joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010879
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1040
call fcn.1003c310
mov eax, dword [0x1008f304]
xor eax, esp
mov dword [esp + 0x103c], eax
and dword [esp], 0
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1048]
push edi
mov edi, dword [esp + 0x1058]
push eax
push dword [esp + 0x1054]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
pop ecx
pop ecx
test eax, eax
jns 0x100108eb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [eax]
push esi
call sym.glib_lite.dll_Ordinal_353
pop ecx
push eax
push esi
call fcn.10002ff5
pop ecx
push eax
call fcn.100030eb
push eax
push edi
call fcn.1002b259
add esp, 0x10
xor eax, eax
jmp 0x100109ca
test dword [esp + 0x12], 0x8000
jne 0x10010903
push str.Not_a_regular_file
push 1
call fcn.100102cf
jmp 0x100108da
push ebx
mov bl, byte [esi + 0x14]
push esi
call fcn.10010253
push esi
call fcn.10010717
mov eax, dword [esp + 0x1060]
pop ecx
pop ecx
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], eax
push ebp
push 0x1000
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1060]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [eax]
test ebp, ebp
je 0x10010996
jns 0x10010978
cmp ebx, 4
je 0x1001098c
cmp ebx, 0xb
je 0x1001098c
push ebx
call sym.glib_lite.dll_Ordinal_353
pop ecx
push eax
push ebx
call fcn.10002ff5
pop ecx
push eax
call fcn.100030eb
push eax
push edi
call fcn.1002b259
add esp, 0x10
jmp 0x100109c1
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x54]
push eax
push esi
call fcn.10010c32
add esp, 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10010923
jmp 0x1001099e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100109a1
push eax
jmp 0x100109b9
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1002b259
cmp dword [esp + 0x18], 0
pop ecx
pop ecx
je 0x100109c5
push dword [esp + 0x10]
push edi
call fcn.1002b259
pop ecx
pop ecx
xor eax, eax
jmp 0x100109c8
xor eax, eax
inc eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x1044]
pop edi
pop esi
xor ecx, esp
call fcn.1003c212
add esp, 0x1040
ret
Function at 0x100296d3
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [edi + 0x74]
push eax
xor eax, eax
push eax
push edi
push dword [esp + 0x20]
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test esi, esi
jne 0x1002971a
push dword [eax]
call sym.glib_lite.dll_Ordinal_353
push eax
push str.Error_creating_thread:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_182
add esp, 0x14
jmp 0x1002974e
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1002974e
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.1002b259
mov esi, eax
push esi
push str.Error_closing_thread_handle:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_182
push esi
call sym.glib_lite.dll_Ordinal_105
add esp, 0x18
push 0xffffffffffffffff
push dword [edi + 0x8c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
pop edi
pop esi
ret

Function at 0x1002b259
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1002b268
pop dword [ebp - 0x4c]
mov eax, 0x7be9343f
sub eax, 0x6be681d7
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xc0cbfc69
sub dword [ebp - 0x5c], 0x7279b71e
mov dword [ebp - 0x58], 0x15ae89a5
sub dword [ebp - 0x58], 0xe37b3d60
mov dword [ebp - 0x54], 0x90ddbbcc
sub dword [ebp - 0x54], 0x4491779e
mov dword [ebp - 0x50], 0x640b303e
add dword [ebp - 0x50], 0x9bf4cfc2
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x24dfea96
sub eax, 0x14dbe982
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x29939567
add dword [ebp - 0x5c], 0x4aded3ef
mov dword [ebp - 0x58], 0xf547e2e2
sub dword [ebp - 0x58], 0xb3db816d
mov dword [ebp - 0x54], 0xfc9d6ea0
add dword [ebp - 0x54], 0x66d1fdcc
mov dword [ebp - 0x50], 0x29c5976a
add dword [ebp - 0x50], 0xd63a6896
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b4f9
push 0
call eax
mov ecx, 0xaa6cf98c
sub ecx, 0xaa6cb120
xor edx, edx
add edx, eax
mov edi, 0x10094a00
add edi, dword [ebp - 0x4c]
mov esi, 0xbc2f5352
sub esi, 0x5128c3de
xor dword [ebp - 0x3c], edx
mov ebx, dword [edi]
add ebx, esi
sub dword [ebp - 0x14], 0xee50e056
mov dword [edx], ebx
add edx, 0x9ac595bf
sub edx, 0x9ac595bb
add edi, 0x85fe5936
sub edi, 0x85fe5932
loop 0x1002b381
add eax, 0x11483
xor ebx, ebx
add ebx, eax
add eax, 0xfecd41b
sub eax, 0xfecd416
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x419668
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4196c1
test eax, edx
je 0x4196c4
movzx ecx, word [edx]
cmp cx, word [eax]
cmp ecx, dword [eax]
je 0x41967f
movzx eax, word [eax]
sub eax, ecx
jmp 0x4196a6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4196a7
add ecx, 4
js 0x419697
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4196a4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4196a6
xor eax, eax
ret
test eax, eax
je 0x4196d0
test edx, edx
jne 0x419670
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42459c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x4245b8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4245ba
shr eax, 1
dec edx
jne 0x4245ab
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4245a4
pop esi
ret

Function at 0x4245d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x4245fa
call fcn.0042459c
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x424624
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x424600
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x467440
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x467448
mov eax, edx
pop esi
pop ebx
ret
Function at 0x403650
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x434458
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4445f4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
call fcn.0040b99f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40368d
push 0x80004005
call fcn.004027f0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
cmp byte [0x448734], 0
mov edx, str.SetUp_x64.exe
jne 0x4036b8
mov edx, str.SetUp.exe
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4036c0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.004023c0
mov esi, dword [esp + 0xc]
lea edi, [esp + 0xc]
call fcn.00402f80
mov esi, dword [esp + 0xc]
push 5
push 0
push 0
push esi
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40372b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x403770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.0040eb22

Function at 0x4038c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4038d9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403914
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403910
lea ebx, [ebx]
cmp esi, eax
jae 0x403914
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403900
cmp esi, eax
jb 0x40391a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4093cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x409412
call fcn.0041022f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x409412
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40942e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00408f43
mov esi, eax
test edi, edi
je 0x40942c
test ebx, ebx
je 0x40942c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x409cc7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x433245
call fcn.00421560
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x409cec
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x409d32
lea ecx, [ebp - 0x10]
call fcn.00402610
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004094da
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402680
mov eax, esi
call fcn.00421638
ret 8

Function at 0x40c54a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x4445f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x40c5e2
push 0x436d0c
push 4
push eax
call fcn.00420d8d
push eax
call fcn.00403970
add esp, 0x10
push ebx
push edi
call fcn.004219a9
mov edi, dword [eax]
call fcn.004219a9
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00421946
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004219a9
cmp dword [eax], ebx
je 0x40c5f9
call fcn.004219a9
push dword [eax]
call fcn.00403b4b
pop ecx
jmp 0x40c600
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x40c58d
jmp 0x40c687
call fcn.004219a9
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x40c683
cmp dword [ebp - 0x234], esi
jae 0x40c683
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.00421100
add esp, 0xc
push 0x436a6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40c672
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40c672
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x40c672
push ebx
push ebx
push esi
jmp 0x40c67b
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40c685
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004208ad
leave
ret
Function at 0x40d7ed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x40d835
call fcn.0041022f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40d835
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x40d878
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x40d861
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40d861
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40d875
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4208ad
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4445f4]
jne 0x4208b7
repz ret
jmp fcn.004258b6

Function at 0x42c5a2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004252c5
and dword [ebp - 4], 0
cmp dword [0x448598], 0
mov ebx, eax
jne 0x42c653
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42c704
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42c704
push eax
call fcn.00425253
mov dword [esp], 0x439530
push edi
mov dword [0x448598], eax
call esi
push eax
call fcn.00425253
mov dword [esp], 0x43951c
push edi
mov dword [0x44859c], eax
call esi
push eax
call fcn.00425253
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4485a0], eax
call esi
push eax
call fcn.00425253
pop ecx
mov dword [0x4485a8], eax
test eax, eax
je 0x42c653
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00425253
pop ecx
mov dword [0x4485a4], eax
mov eax, dword [0x4485a4]
cmp eax, ebx
je 0x42c6ab
cmp dword [0x4485a8], ebx
je 0x42c6ab
push eax
call fcn.004252ce
push dword [0x4485a8]
mov esi, eax
call fcn.004252ce
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42c6ab
test edi, edi
je 0x42c6ab
call esi
test eax, eax
je 0x42c6a2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42c6a2
test byte [ebp - 0xc], 1
jne 0x42c6ab
or dword [ebp + 0x10], 0x200000
jmp 0x42c6e4
mov eax, dword [0x44859c]
cmp eax, ebx
je 0x42c6e4
push eax
call fcn.004252ce
pop ecx
test eax, eax
je 0x42c6e4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42c6e4
mov eax, dword [0x4485a0]
cmp eax, ebx
je 0x42c6e4
push eax
call fcn.004252ce
pop ecx
test eax, eax
je 0x42c6e4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x448598]
call fcn.004252ce
pop ecx
test eax, eax
je 0x42c704
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42c706
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xf964a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5e5000]
push edi
jmp 0xf964ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xf964c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf964b0
mov eax, 1
add ebx, ebx
jne 0xf964d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xf964e4
jne 0xf96503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf96503
dec eax
add ebx, ebx
jne 0xf964f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xf964c8
add ebx, ebx
jne 0xf964ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xf96555
xor ecx, ecx
sub eax, 3
jb 0xf9651b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xf9658a
sar eax, 1
mov ebp, eax
jmp 0xf96526
add ebx, ebx
jne 0xf96526
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf964f4
inc ecx
add ebx, ebx
jne 0xf96534
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf964f4
add ebx, ebx
jne 0xf96541
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xf96536
jne 0xf96552
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xf96536
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xf96574
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xf96566
jmp 0xf964b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xf96574
add edi, ecx
jmp 0xf964b6
pop esi
mov edi, esi
mov ecx, 0xd2ba
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xf96592
cmp byte [edi], 0x24
jne 0xf96592
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xf96597
lea edi, [esi + 0xb93000]
mov eax, dword [edi]
or eax, eax
je 0xf9660f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbd9098]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbd91f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xf965c4
mov ecx, edi
jns 0xf965f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbd9200]
or eax, eax
je 0xf96609
mov dword [ebx], eax
add ebx, 4
jmp 0xf965e1
call dword [esi + 0xbd91fc]
mov ebp, dword [esi + 0xbd9204]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xf96643
sub esp, 0xffffff80
jmp 0x5bb322
Function at 0x401510
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 0x428580
xor edi, edi
lea eax, [esi + 0x68]
push eax
call fcn.00403a40
mov ebp, eax
add esp, 8
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x401555
mov eax, dword [esp + 0x1c]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402690
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x20]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [esi]
adc eax, dword [esi + 4]
push eax
push ecx
push ebp
call fcn.0040ed46
add esp, 0x10
test eax, eax
jns 0x40158d
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402530
add esp, 0xc
jmp 0x4015bd
push dword [ebx + 0xc]
call fcn.00412a29
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4015d3
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00402530
add esp, 0x10
mov edi, dword [esp + 0x10]
push dword [esp + 0x14]
call fcn.0040e6c1
add esp, 4
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
cmp byte [ebx + 0x10], 1
jne 0x4015fb
push eax
push 0
push ebx
push ebp
call fcn.00401040
add esp, 0x10
test eax, eax
je 0x4015b9
mov edi, dword [esp + 0x10]
push edi
call fcn.00412a0e
add esp, 4
xor edi, edi
jmp 0x4015bd
mov esi, dword [ebx + 0xc]
mov ebp, eax
xor ebx, ebx
test esi, esi
je 0x40167a
test ebx, ebx
jb 0x40161b
ja 0x401614
cmp esi, 0x2000
jbe 0x40161b
mov edi, 0x2000
jmp 0x40161d
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push ebp
call fcn.0040e922
add esp, 0x10
cmp eax, 1
jb 0x40164c
sub esi, edi
sbb ebx, 0
add ebp, edi
test ebx, ebx
ja 0x401614
jb 0x4015b9
test esi, esi
jne 0x401606
jmp 0x4015b9
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402530
mov edi, dword [esp + 0x1c]
add esp, 0xc
push edi
call fcn.00412a0e
add esp, 4
xor edi, edi
jmp 0x4015bd
mov edi, eax
jmp 0x4015bd
Function at 0x405e13
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x4308e8
push 0x40a574
push ebx
call dword [sym.imp.kernel32.dll_lstrcpyW]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.kernel32.dll_GetShortPathNameW]
test esi, esi
mov edi, 0x400
je 0x405e61
push 1
push 0
push esi
call fcn.00405cb9
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x405f80
cmp eax, edi
jg 0x405f80
mov esi, 0x4310e8
push edi
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x405f80
cmp eax, edi
jg 0x405f80
push esi
push ebx
push str._ls_ls_r_n
push 0x4304e8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x434ef0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.004070d4
push 4
push 0xc0000000
push esi
call fcn.00405cb9
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x405f80
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405f79
push edi
push esi
push ebp
call fcn.004070d4
test eax, eax
je 0x405f79
push str._Rename__r_n
push esi
call fcn.004070d4
test eax, eax
jne 0x405f17
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405f4c
add eax, 0xa
push 0x40a558
push eax
call fcn.004070d4
mov ebp, eax
test ebp, ebp
je 0x405f48
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405f39
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405f33
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405f4e
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x4304e8
push eax
call fcn.00405c74
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.004070d4
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405f85
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
jne 0x405fa8
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405e13
pop ecx
pop ecx
inc dword [0x434f70]
ret 8

Function at 0x40656f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4065a6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406580
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x40657b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065d7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4065b9
pop edi
not eax
pop esi
ret 0xc