joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d00
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x406d22
cmp dword [ebp + 0xc], 1
jae 0x406d29
xor eax, eax
jmp 0x406e5a
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00407070
add esp, 0xc
call fcn.00403960
test eax, eax
je 0x406d5c
push 1
push str.SePInstallDirectryMap
push 0
push 4
call fcn.00403a00
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x406d6e
push str.SePInstallDirectryMap
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406dc4
push 0x104
push 0
push 0
push 4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406dba
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x406db0
mov ecx, 0x41
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x10]
push eax
call dword [0x41713c]
cmp dword [ebp - 8], 0
jne 0x406e57
call fcn.00403960
test eax, eax
je 0x406def
push 1
push str.FM1InstallDirectryMap
push 0
push 4
call fcn.00403a00
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x406e01
push str.FM1InstallDirectryMap
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406e57
push 0x104
push 0
push 0
push 4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406e4d
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x406e43
mov ecx, 0x41
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x10]
push edx
call dword [0x41713c]
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40bd82
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416bb8]
jne 0x40bd8c
repz ret
jmp fcn.0040db8f
Function at 0x40d63c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004099e4
and dword [ebp - 4], 0
cmp dword [0x4177ec], 0
mov ebx, eax
jne 0x40d6ed
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d79e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x414eec
push edi
call esi
test eax, eax
je 0x40d79e
push eax
call fcn.00409972
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4177ec], eax
call esi
push eax
call fcn.00409972
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4177f0], eax
call esi
push eax
call fcn.00409972
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4177f4], eax
call esi
push eax
call fcn.00409972
pop ecx
mov dword [0x4177fc], eax
test eax, eax
je 0x40d6ed
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409972
pop ecx
mov dword [0x4177f8], eax
mov eax, dword [0x4177f8]
cmp eax, ebx
je 0x40d745
cmp dword [0x4177fc], ebx
je 0x40d745
push eax
call fcn.004099ed
push dword [0x4177fc]
mov esi, eax
call fcn.004099ed
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d745
test edi, edi
je 0x40d745
call esi
test eax, eax
je 0x40d73c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d73c
test byte [ebp - 0xc], 1
jne 0x40d745
or dword [ebp + 0x10], 0x200000
jmp 0x40d77e
mov eax, dword [0x4177f0]
cmp eax, ebx
je 0x40d77e
push eax
call fcn.004099ed
pop ecx
test eax, eax
je 0x40d77e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d77e
mov eax, dword [0x4177f4]
cmp eax, ebx
je 0x40d77e
push eax
call fcn.004099ed
pop ecx
test eax, eax
je 0x40d77e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4177ec]
call fcn.004099ed
pop ecx
test eax, eax
je 0x40d79e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d7a0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d89
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x402dbf
lea esi, [edi + 4]
test esi, esi
je 0x402dbf
call fcn.00402ceb
test al, al
je 0x402dbf
mov ecx, edi
call fcn.00402ceb
test al, al
je 0x402dbf
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x402dc1
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x405301
pop dword [ebp - 0x50]
mov eax, 0xf079483a
sub eax, 0xf038f539
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3f875
push 0
mov eax, 0x4bb8b57a
add eax, 0xb4891c9a
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xaa962fcf
add ecx, 0x556a20cd
mov ebx, eax
mov esi, 0xc49f6d1a
sub esi, 0xc45c0d1a
add esi, dword [ebp - 0x50]
mov edx, 0xbbd6ec29
sub edx, 0x97230e95
mov dword [ebp - 4], 0x4f2884d1
mov edi, dword [esi]
mov dword [ebp - 4], 0x594063d0
xor edi, edx
sub dword [ebp - 0x3c], esi
mov dword [ebx], edi
add dword [ebp - 0x24], eax
add ebx, 0xb3bfb8b4
sub ebx, 0xb3bfb8b0
add esi, 0x1cb19039
sub esi, 0x1cb19035
loop 0x405360
add eax, 0x75b585b5
add eax, 0x8a4baf8e
xor ebx, ebx
add ebx, eax
add eax, 0xf3b9d043
add eax, 0xc462fc2
mov ecx, 0x785ecd54
add ecx, 0x87e132ac
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x40612f
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4061b0
mov byte [esi + 8], 1
call main
cmp dword [esi + 0x10], 0
je 0x4061b0
test al, al
je 0x40614f
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.00406749
test al, al
jne 0x406176
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call main
cmp dword [esi + 0x18], 0
jne 0x40619d
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x4061b0
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x406749
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x406756
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x40678f
cmp eax, 0x80
je 0x40678f
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x406752
mov al, 1
pop esi
ret
Function at 0x407427
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407496
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407472
push ebx
push edi
push eax
call fcn.0040b3a0
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x40748d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5742597e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7623131
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x434431
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
jmp 0x449f8c
jmp 0x43415c
pushfd
lea esp, [esp + 0x28]
call fcn.0043448e
je 0x44360a
pushal
adc ecx, ecx
pushal
mov byte [esp], 0xf1
call fcn.00445621

Function at 0x445733
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul edx, edx, 0xa
mov byte [esp], ch
pushfd
add edx, eax
pushfd
lea esp, [esp + 0x14]
jmp fcn.00442d2e

Function at 0x4460e5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
je 0x4448d4
stc
call fcn.00449f52
Function at 0x446672
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, 9
pushal
call fcn.00449f64
lea esp, [esp + 0x44]
je 0x443840
dec si
pushfd
mov word [esp], 0xd67
add edi, ebx
sar si, 0xa
shld si, dx, 3
bsr si, cx
test bx, cx
mov esi, dword [edx]
clc
test esi, esi
jmp 0x442ab3
lea esp, [esp + 4]
je 0x444bf0
jmp 0x4499e8
jmp 0x443630
pushfd
push 0x778e5924
mov dword [esp + 4], ebx
pushfd
jmp 0x443286
popal
pop ds
jnp 0x44328d
fst qword [edx]
push 0xb8280d47
mov byte [0x6e7d0cd7], al
out 0x34, eax
std
pop edx
aaa
test al, 0xdd
mul byte [edi + 0x23fea5cc]
pop eax
inc ecx
arpl word ss:[ecx + ecx*2 + 0x7b1f616a], ax
jns 0x44322d
inc ebp
cmp cl, byte [ebx - 0x40f3b898]
arpl word [ebp + ecx*4 - 0x76], ax
out 0xc4, eax
imul edi, dword [edx], 0xff02f78b
dec edx
xchg esi, eax
inc ecx
sub al, 0x22
mov ah, byte [ebx - 0x207dd66c]
enter 0x5249, 0x4f
je 0x443217
invalid
invalid
inc eax
jno 0x44322b
stc
sub al, 0x30
pushal
jmp 0x4428f7
xor byte [eax - 0x17], ah
jno 0x44327a
invalid
pushal
pushfd
lea esp, [esp + 0x2c]
call fcn.004438f5
push es
add byte [eax], al
call fcn.004433c0
sti
shl dword [edx], 0x27
mov eax, 0x34ffae29
inc ecx
ja 0x44325f
or bh, bl
je 0x44327f
mov byte [0x611c8bf], al
pop es
test bl, dh
retf 0xf2dc
pushfd
push ebx
mov dword [esp + 4], edi
lea esp, [esp + 4]
jns 0x442ba6
pushfd
mov dword [esp], ebx
push 0xe378bf
pushfd
lea esp, [esp + 8]
call fcn.004438f5
pushfd
mov esp, esi
pushal
lea esp, [esp + 0x20]
jmp 0x442c32
dec bl
rcr bh, cl
xor si, dx
xor eax, eax
setne bl
movsx bx, al
movzx bx, bl
not bh
pop ebx
movsx si, bl
pop edi
lea esi, [edx + 0x33304ad4]
not si
call fcn.00445283
leave
movsd dword es:[edi], dword [esi]
pop ebp
call 0x9507c0dd
jmp 0x6354f5c3
push 0x7a1a5011
repne scasb al, byte es:[edi]
pushfd
lea esp, [esp + 0x14]
jne 0x443a0b
mov al, ch
movsx ax, al
mov byte [edi - 1], 0
lahf
push ebx
call fcn.00445b9f
lea esp, [esp + 4]
jne 0x442b43
cmc
xor edx, edx
bsr eax, esp
mov eax, edx
call fcn.00446e1d
push 0x9764a530
xchg edi, eax
call fcn.0044b065
and al, 0x9d
jo 0x443e78
cdq
movsb byte es:[edi], byte [esi]
shr dword [esi - 0x45], 1
test cl, al
dec edx
push ebx
or al, 0x49
into
inc edi
pop esp
jno 0x443eea
andps xmm1, xmm5
lcall 0x74e7, 0xf445d6e8
jge 0x443ec4
mov word [ebp + 0x38adef4], cs
jge 0x443f1a
outsd dx, dword [esi]
cdq
cdq
jo 0x443f60
inc ebx
mov edi, 0xda7801b0
pop ebp
xchg byte [ebx - 0x68], dl
pop ebp
call 0xef41b491
jecxz 0x443f1c
div byte [ebx]
das
sbb eax, 0x11e8e35e
xchg edx, eax
scasd eax, dword es:[edi]
mov al, 0xd
cmp ah, byte [edi - 0x18]
sal dword [edx + 0x2444c6cb], 1
mov byte [esp + 8], 0xa
dec al
stc
test bh, 0xed
cmp cl, cl
cmp bx, 0x5a2b
shr eax, 1
mov byte [esp + 8], dh
call fcn.00445895
and al, 8
bsr si, ax
shr si, cl
adc esi, edi
daa
mov esi, edi
btc ax, bx
pushfd
mov eax, dword [edx + 0xc]
test ax, dx
pushal
add eax, ebx
pushfd
xchg dword [esp + 0x24], eax
pushfd
movsx eax, cl
setae ah
lea eax, [0x4345d1]
pushfd
mov dword [esp + 0x28], 0x434418
push 0xfbee76ea
mov word [esp + 0xc], 0x695
mov dword [esp + 0x28], eax
mov dword [esp], ebp
push dword [esp + 0x28]
ret 0x2c
mov al, 0x2e
stc
jmp 0x443eac
call fcn.00449b4c
Function at 0x446e48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x4448d4
call fcn.004458b9
lea esp, [esp + 8]
je 0x446559
add byte [eax], al
pushal
call fcn.00446231
mov dword [ebp + eax - 0x16f3189e], ebx
inc esi
out dx, eax
pop eax
loop 0x44447b
or ch, dl
test byte [edi - 0x64], 0xd
clc
xchg edx, eax
mov al, 0x6d
sub ch, byte [ebx]
pushfd
mov ebp, 0x7c167f5
push ebx
nop
loope 0x444492
mov ch, 0xcc
inc esp
cli
cmp al, al
mov ebp, 0x9574d3fa
jbe 0x444418
cwde
or eax, 0x9d243f3a
and al, 0x9d
cli
jl 0x444469
invalid
or eax, 0x5f6ebc68
jo 0x44442b
push 0x279da530
call fcn.0044bba2
xchg esp, eax
mov dword [0xe8093cce], eax
insd dword es:[edi], dx
sldt word [eax]
jmp 0x444423

Function at 0x449f64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x443c6d
mov byte [esp + 8], dl
pushal
lea esp, [esp + 0x44]
jbe 0x444e32
not edi
bt bp, bx
mov edi, dword [edx + 0x24]
movsx si, bl
lea esi, [esp - 0x5ac412f0]
add edi, eax
adc esi, 0xb998c0d
mov esi, dword [edx + 0x20]
push esi
add esi, eax
bt di, 4
xor ecx, ecx
add esp, 4
call fcn.00443703
call 0x444eb0
mov dword [esp + 0x24], ecx
shr cx, cl
rcr ch, 1
mov ecx, dword [ebp + 4]
stc
stc
cmp ecx, 0xffff
jmp 0x434484

Function at 0x44ab24
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x98
call fcn.0044b844

Function at 0x44ab2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xc], sp
push dword [esp + 0x40]
pop dword [ebp]
push dword [esp + 4]
mov dword [esp], 0xdc8da45b
mov byte [esp], ch
lea esp, [esp + 0x48]
jmp 0x44a5c2

Function at 0x44b82d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pop dword [esp + 4]
bswap di
pushfd
mov dword [esp + 4], esi
not edi
xchg si, di
call fcn.0044a674

Function at 0x44b844
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push dword [esp + 0x3c]
pop dword [ebp]
push 0xffc8cdd2
mov word [esp], 0x22ea
pushfd
lea esp, [esp + 0x48]
jmp 0x44a5c2
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x404f26
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x404f35
pop dword [ebp - 0x14]
mov eax, 0x404f35
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x4ed7ed1e
add dword [ebp - 0x24], 0xff7a582d
mov dword [ebp - 0x20], 0xb996384
sub dword [ebp - 0x20], 0xd966173f
mov dword [ebp - 0x1c], 0x779f4e7c
sub dword [ebp - 0x1c], 0x2b530a4e
mov dword [ebp - 0x18], 0xf0e1e6e
add dword [ebp - 0x18], 0xf0f1e192
lea eax, [ebp - 0x24]
push eax
mov eax, 0xbc79bd41
add eax, 0x43c712f3
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x4c269291
add dword [ebp - 0x24], 0x284bd6c5
mov dword [ebp - 0x20], 0xcde9b33a
add dword [ebp - 0x20], 0x7382ae3b
mov dword [ebp - 0x1c], 0x1813b5ad
add dword [ebp - 0x1c], 0x4b5bb6bf
mov dword [ebp - 0x18], 0xe1ac5f67
sub dword [ebp - 0x18], 0xe1ac5f67
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x5c28a33
add eax, 0xfa7e45fd
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3865d
push 0
call eax
mov ecx, 0x4653
mov esi, eax
mov edx, 0xf4efa225
add edx, 0xb526ddb
add edx, dword [ebp - 0x14]
mov ebx, 0xd3273dc2
sub ebx, 0xe2dbac74
add dword [ebp - 4], 0xc23d3556
mov edi, dword [edx]
sub dword [ebp - 4], 0xd71dce6f
xor edi, ebx
mov dword [ebp - 4], 0xa6735788
mov dword [esi], edi
add dword [ebp - 4], 0x3f55b64f
add esi, 4
add edx, 0xc60329f
add edx, 0xf39fcd65
loop 0x40504c
add eax, 0x55a7b591
sub eax, 0x55a6a972
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6ecd3422
add ecx, 0x9172cbde
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x405240
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x405391
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
nop dword [eax]
call esi
sub byte [edi + ebp], 0x15
call esi
add byte [edi + ebp], 0x29
call esi
xor byte [edi + ebp], 0x7e
call esi
add byte [edi + ebp], 0x60
call esi
add byte [edi + ebp], 0xe1
call esi
add byte [edi + ebp], 0x96
call esi
add byte [edi + ebp], 0x50
call esi
xor byte [edi + ebp], 0x18
call esi
add byte [edi + ebp], 0xc
call esi
add byte [edi + ebp], 0x1d
call esi
xor byte [edi + ebp], 0x4c
call esi
add byte [edi + ebp], 0x74
call esi
add byte [edi + ebp], 0x5d
call esi
add byte [edi + ebp], 0xf7
call esi
add byte [edi + ebp], 0xd4
call esi
add byte [edi + ebp], 0x15
call esi
xor byte [edi + ebp], 0xf3
call esi
add byte [edi + ebp], 0x2b
call esi
add byte [edi + ebp], 7
call esi
add byte [edi + ebp], 0xec
call esi
add byte [edi + ebp], 0xb2
call esi
add byte [edi + ebp], 0x55
call esi
add byte [edi + ebp], 0x79
call esi
add byte [edi + ebp], 0xb7
call esi
add byte [edi + ebp], 0x33
call esi
xor byte [edi + ebp], 0xd5
call esi
add byte [edi + ebp], 0x84
call esi
add byte [edi + ebp], 0x26
call esi
add byte [edi + ebp], 0x51
call esi
add byte [edi + ebp], 0x25
call esi
add byte [edi + ebp], 0xd7
call esi
xor byte [edi + ebp], 0x9c
call esi
xor byte [edi + ebp], 0xdd
call esi
xor byte [edi + ebp], 0xc3
call esi
add byte [edi + ebp], 0x88
call esi
add byte [edi + ebp], 0x56
call esi
xor byte [edi + ebp], 0x5d
call esi
add byte [edi + ebp], 0x16
call esi
add byte [edi + ebp], 0xc2
call esi
xor byte [edi + ebp], 0x93
call esi
add byte [edi + ebp], 0xbf
call esi
xor byte [edi + ebp], 0xab
call esi
add byte [edi + ebp], 0x51
call esi
xor byte [edi + ebp], 0xa9
call esi
add byte [edi + ebp], 0x5f
call esi
xor byte [edi + ebp], 0x29
call esi
add byte [edi + ebp], 0xfb
call esi
add byte [edi + ebp], 0xef
call esi
add byte [edi + ebp], 0xe7
inc edi
cmp edi, ebx
jb 0x405260
pop esi
pop ebp
pop edi
pop ebx
ret
Function at 0x41ad5d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a840
mov eax, dword [0x46d500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00418511
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41ad9f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41aefb
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00425fb0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x46fbb8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041b183
mov ecx, dword [esi*4 + 0x46fbb8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41aef4
cmp eax, dword [edi + ecx + 0x24]
jne 0x41aef4
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41aef4
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b183
add esp, 0x14
test edx, edx
jl 0x41aef4
jg 0x41ae6a
test eax, eax
jb 0x41aef4
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41aef4
jl 0x41ae84
cmp dword [ebp - 0x1008], eax
ja 0x41aef4
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41aea2
test ebx, ebx
je 0x41aedb
cmp ecx, edi
jae 0x41aedb
mov al, byte [ecx]
cmp al, 0xd
jne 0x41aebc
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41aec8
cmp byte [ecx + 1], 0xa
jne 0x41aec8
inc ecx
jmp 0x41aec8
movzx eax, al
movsx eax, byte [eax + 0x46de40]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41aea2
cmp edx, ebx
jne 0x41aea2
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41aef9
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409c00
leave
ret