 0xfff
lea eax, [esp + 0xd]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x14], 0
call fcn.004b6dc0
mov eax, dword [esi]
add esp, 0xc
test eax, eax
jne 0x403556
xor al, al
jmp 0x4035b1
push 0
push 0
push eax
call fcn.004b821d
add esp, 0xc
test eax, eax
jne 0x403552
mov ecx, dword [esi]
push ecx
push 0x1000
lea edx, [esp + 0x10]
push 1
push edx
call fcn.004b8542
add esp, 0x10
cmp eax, 0x1000
jne 0x403552
mov eax, 0x5a4d
cmp word [esp + 8], ax
jne 0x403552
mov eax, dword [esp + 0x44]
cmp eax, 0x1000
jg 0x403552
cmp dword [esp + eax + 8], 0x4550
lea eax, [esp + eax + 8]
jne 0x403552
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov al, 1
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x1004
ret 4

Function at 0x403d40
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret

Function at 0x4041d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40425d
mov ecx, esi
and ecx, 0xff
lea edx, [ecx + ecx*2 + 0x65]
mov byte [0x536469], cl
lea ecx, [ecx + ecx*2 + 1]
lea ecx, [ecx + ecx*2]
push ebx
lea ebx, [ecx + 0x65]
inc ecx
mov dword [esp + 8], edx
mov byte [0x536468], 1
mov edx, 4
test eax, eax
jle 0x40423c
push edi
sub esi, 0x53646c
mov edi, eax
lea esp, [esp]
lea ecx, [ecx + ecx*2]
mov al, cl
add al, 0x65
xor al, byte [esi + edx + 0x536468]
inc edx
mov byte [edx + 0x536467], al
inc ecx
sub edi, 1
jne 0x404220
pop edi
lea ecx, [edx - 4]
mov eax, ecx
sar eax, 8
xor al, byte [esp + 8]
xor bl, cl
mov byte [edx + 0x536468], 0
mov byte [0x53646b], bl
mov byte [0x53646a], al
pop ebx
mov eax, 0x536468
pop esi
pop ecx
ret
Function at 0x404390
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x410
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
mov edi, dword [esp + 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x4044a9
mov ecx, dword [esp + 0x420]
and ecx, 0xff
lea edx, [ecx*8]
sub edx, ecx
lea eax, [edx + 0x46]
inc edx
mov byte [esp + 0x15], cl
lea ecx, [edx*8]
sub ecx, edx
mov dword [esp + 0x10], eax
lea eax, [ecx + 0x46]
inc ecx
push ebx
mov byte [esp + 0x18], 2
mov edx, 4
test esi, esi
jle 0x404435
push ebp
mov ebp, edi
lea ebx, [esp + 0x20]
sub ebp, ebx
mov dword [esp + 0x10], esi
lea esp, [esp]
lea esi, [ecx*8]
sub esi, ecx
mov ecx, esi
mov bl, cl
lea esi, [edx + ebp]
add bl, 0x46
xor bl, byte [esp + esi + 0x1c]
inc edx
mov byte [esp + edx + 0x1b], bl
inc ecx
sub dword [esp + 0x10], 1
jne 0x404410
pop ebp
lea ebx, [edx - 4]
mov ecx, ebx
sar ecx, 8
xor cl, byte [esp + 0x14]
push ebx
mov byte [esp + edx + 0x1c], 0
xor al, bl
push 0
push edi
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], al
call fcn.004b6dc0
add ebx, 4
add esp, 0xc
xor esi, esi
test ebx, ebx
jle 0x40448f
movzx ecx, byte [esp + esi + 0x18]
push ecx
lea edx, [esp + 0x14]
push str._02X
push edx
call fcn.004b79a8
push 2
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004b8952
inc esi
add esp, 0x18
cmp esi, ebx
jl 0x404465
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.004b6da3
add esp, 0x410
ret
mov ecx, dword [esp + 0x414]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x410
ret

Function at 0x4044d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
xor eax, eax
push esi
mov byte [esp + 0x10], 0
mov word [esp + 0x11], ax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
xor edi, edi
test ebx, ebx
jle 0x40452a
push ebp
mov ebp, esi
jmp 0x404500
push 2
lea ecx, [esp + 0x14]
push ebp
push ecx
call fcn.004b8a4f
push 0x10
lea edx, [esp + 0x20]
push 0
push edx
call fcn.004b8fb7
mov byte [edi + esi], al
inc edi
add esp, 0x18
add ebp, 2
cmp edi, ebx
jl 0x404500
pop ebp
test esi, esi
jne 0x404535
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
cmp byte [esi], 2
jne 0x4045a2
movsx ecx, byte [esi + 1]
lea eax, [ecx*8]
sub eax, ecx
mov cl, al
add cl, 0x46
xor byte [esi + 2], cl
movzx edi, byte [esi + 2]
lea ecx, [eax + 1]
lea eax, [ecx*8]
sub eax, ecx
mov dl, al
add dl, 0x46
xor byte [esi + 3], dl
movzx ecx, byte [esi + 3]
shl edi, 8
inc eax
or edi, ecx
mov ecx, 0
jle 0x40459e
jmp 0x404580
lea edx, [eax*8]
sub edx, eax
mov eax, edx
mov dl, al
add dl, 0x46
xor dl, byte [ecx + esi + 4]
inc ecx
mov byte [ecx + esi - 1], dl
inc eax
cmp ecx, edi
jl 0x404580
mov byte [edi + esi], 0
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
Function at 0x4045b0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x536884], 1
jne 0x4045ec
or dword [0x536884], 1
push 0x536868
mov dword [0x536880], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4ffe90
mov dword [0x536880], 1
call fcn.004b7e4b
add esp, 4
cmp dword [0x536880], 0
je 0x404600
push 0x536868
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x404620
cmp dword [0x536880], esi
je 0x40461c
push 0x536868
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop esi
ret
cmp byte [esi], 1
jne 0x404671
movsx eax, byte [esi + 1]
lea eax, [eax + eax*2]
mov cl, al
add cl, 0x65
xor byte [esi + 2], cl
lea eax, [eax + eax*2 + 3]
mov dl, al
push edi
movzx edi, byte [esi + 2]
add dl, 0x65
xor byte [esi + 3], dl
movzx ecx, byte [esi + 3]
shl edi, 8
inc eax
or edi, ecx
mov ecx, 0
jle 0x40466c
lea eax, [eax + eax*2]
mov dl, al
add dl, 0x65
xor dl, byte [ecx + esi + 4]
inc ecx
mov byte [ecx + esi - 1], dl
inc eax
cmp ecx, edi
jl 0x404656
mov byte [edi + esi], 0
pop edi
cmp dword [0x536880], 0
je 0x404685
push 0x536868
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x404690
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40c
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x408], eax
test byte [0x5368f8], 1
push esi
mov esi, dword [esp + 0x414]
push edi
jne 0x4046e9
mov edi, 1
or dword [0x5368f8], edi
push 0x5368dc
mov dword [0x5368f4], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4ffeb0
mov dword [0x5368f4], edi
call fcn.004b7e4b
add esp, 4
test esi, esi
jne 0x404706
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.004b6da3
add esp, 0x40c
ret
cmp dword [0x5368f4], 0
je 0x40471a
push 0x5368dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi], 1
jne 0x40476a
movsx eax, byte [esi + 1]
lea eax, [eax + eax*2]
mov cl, al
add cl, 0x65
xor byte [esi + 2], cl
movzx edi, byte [esi + 2]
lea eax, [eax + eax*2 + 3]
mov dl, al
add dl, 0x65
xor byte [esi + 3], dl
movzx ecx, byte [esi + 3]
shl edi, 8
inc eax
or edi, ecx
mov ecx, 0
jle 0x404766
nop
lea eax, [eax + eax*2]
mov dl, al
add dl, 0x65
xor dl, byte [esi + ecx + 4]
inc ecx
mov byte [esi + ecx - 1], dl
inc eax
cmp ecx, edi
jl 0x404750
mov byte [esi + edi], 0
push ebx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 1
jmp 0x404780
cmp dword [ecx*4 + 0x5368b4], eax
je 0x404791
inc ecx
cmp ecx, 0xa
jl 0x404780
jmp 0x404797
mov ebx, ecx
test ecx, ecx
jne 0x4047b2
mov ecx, dword [0x5368b0]
cmp ecx, 9
jae 0x4047b2
inc ecx
mov dword [0x5368b0], ecx
mov dword [ecx*4 + 0x5368b4], eax
mov ebx, ecx
mov edi, dword [ebx*4 + 0x536888]
mov dword [ebx*4 + 0x536888], esi
test edi, edi
je 0x404863
cmp edi, esi
je 0x404863
cmp byte [esi], 1
je 0x404863
cmp byte [edi], 1
je 0x404863
push edi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x404863
lea ecx, [esp + 0x14]
and ecx, 0xff
lea edx, [ecx + ecx*2 + 0x65]
mov byte [edi + 1], cl
lea ecx, [ecx + ecx*2 + 1]
lea ecx, [ecx + ecx*2]
lea ebx, [ecx + 0x65]
mov dword [esp + 0xc], edx
inc ecx
xor edx, edx
push ebp
mov byte [edi], 1
mov dword [esp + 0x14], ebx
mov ebp, 4
test eax, eax
jle 0x40484a
lea ecx, [ecx + ecx*2]
mov bl, cl
add bl, 0x65
xor bl, byte [esp + edx + 0x18]
inc edx
mov byte [edi + ebp], bl
inc ebp
inc ecx
cmp edx, eax
jl 0x404830
mov ebx, dword [esp + 0x14]
lea eax, [ebp - 4]
mov ecx, eax
sar ecx, 8
xor cl, byte [esp + 0x10]
mov byte [edi + ebp], 0
xor bl, al
mov byte [edi + 2], cl
mov byte [edi + 3], bl
pop ebp
cmp dword [0x5368f4], 0
pop ebx
je 0x404878
push 0x5368dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x410]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x40c
ret
Function at 0x4048a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40c
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x408], eax
test byte [0x53691c], 1
push esi
mov esi, dword [esp + 0x414]
push edi
jne 0x4048f9
mov edi, 1
or dword [0x53691c], edi
push 0x536900
mov dword [0x536918], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4ffed0
mov dword [0x536918], edi
call fcn.004b7e4b
add esp, 4
test esi, esi
jne 0x404916
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.004b6da3
add esp, 0x40c
ret
cmp dword [0x536918], 0
je 0x40492a
push 0x536900
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi], 1
jne 0x40497a
movsx eax, byte [esi + 1]
lea eax, [eax + eax*2]
mov cl, al
add cl, 0x65
xor byte [esi + 2], cl
movzx edi, byte [esi + 2]
lea eax, [eax + eax*2 + 3]
mov dl, al
add dl, 0x65
xor byte [esi + 3], dl
movzx ecx, byte [esi + 3]
shl edi, 8
inc eax
or edi, ecx
mov ecx, 0
jle 0x404976
nop
lea eax, [eax + eax*2]
mov dl, al
add dl, 0x65
xor dl, byte [esi + ecx + 4]
inc ecx
mov byte [esi + ecx - 1], dl
inc eax
cmp ecx, edi
jl 0x404960
mov byte [esi + edi], 0
mov edi, dword [0x5368fc]
mov dword [0x5368fc], esi
test edi, edi
je 0x404a2b
cmp edi, esi
je 0x404a2b
cmp byte [esi], 1
je 0x404a2b
cmp byte [edi], 1
je 0x404a2b
push edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x404a2b
lea ecx, [esp + 0x10]
and ecx, 0xff
lea edx, [ecx + ecx*2 + 0x65]
mov byte [edi + 1], cl
lea ecx, [ecx + ecx*2 + 1]
push ebx
lea ecx, [ecx + ecx*2]
lea ebx, [ecx + 0x65]
push ebp
inc ecx
xor ebp, ebp
mov dword [esp + 0x10], edx
mov byte [edi], 1
mov dword [esp + 0x14], ebx
mov edx, 4
test eax, eax
jle 0x404a11
lea ecx, [ecx + ecx*2]
mov bl, cl
add bl, 0x65
xor bl, byte [esp + ebp + 0x18]
inc ebp
mov byte [edx + edi], bl
inc edx
inc ecx
cmp ebp, eax
jl 0x4049f7
mov ebx, dword [esp + 0x14]
mov byte [edx + edi], 0
add edx, 0xfffffffc
mov eax, edx
sar eax, 8
xor al, byte [esp + 0x10]
xor bl, dl
pop ebp
mov byte [edi + 3], bl
mov byte [edi + 2], al
pop ebx
cmp dword [0x536918], 0
je 0x404a3f
push 0x536900
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x410]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x40c
ret
Function at 0x404a60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80c
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x808], eax
test byte [0x536940], 1
push esi
mov esi, dword [esp + 0x814]
push edi
jne 0x404ab9
mov edi, 1
or dword [0x536940], edi
push 0x536924
mov dword [0x53693c], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4ffef0
mov dword [0x53693c], edi
call fcn.004b7e4b
add esp, 4
test esi, esi
jne 0x404ad6
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.004b6da3
add esp, 0x80c
ret
cmp dword [0x53693c], 0
je 0x404aea
push 0x536924
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp word [esi], 1
jne 0x404b3c
movzx eax, word [esi + 2]
lea ecx, [eax + eax*2 + 0x65]
xor word [esi + 4], cx
lea eax, [eax + eax*2 + 1]
lea eax, [eax + eax*2]
lea edx, [eax + 0x65]
xor word [esi + 6], dx
movzx edx, byte [esi + 4]
movzx ecx, byte [esi + 6]
shl edx, 8
inc eax
or edx, ecx
mov ecx, 0
jle 0x404b36
nop
lea eax, [eax + eax*2]
lea edi, [eax + 0x65]
xor di, word [esi + ecx*2 + 8]
inc ecx
mov word [esi + ecx*2 - 2], di
inc eax
cmp ecx, edx
jl 0x404b20
xor eax, eax
mov word [esi + edx*2], ax
mov ecx, dword [0x536920]
mov dword [0x536920], esi
test ecx, ecx
je 0x404c18
cmp ecx, esi
je 0x404c18
cmp word [esi], 1
je 0x404c18
cmp word [ecx], 1
je 0x404c18
lea edi, [esp + 0x10]
mov eax, ecx
sub edi, ecx
movzx edx, word [eax]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x404b74
lea eax, [esp + 0x10]
lea edi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x404b90
sub eax, edi
sar eax, 1
push ebx
mov ebx, eax
je 0x404c17
mov edx, 1
lea eax, [esp + 0x14]
and eax, 0xff
mov word [ecx], dx
lea edx, [eax + eax*2 + 0x65]
mov word [ecx + 2], ax
lea eax, [eax + eax*2 + 1]
lea eax, [eax + eax*2]
push ebp
lea ebp, [eax + 0x65]
inc eax
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
mov edx, 4
test ebx, ebx
jle 0x404bfa
lea esp, [esp]
lea eax, [eax + eax*2]
lea ebp, [eax + 0x65]
xor bp, word [esp + edi*2 + 0x18]
inc edi
mov word [ecx + edx*2], bp
inc edx
inc eax
cmp edi, ebx
jl 0x404be0
mov ebp, dword [esp + 0x14]
xor eax, eax
mov word [ecx + edx*2], ax
add edx, 0xfffffffc
mov eax, edx
sar eax, 8
xor eax, dword [esp + 0x10]
xor ebp, edx
mov word [ecx + 6], bp
mov word [ecx + 4], ax
pop ebp
pop ebx
cmp dword [0x53693c], 0
je 0x404c2c
push 0x536924
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x810]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x80c
ret
Function at 0x405c00
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
jne 0x405c38
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call edi
push 0xfffffffffffffff6
mov dword [esi + 4], eax
call edi
cmp dword [esi + 4], 0xffffffff
mov dword [esi + 8], eax
pop edi
je 0x405c32
cmp eax, 0xffffffff
je 0x405c32
mov ecx, esi
pop esi
jmp fcn.00405bb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
ret

Function at 0x405c70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x405c87
mov dword [ecx + 0x400], 1
xor al, al
ret 0xc
mov edx, dword [esp + 8]
push esi
lea esi, [eax + edx]
cmp eax, esi
jae 0x405cb9
mov edx, dword [esp + 0x10]
push ebx
push edi
lea esp, [esp]
movzx edi, byte [eax]
movzx ebx, byte [edx]
xor edi, ebx
mov ebx, dword [edx]
shr ebx, 8
xor ebx, dword [ecx + edi*4]
inc eax
mov dword [edx], ebx
cmp eax, esi
jb 0x405ca0
pop edi
pop ebx
mov al, 1
pop esi
ret 0xc

Function at 0x405dd0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
mov eax, ebx
shr eax, 1
mov edx, esi
xor ecx, ecx
call fcn.00405da0
movzx ecx, ax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x405e01
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
je 0x405e05
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x405e0c
pop esi
pop ebx
ret
mov edx, dword [eax + 0x58]
cmp cx, dx
jb 0x405e1d
push edi
movzx edi, dx
sub ecx, edi
pop edi
jmp 0x405e26
sub ecx, edx
and ecx, 0xffff
dec ecx
shr edx, 0x10
cmp cx, dx
jb 0x405e35
movzx edx, dx
sub ecx, edx
jmp 0x405e3e
sub ecx, edx
and ecx, 0xffff
dec ecx
test bl, 1
je 0x405e4a
movzx edx, byte [esi + ebx - 1]
add ecx, edx
mov edx, dword [esp + 0x18]
add ecx, ebx
mov dword [edx], ecx
mov ecx, dword [eax + 0x58]
mov edx, dword [esp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
ret
Function at 0x405e60
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x4fe0db
mov eax, dword fs:[0]
push eax
sub esp, 0x408
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52e144]
xor eax, esp
push eax
lea eax, [esp + 0x41c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x42c]
mov byte [esp + 0x17], 0
test eax, eax
je 0x405f2e
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x405f2e
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push edi
mov dword [esi + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, eax
test ebp, ebp
je 0x405f01
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebp
mov dword [esi + 0x48], eax
call ebx
test edi, edi
je 0x405f08
push edi
call ebx
mov eax, dword [esi + 0x48]
mov bl, 1
test eax, eax
je 0x405f85
mov eax, dword [esi + 0x4c]
push eax
mov byte [esp + 0x1b], bl
call fcn.004b958c
mov edi, eax
add esp, 4
test edi, edi
jne 0x405f32
mov dword [esi + 0x44], 8
xor al, al
jmp 0x405f89
mov ecx, dword [esi + 0x4c]
mov edx, dword [esi + 0x48]
push ecx
push edx
push edi
call fcn.004b6e40
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.00407250
mov eax, dword [esp + 0x430]
mov ecx, dword [esi + 0x4c]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x430], 0
call fcn.00407a50
lea ecx, [esp + 0x18]
mov byte [esp + 0x17], bl
mov dword [esp + 0x424], 0xffffffff
call fcn.004011c0
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x41c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x414
ret 8
Function at 0x407700
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, 0x1008
call fcn.004b7ac0
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x100c]
push esi
mov esi, dword [esp + 0x1014]
push edi
mov edi, ecx
mov dword [esi], 0xffffffff
test eax, eax
je 0x407818
cmp byte [eax], 0
je 0x407818
push ebx
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407788
mov dword [edi + 0x400], 2
xor al, al
pop ebx
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x1008
ret 8
push ebp
push 0
lea eax, [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x20]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4077f9
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4077f5
lea eax, [esp + 0x14]
lea ecx, [esp + ecx + 0x14]
mov edx, eax
cmp edx, ecx
jae 0x4077d7
jmp 0x4077c0
movzx ebp, byte [eax]
movzx edx, byte [esi]
xor edx, ebp
mov ebp, dword [esi]
shr ebp, 8
xor ebp, dword [edi + edx*4]
inc eax
mov dword [esi], ebp
cmp eax, ecx
jb 0x4077c0
push 0
lea eax, [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x20]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4077a5
jmp 0x4077f9
test eax, eax
jne 0x407803
mov dword [edi + 0x400], 3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi]
not edx
mov dword [esi], edx
mov al, 1
pop ebp
jmp 0x40776e
mov dword [edi + 0x400], 1
xor al, al
jmp 0x40776f
Function at 0x407830
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, 0x1014
call fcn.004b7ac0
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x1010], eax
mov eax, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1028]
push edi
mov edi, ecx
mov dword [esp + 8], edi
test eax, eax
je 0x4079ab
cmp byte [eax], 0
je 0x4079ab
push ebp
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, 0xffffffff
jne 0x4078ba
mov dword [edi + 0x400], 2
xor al, al
pop ebp
mov ecx, dword [esp + 0x1018]
pop edi
pop esi
xor ecx, esp
call fcn.004b6da3
add esp, 0x1014
ret 0x10
mov eax, dword [esp + 0x1028]
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4078e5
push ebp
mov dword [edi + 0x400], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40789e
push ebx
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x1000
lea edx, [esp + 0x2c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x14], eax
test eax, eax
je 0x407992
mov ebx, dword [esp + 0x1030]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40798a
lea ecx, [esp + 0x20]
cmp ebx, edi
jbe 0x407929
lea edx, [esp + edi + 0x20]
sub ebx, edi
jmp 0x40792f
lea edx, [esp + ebx + 0x20]
xor ebx, ebx
lea edi, [esp + 0x20]
cmp edi, edx
jae 0x407964
jmp 0x407940
movzx edi, byte [ecx]
movzx eax, byte [esi]
mov ebp, dword [esp + 0x10]
xor eax, edi
mov edi, dword [esi]
shr edi, 8
xor edi, dword [ebp + eax*4]
inc ecx
mov dword [esi], edi
cmp ecx, edx
jb 0x407940
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test ebx, ebx
je 0x40798a
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x1000
lea edx, [esp + 0x2c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x407911
jmp 0x40798e
test eax, eax
jne 0x40799c
mov edi, dword [esp + 0x10]
mov dword [edi + 0x400], 3
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ebx
jmp 0x4078a0
mov dword [edi + 0x400], 1
xor al, al
jmp 0x4078a1