joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ead0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
movzx ecx, byte [esp + eax]
lea edx, [eax + 0x6d0adf57]
xor edx, ecx
add edx, 0x6db4ca35
mov ecx, edx
and ecx, 0x18
xor edx, 0x18
lea ecx, [edx + ecx*2]
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43eaf0
mov eax, dword [esp]
mov edx, dword [0x449ea0]
test edx, edx
je 0x43eb78
xor ebx, ebx
mov ecx, dword [0x449ea4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x43eb50
inc ebx
cmp edx, ebx
jne 0x43eb40
jmp 0x43eb78
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43eb78
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push edx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x20
test edi, edi
je 0x43eb82
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43eb8e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43eba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
lea ebx, [eax + 0x6d0adf57]
xor ebx, edi
add ebx, 0x6db4ca35
mov edi, ebx
and edi, 0x18
xor ebx, 0x18
lea ebx, [ebx + edi*2]
mov byte [esp + eax], bl
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
cmp eax, 5
jb 0x43ebd0
mov eax, dword [esp]
mov ebx, dword [0x449ea0]
test ebx, ebx
je 0x43ec5e
xor ebp, ebp
mov edi, dword [0x449ea4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x43ec30
inc ebp
cmp ebx, ebp
jne 0x43ec20
jmp 0x43ec5e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43ec5e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x30
cmp eax, 0x103
jne 0x43ed09
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax + 0x6d0adf57]
xor edx, ecx
add edx, 0x6db4ca35
mov ecx, edx
and ecx, 0x18
xor edx, 0x18
lea ecx, [edx + ecx*2]
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43ec80
mov eax, dword [esp]
mov ecx, dword [0x449ea0]
test ecx, ecx
je 0x43ed01
xor edx, edx
mov edi, dword [0x449ea4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43ece0
inc edx
cmp ecx, edx
jne 0x43ecd0
jmp 0x43ed01
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ed01
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x18
test eax, eax
js 0x43ed09
mov eax, dword [esp + 8]
test esi, esi
je 0x43ed1c
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43ed1a
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ed30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
lea ebx, [eax + 0x6d0adf57]
xor ebx, edi
add ebx, 0x6db4ca35
mov edi, ebx
and edi, 0x18
xor ebx, 0x18
lea ebx, [ebx + edi*2]
mov byte [esp + eax], bl
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
cmp eax, 5
jb 0x43ed60
mov eax, dword [esp]
mov ebx, dword [0x449ea0]
test ebx, ebx
je 0x43edee
xor ebp, ebp
mov edi, dword [0x449ea4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x7e66a1b5
je 0x43edc0
inc ebp
cmp ebx, ebp
jne 0x43edb0
jmp 0x43edee
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43edee
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x30
cmp eax, 0x103
jne 0x43ee99
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax + 0x6d0adf57]
xor edx, ecx
add edx, 0x6db4ca35
mov ecx, edx
and ecx, 0x18
xor edx, 0x18
lea ecx, [edx + ecx*2]
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43ee10
mov eax, dword [esp]
mov ecx, dword [0x449ea0]
test ecx, ecx
je 0x43ee91
xor edx, edx
mov edi, dword [0x449ea4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43ee70
inc edx
cmp ecx, edx
jne 0x43ee60
jmp 0x43ee91
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ee91
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x18
test eax, eax
js 0x43ee99
mov eax, dword [esp + 8]
test esi, esi
je 0x43eea3
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43eeb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43eed0
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xe8ebeae5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
movzx edi, byte [esp + eax]
lea ebx, [eax + 0x6d0adf57]
xor ebx, edi
add ebx, 0x6db4ca35
mov edi, ebx
and edi, 0x18
xor ebx, 0x18
lea ebx, [ebx + edi*2]
mov byte [esp + eax], bl
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
cmp eax, 5
jb 0x43ef30
mov eax, dword [esp]
mov edi, dword [0x449ea0]
test edi, edi
je 0x43efb2
xor ebx, ebx
mov ebp, dword [0x449ea4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x43ef91
inc ebx
cmp edi, ebx
jne 0x43ef80
jmp 0x43efb2
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43efb2
lea eax, [esp + 0x10]
push esi
push eax
push edx
push ecx
push 4
push edi
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401023
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x401bb0
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0xe
push 0x80
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, dword [0x406624]
mov esi, eax
xor edx, edx
sub ebp, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], edx
je 0x401c28
xor eax, eax
test ebx, ebx
jbe 0x401c1b
mov ecx, dword [0x406b0c]
lea edi, [ecx + edx]
mov cl, byte [edi + eax]
cmp cl, byte [eax + esi]
jne 0x401c1b
inc eax
cmp eax, ebx
jb 0x401c0e
cmp eax, ebx
je 0x401c24
inc edx
cmp edx, ebp
jb 0x401bff
mov dword [esp + 0x14], edx
cmp word [esi + 4], 0
mov dword [esp + 0x18], 0
jbe 0x401d10
add esi, 0xe
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
xor edx, edx
push 3
mov dx, word [eax + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, dword [0x406624]
xor ebx, ebx
sub ebp, edi
je 0x401ce0
xor ecx, ecx
test edi, edi
jbe 0x401c9e
mov edx, dword [0x406b0c]
lea esi, [edx + ebx]
mov dl, byte [esi + ecx]
cmp dl, byte [ecx + eax]
jne 0x401c9e
inc ecx
cmp ecx, edi
jb 0x401c91
cmp ecx, edi
je 0x401ca9
inc ebx
cmp ebx, ebp
jb 0x401c82
jmp 0x401ce0
mov esi, dword [esp + 0x10]
lea eax, [esi - 8]
push eax
call fcn.00401064
add esp, 4
test eax, eax
je 0x401cda
mov edx, dword [0x406b0c]
mov ecx, edi
mov esi, eax
mov eax, ecx
lea edi, [edx + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x401ce0
mov dword [esi], 0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [edx + 4]
inc eax
add esi, 0xe
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
jb 0x401c42
mov ebx, dword [esp + 0x20]
mov esi, edx
mov edx, dword [esp + 0x14]
xor edi, edi
xor ecx, ecx
mov di, word [esi + 4]
mov word [esi + 4], cx
cmp edi, ecx
mov dword [esp + 0x20], edi
jbe 0x401d75
lea edx, [esi + 6]
mov eax, dword [edx + 8]
test eax, eax
je 0x401d69
xor eax, eax
mov ax, word [esi + 4]
cmp eax, ecx
je 0x401d65
lea edi, [eax*8]
sub edi, eax
lea eax, [esi + 6]
lea eax, [eax + edi*2]
mov edi, edx
mov ebp, dword [edi]
mov dword [eax], ebp
mov ebp, dword [edi + 4]
mov dword [eax + 4], ebp
mov ebp, dword [edi + 8]
mov dword [eax + 8], ebp
mov di, word [edi + 0xc]
mov word [eax + 0xc], di
mov edi, dword [esp + 0x20]
inc word [esi + 4]
inc ecx
add edx, 0xe
cmp ecx, edi
jb 0x401d27
mov edx, dword [esp + 0x14]
mov eax, dword [0x406b0c]
mov ecx, ebx
lea edi, [eax + edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x40104b
Capabilities:
Get disk information

Disassembly:
jmp 0x402620
push edi
mov edi, dword [esp + 8]
push 0x4066d8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40269b
push ebx
push esi
mov esi, 0x4066d4
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402666
test cl, cl
je 0x402662
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402666
add eax, 2
add esi, 2
test cl, cl
jne 0x40263e
xor eax, eax
jmp 0x40266b
sbb eax, eax
sbb eax, 0xffffffff
pop esi
pop ebx
test eax, eax
je 0x40269b
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x40267f
pop edi
ret
cmp eax, 4
jne 0x40268b
mov eax, 3
pop edi
ret
xor ecx, ecx
cmp eax, 3
setne cl
dec ecx
pop edi
and ecx, 4
mov eax, ecx
ret
mov eax, 1
pop edi
ret
Function at 0x40105f
Capabilities:
Create directory
Enumerate files on windows
Get disk information

Disassembly:
jmp 0x402360
push 0xffffffffffffffff
push 0x403e51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x264
push ebx
push ebp
push esi
push edi
push 0x406a04
push str._sconfigUnited_States_
push 0x4068f8
call sub.MFC42.DLL_CString::Format
mov eax, dword [0x4068f8]
add esp, 0xc
xor esi, esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x10]
call fcn.0040280a
mov dword [esp + 0x27c], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp eax, esi
mov dword [esp + 0x14], eax
je 0x402561
mov ebp, dword [esp + 0x284]
mov dword [esp + 0x18], esi
mov ebx, 2
and eax, 1
cmp al, 1
jne 0x402549
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x1c], ecx
lea edi, [esp + 0x170]
mov dword [esp + 0x20], ecx
mov ecx, 0x41
lea edx, [esi + 0x41]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x20]
push str._c:_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x28]
push ecx
call fcn.0040104b
add esp, 0x10
cmp eax, ebx
jne 0x402549
lea edx, [esp + 0x1c]
lea eax, [esp + 0x170]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x170]
push str..exe
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x30]
lea eax, [esp + 0x170]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40253e
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea ecx, [esp + 0x5c]
push 0x4066a0
push ecx
call edi
test eax, eax
je 0x40252a
lea edx, [esp + 0x5c]
push 0x40669c
push edx
call edi
test eax, eax
je 0x40252a
cmp dword [esp + 0x30], 0x10
je 0x40252a
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x18]
push str._s_s
push edx
call sub.MFC42.DLL_CString::Format
lea eax, [esp + 0x6c]
push eax
push 0x406a04
push str._sconfigUnited_States_s
push 0x4068f8
call sub.MFC42.DLL_CString::Format
add esp, 0x20
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4068f8
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x288], 1
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4068f4
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x290], bl
call sub.MFC42.DLL_CString::CString_1
mov byte [esp + 0x28c], 0
call fcn.00401014
add esp, 0x10
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402469
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
shr eax, 1
inc esi
mov dword [esp + 0x14], eax
cmp esi, 0x1a
mov dword [esp + 0x18], esi
jl 0x4023d7
lea ecx, [esp + 0x10]
mov dword [esp + 0x27c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x270
ret
Function at 0x401087
Capabilities:
Create process on windows

Disassembly:
jmp 0x4022d0
sub esp, 0x54
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
mov esi, dword [esp + 0x60]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x40232c
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 4
pop edi
pop esi
add esp, 0x54
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4ffa14bc
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x231f43ff
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401080
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
push 0x40
push eax
push 0x40ae70
call fcn.004013c0
push 0x40
push 0x409108
push 0x40ae70
push 0x40ae70
call fcn.004012e0
mov al, byte [esp + 0x34]
add esp, 0x1c
test al, al
jne 0x40110b
mov ebx, 0x40aeb0
mov eax, dword [0x40a034]
mov ecx, 8
mov esi, eax
mov edi, 0x40ae50
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401220
mov ecx, dword [0x40a030]
mov edx, dword [0x40a034]
push 0x20
push ecx
push edx
call fcn.00401330
mov edi, dword [0x40a030]
add ebx, 0x30
add esp, 0x14
mov ecx, 8
mov esi, 0x40ae50
cmp ebx, 0x40b1b0
rep movsd dword es:[edi], dword [esi]
jl 0x4010ba
jmp 0x40115e
mov ebx, 0x40b180
mov eax, dword [0x40a030]
mov ecx, 8
mov esi, eax
mov edi, 0x40ae50
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401220
mov eax, dword [0x40a034]
mov ecx, dword [0x40a030]
push 0x20
push eax
push ecx
call fcn.00401330
mov edi, dword [0x40a034]
sub ebx, 0x30
add esp, 0x14
mov ecx, 8
mov esi, 0x40ae50
cmp ebx, 0x40aeb0
rep movsd dword es:[edi], dword [esi]
jge 0x401110
push 0x40
push 0x409148
push 0x40ae70
push 0x40ae70
call fcn.004012e0
mov edx, dword [esp + 0x20]
push 0x40
push 0x40ae70
push edx
call fcn.00401410
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x401190
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0x40
push eax
push 0x40ae10
call fcn.004013c0
push 0x38
push str.91__
push 0x40ae10
push 0x40ae10
call fcn.004012e0
add esp, 0x1c
xor esi, esi
mov edi, 0x40aeb0
mov edx, dword [0x40a038]
xor ecx, ecx
mov cl, byte [esi + 0x409240]
push ecx
push 0x1c
push edx
call fcn.00401360
mov ecx, dword [0x40a03c]
xor eax, eax
mov al, byte [esi + 0x409240]
push eax
push 0x1c
push ecx
call fcn.00401360
push 0x30
push 0x409210
push 0x40ae10
push edi
call fcn.004012e0
add esp, 0x28
add edi, 0x30
inc esi
cmp edi, 0x40b1b0
jl 0x4011c3
pop edi
pop esi
ret

Function at 0x401220
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x409188
push esi
push 0x40ade0
call fcn.004012e0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x40ade0
call fcn.00401330
push 0x40ade0
push esi
call fcn.00401270
push 0x20
push 0x4091b8
push esi
push esi
call fcn.004012e0
add esp, 0x34
pop esi
ret

Function at 0x401330
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x401352
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x401344
pop ebx
pop esi
ret
Function at 0x401480
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x4014c0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4014ab
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4014b8
add edx, ecx
cmp ebx, edx
jb 0x4014c2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4014a1
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x401500
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
cmp word [ebp], 0x5a4d
jne 0x401571
mov eax, dword [ebp + 0x3c]
add eax, ebp
cmp dword [eax], 0x4550
jne 0x401571
cmp word [eax + 0x14], 0xe0
jne 0x401571
cmp word [eax + 0x18], 0x10b
jne 0x401571
mov dword [0x40b1b8], ebp
mov esi, dword [ebp + 0x3c]
add esi, ebp
push esi
mov edi, dword [esi + 0x78]
push edi
call fcn.00401480
add esp, 8
test eax, eax
je 0x401571
mov eax, dword [0x40b1b8]
push eax
push esi
push edi
call fcn.004014d0
mov ebx, dword [esi + 0x78]
add esp, 0xc
test ebx, ebx
jne 0x40157b
push ebx
push ebx
push str.Error_in_GetProcAddressDirectly__
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov ecx, dword [ebx + ebp + 0x24]
mov edx, dword [ebx + ebp + 0x20]
mov edi, dword [ebx + ebp + 0x1c]
mov eax, dword [esp + 0x30]
add ebx, ebp
add ecx, ebp
add edx, ebp
add edi, ebp
shr eax, 0x10
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], edi
je 0x401661
mov esi, dword [edi]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40162d
xor ebp, ebp
mov edi, edx
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [edx]
cmp ecx, eax
jne 0x40160e
mov eax, dword [edi]
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
add eax, ecx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401601
test cl, cl
je 0x4015fd
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401601
add eax, 2
add esi, 2
test cl, cl
jne 0x4015dd
xor eax, eax
jmp 0x401606
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401648
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [ebx + 0x18]
inc ebp
add edx, 2
add edi, 4
dec ecx
cmp ebp, ecx
mov dword [esp + 0x10], edx
jbe 0x4015c4
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov esi, dword [ebx + 0x14]
inc eax
dec esi
mov dword [esp + 0x14], eax
cmp eax, esi
jbe 0x4015b4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, dword [edx + eax*4]
pop esi
pop ebp
add eax, ecx
pop ebx
add esp, 0x18
ret
mov ecx, dword [ebx + 0x10]
xor eax, eax
mov edx, edi
cmp dword [esp + 0x30], ecx
jne 0x401673
cmp dword [edx], 0
jne 0x40168a
mov esi, dword [ebx + 0x14]
inc eax
inc ecx
add edx, 4
dec esi
cmp eax, esi
jbe 0x401668
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [edi + eax*4]
pop edi
shl eax, 6
add eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x18
ret