joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002279d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002dfd9
call fcn.1002b2c2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100228e2
cmp dword [ebp - 0x18], 1
jne 0x100228e2
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100206aa
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x100228e2
push dword [ebp - 0x14]
push ebx
push esi
call fcn.100206aa
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100228d7
cmp dword [ebp - 0x18], 1
jne 0x100228d7
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100206aa
mov dword [edi], eax
pop ecx
test eax, eax
je 0x100228d7
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.100206aa
lea eax, [ebp - 0x20]
push eax
push 0x10033448
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x100228bb
push ebx
call fcn.100206aa
pop ecx
test al, al
je 0x100228bb
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x100228d7
push dword [edi]
call fcn.1002b561
and dword [edi], 0
pop ecx
jmp 0x100228d7
test esi, esi
je 0x100228e2
push esi
call fcn.1002b561
pop ecx
call fcn.1002b220
ret

Function at 0x10023089
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x100331a4
xor esi, esi
call fcn.100206aa
pop ecx
test eax, eax
jne 0x100230aa
push 0x100331bc
call fcn.100206aa
pop ecx
test eax, eax
je 0x100230ad
xor esi, esi
inc esi
cmp byte [0x1003ce0b], 0
jne 0x100230bf
cmp byte [0x1003ce0a], 0
je 0x100230f5
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d650
push edi
call fcn.100206aa
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100230e4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100230f4
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x1002549d
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002551b
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002551b
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003ce0b], 0
jne 0x100254df
cmp byte [0x1003ce0a], 0
je 0x10025516
movzx eax, bl
mov esi, 0x1003e1b8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.100206aa
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10025506
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10025516
push esi
call fcn.10005ee0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003ce0b], 0
jne 0x1002552d
cmp byte [0x1003ce0a], 0
je 0x1002555f
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1b8
push esi
call fcn.100206aa
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002554f
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002555f
push esi
call fcn.10005ee0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028ddc
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028df9
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003ce0b], 0
jne 0x10028e0f
cmp byte [0x1003ce0a], 0
je 0x10028f4e
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e608
push edi
call fcn.100206aa
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e35
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e4e
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e57
cmp byte [0x1003ce0a], 0
je 0x10028e77
push 4
push str.sizeof_Uns32____d
push edi
call fcn.100206aa
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e77
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e90
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e99
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.100206aa
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028ed2
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028edb
cmp byte [0x1003ce0a], 0
je 0x10028efb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.100206aa
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028efb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f14
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028f1d
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push 4
push str.sizeof_void____d
push edi
call fcn.100206aa
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f4d
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028fdd
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e2c3
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, 0x1003e608
mov edi, dword [ebp + 8]
jne 0x10029008
mov al, byte [0x1003ce0a]
test al, al
jne 0x10029008
lea esi, [edi + 4]
jmp 0x1002901f
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.100206aa
mov al, byte [0x1003ce0a]
add esp, 0xc
test al, al
je 0x1002902a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002903a
push ebx
call fcn.10005ee0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100206aa
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1002906d
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.10003172
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b235
ret
Function at 0x10029083
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e2f7
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x100290b0
cmp byte [0x1003ce0a], 0
je 0x100290ff
call fcn.100206aa
test al, al
mov edx, 0x1002fbdc
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e608
call fcn.100206aa
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100290eb
push 0x1003e608
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100290ff
push 0x1003e608
call fcn.10005ee0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.100206aa
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10003172
test ebx, ebx
jne 0x1002917d
cmp byte [0x1003ce0b], bl
jne 0x10029149
cmp byte [0x1003ce0a], bl
je 0x100291f1
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e608
push ebx
call fcn.100206aa
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002916b
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100291f1
push ebx
call fcn.10005ee0
pop ecx
jmp 0x100291f1
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x100291ac
cmp byte [0x1003ce0b], al
jne 0x100291a5
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002914e
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x100291e1
cmp byte [0x1003ce0b], al
jne 0x100291d7
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002914e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b235
ret
Function at 0x401000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, 0x402020
push eax
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_fopen
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x401035
mov eax, 0
jmp 0x40112d
mov eax, 2
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
push ecx
mov dword [ebp - 0x10], eax
call sub.msvcrt.dll_ftell
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp ecx, 0
jne 0x401088
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, 0
jmp 0x40112d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
inc ecx
push ecx
call sub.msvcrt.dll_malloc
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0
jne 0x4010b0
mov eax, 0
jmp 0x40112d
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [eax]
push ecx
mov eax, 1
push eax
mov eax, dword [ebp - 8]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [eax]
cmp ecx, edx
je 0x401119
mov eax, dword [ebp - 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, 0
jmp 0x40112d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp - 8]
add eax, ecx
mov ecx, 0
mov byte [eax], cl
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4014ac
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x4014da
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x4014e2
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x401511
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x401537
mov eax, 0x402100
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x401560
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x401560
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x401560
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.0040114d
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xca12a5e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x18c6239e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4190b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4190c0
push ebx
push esi
mov eax, 0x418ff8
call fcn.0040642c
xor eax, eax
push ebp
push 0x4192b5
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
push 0x42c260
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x14]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0x4192cc
call fcn.004175fc
mov edx, dword [ebp - 0x18]
pop eax
call fcn.004048d4
mov eax, dword [ebp - 0x14]
call fcn.0040b460
test al, al
je 0x419170
push 0
lea eax, [ebp - 0x1c]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x4192cc
call fcn.004175fc
mov edx, dword [ebp - 0x20]
pop eax
call fcn.004048d4
mov eax, dword [ebp - 0x1c]
call fcn.00404acc
push eax
call sub.kernel32.dll_WinExec
call fcn.00417980
jmp 0x41929a
lea eax, [ebp - 0x24]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
call fcn.00417738
lea eax, [ebp - 0x28]
mov edx, 0x4192dc
call fcn.004048d4
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00404a18
je 0x41921b
lea eax, [ebp - 0x2c]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
call fcn.00417738
lea eax, [ebp - 0x30]
mov edx, 0x4192f0
call fcn.004048d4
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00404a18
je 0x419295
lea eax, [ebp - 0x34]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
mov eax, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
call fcn.00417738
lea eax, [ebp - 0x38]
mov edx, 0x41930c
call fcn.004048d4
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00404a18
je 0x419272
jmp 0x419166
call fcn.00418320
call fcn.00418a04
mov eax, 0x419324
call fcn.00417c74
mov eax, 0x419330
call fcn.00417c74
mov eax, 0x41933c
call fcn.00417c74
mov eax, 0x419324
call fcn.00418cb8
mov eax, 0x419330
call fcn.00418cb8
mov eax, 0x41933c
call fcn.00418cb8
mov edx, 0x419348
mov eax, 0x41935c
call fcn.00417f98
jmp 0x41929a
xor esi, esi
mov ebx, 0x41a404
mov eax, dword [ebx]
call fcn.0041747c
inc esi
add ebx, 4
cmp esi, 0x40
jne 0x419279
push 0x3e7
call sub.kernel32.dll_Sleep_1
jmp 0x419272
call fcn.00418b3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4192bc
lea eax, [ebp - 0x38]
mov edx, 0xa
call fcn.00404630
ret

Function at 0x10fb044
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10fb04e
pushal
call 0x10fb054
pop ebp
sub ebp, 0x10
sub ebp, 0xcfb044
jmp 0x10fb06a
mov eax, 0xcfb044
add eax, ebp
add eax, 0x4c
mov ecx, 0x605
mov edx, 0xeb4f0f85
xor byte [eax], dl
inc eax
dec ecx
jne 0x10fb081
jmp 0x10fb094
push cs
dec eax
push cs
or al, 0xb9
test dword [ebp + 0x7d440485], eax
test dword [ebp + 0x3d488685], eax
add dword [ebp - 0x52c07a7b], 0xffffff85
test dword [ebp + 0x4d866772], eax
push cs
add al, 0x89
test dword [ebp - 0x2abf797b], eax
aad 0xed
std
jmp dword [ebp + eax*4 + 0x2bb04ced]
Function at 0x401a5e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x82
call fcn.0040bdb1
xor edx, edx
pop ecx
cmp dword [ebp + 0xc], edx
jle 0x401aa3
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x476b50
mov edi, eax
sub esi, ecx
sub edi, ecx
mov cx, word [esi + edx*2 + 0x476b50]
xor cx, word [edx*2 + 0x476b50]
inc edx
mov word [edi + edx*2 + 0x476b4e], cx
cmp edx, dword [ebp + 0xc]
jl 0x401a83
pop edi
pop esi
xor ecx, ecx
mov word [eax + edx*2], cx
pop ebp
ret 8

Function at 0x401d81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x2a
call fcn.0040d1c3
xor edx, edx
pop ecx
cmp dword [ebp + 0xc], edx
jle 0x401dc3
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x44ca24
mov edi, eax
sub esi, ecx
sub edi, ecx
mov cx, word [esi + edx*2 + 0x44ca24]
xor cx, word [edx*2 + 0x44ca24]
inc edx
mov word [edi + edx*2 + 0x44ca22], cx
cmp edx, dword [ebp + 0xc]
jl 0x401da3
pop edi
pop esi
xor ecx, ecx
mov word [eax + edx*2], cx
pop ebp
ret 8

Function at 0x401dcd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x15
call fcn.0040d1c3
pop ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jle 0x401e0b
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, 0x44ca4c
mov edi, eax
sub esi, edx
sub edi, edx
mov dl, byte [esi + ecx + 0x44ca4c]
xor dl, byte [ecx + 0x44ca4c]
inc ecx
mov byte [edi + ecx + 0x44ca4b], dl
cmp ecx, dword [ebp + 0xc]
jl 0x401def
pop edi
pop esi
mov byte [ecx + eax], 0
pop ebp
ret 8

Function at 0x4022b8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push esi
cmp dword [0x477e98], ecx
jne 0x4022f7
push 8
mov eax, ecx
pop esi
test al, 1
je 0x4022d8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4022da
shr eax, 1
dec esi
jne 0x4022cb
mov dword [ecx*4 + 0x477ea8], eax
inc ecx
cmp ecx, 0x100
jl 0x4022c6
mov dword [0x477e98], 1
mov ecx, dword [ebp + 8]
lea ecx, [edx + ecx*2]
or eax, 0xffffffff
cmp edx, ecx
jae 0x402324
push edi
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x477ea8]
add edx, 2
cmp edx, ecx
jb 0x402305
pop edi
not eax
pop esi
pop ebp
ret 4

Function at 0x4036e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x66
call fcn.0040bdb1
xor edx, edx
pop ecx
cmp dword [ebp + 0xc], edx
jle 0x403722
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x427cb0
mov edi, eax
sub esi, ecx
sub edi, ecx
mov cx, word [esi + edx*2 + 0x427cb0]
xor cx, word [edx*2 + 0x427cb0]
inc edx
mov word [edi + edx*2 + 0x427cae], cx
cmp edx, dword [ebp + 0xc]
jl 0x403702
pop edi
pop esi
xor ecx, ecx
mov word [eax + edx*2], cx
pop ebp
ret 8

Function at 0x40372c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x76
call fcn.0040bdb1
xor edx, edx
pop ecx
cmp dword [ebp + 0xc], edx
jle 0x40376e
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x4284d8
mov edi, eax
sub esi, ecx
sub edi, ecx
mov cx, word [esi + edx*2 + 0x4284d8]
xor cx, word [edx*2 + 0x4284d8]
inc edx
mov word [edi + edx*2 + 0x4284d6], cx
cmp edx, dword [ebp + 0xc]
jl 0x40374e
pop edi
pop esi
xor ecx, ecx
mov word [eax + edx*2], cx
pop ebp
ret 8
Function at 0x405c35
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4265d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0xffff
mov eax, ebx
push edi
mov edi, ecx
cmp ax, si
jne 0x405c60
xor eax, eax
jmp 0x405dc8
mov ecx, dword [edi + 0x24]
cmp dword [ecx], 0
je 0x405c8d
mov eax, dword [edi + 0x34]
mov ecx, dword [ecx]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x405c8d
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 2]
mov dword [edi], ecx
mov word [eax], si
mov ax, si
jmp 0x405dc8
cmp dword [edi + 0x54], 0
jne 0x405c9a
mov eax, ebx
jmp 0x405dc8
mov eax, edi
call fcn.0040719c
cmp dword [edi + 0x44], 0
jne 0x405cc0
push dword [edi + 0x54]
push esi
call fcn.0040d3ca
pop ecx
cmp ax, bx
pop ecx
movzx eax, si
jne 0x405dc8
jmp 0x405c93
movzx eax, si
lea esi, [ebp - 0x20]
mov dword [ebp - 0x24], eax
call fcn.00406a83
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x405d6d
lea eax, [ebp - 0x20]
mov edx, eax
add eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x28]
push ebx
push eax
push edx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
jl 0x405db8
cmp eax, 1
jg 0x405d75
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x405d1c
lea eax, [ebp - 0x20]
mov esi, dword [ebp - 0x28]
sub esi, eax
je 0x405d42
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x405d2f
lea eax, [ebp - 0x20]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0040e9a5
add esp, 0x10
cmp esi, eax
jne 0x405db8
lea eax, [ebp - 0x24]
mov byte [edi + 0x4a], 1
cmp dword [ebp - 0x2c], eax
jne 0x405da7
cmp esi, ebx
ja 0x405cce
cmp dword [ebp - 0x10], 0x20
push ebx
jae 0x405db9
push 8
pop ebx
lea esi, [ebp - 0x20]
call fcn.00401281
jmp 0x405cce
mov edx, dword [ebp - 0x20]
jmp 0x405ce0
cmp eax, 3
jne 0x405db8
push dword [edi + 0x54]
push dword [ebp - 0x24]
call fcn.0040d3ca
movzx esi, word [ebp + 8]
pop ecx
pop ecx
mov ecx, 0xffff
cmp ax, cx
jne 0x405d97
mov esi, ecx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004012d8
jmp 0x405c85
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004012d8
mov ax, word [ebp + 8]
jmp 0x405dc8
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.004012d8
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c9b7
leave
ret 4
Function at 0x4070a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4265d4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + 0x44], 0
push esi
je 0x40718d
cmp byte [edi + 0x4a], 0
je 0x40718d
mov eax, dword [edi]
mov esi, 0xffff
push esi
mov ecx, edi
call dword [eax + 0xc]
cmp si, ax
jne 0x4070e2
xor al, al
jmp 0x40718f
lea esi, [ebp - 0x20]
call fcn.00406a83
push ebx
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x40712f
lea eax, [ebp - 0x20]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x24]
push ebx
mov ebx, dword [ebp - 0x10]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x407134
dec eax
je 0x407138
dec eax
dec eax
je 0x407189
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004012d8
mov al, bl
pop ebx
jmp 0x40718f
mov edx, dword [ebp - 0x20]
jmp 0x4070f9
mov byte [edi + 0x4a], 0
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x407144
lea eax, [ebp - 0x20]
mov esi, dword [ebp - 0x24]
sub esi, eax
je 0x40716a
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x407157
lea eax, [ebp - 0x20]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0040e9a5
add esp, 0x10
cmp esi, eax
jne 0x40711c
cmp byte [edi + 0x4a], 0
je 0x407189
test esi, esi
jne 0x4070eb
push esi
push 8
pop ebx
lea esi, [ebp - 0x20]
call fcn.00401281
jmp 0x4070eb
mov bl, 1
jmp 0x40711e
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040c9b7
leave
ret

Function at 0x40783b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x58
call fcn.0040bdb1
xor edx, edx
pop ecx
cmp dword [ebp + 0xc], edx
jle 0x40787d
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x427578
mov edi, eax
sub esi, ecx
sub edi, ecx
mov cx, word [esi + edx*2 + 0x427578]
xor cx, word [edx*2 + 0x427578]
inc edx
mov word [edi + edx*2 + 0x427576], cx
cmp edx, dword [ebp + 0xc]
jl 0x40785d
pop edi
pop esi
xor ecx, ecx
mov word [eax + edx*2], cx
pop ebp
ret 8