joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x414b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b58
mov eax, 1
add ebx, ebx
jne 0x414b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b70
jne 0x414b8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b70
xor ecx, ecx
sub eax, 3
jb 0x414ba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c12
mov ebp, eax
add ebx, ebx
jne 0x414bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bdc
inc ecx
add ebx, ebx
jne 0x414bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bbd
jne 0x414bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bed
jmp 0x414b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bfc
add edi, ecx
jmp 0x414b5e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c1a
cmp byte [edi], 0
jne 0x414c1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c1f
lea edi, [esi + 0x12000]
Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.070023e0
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.070023e0
int3

Function at 0x700d4d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d534
cmp byte [esi + 0x10], 0
je 0x700d4f2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [esi + 0xc]
pop ecx
mov byte [esi + 0x10], 0
push edi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d522
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
test eax, eax
je 0x700d53b
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d536
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.070023e0
int3

Function at 0x700d7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700d833
cmp dword [esi + 0xc], 0
je 0x700d82e
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d821
push str.stream_write_error
jmp 0x700d838
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.070023e0
int3
Function at 0x4424b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x26000]
lea eax, [edi + 0x372e0]
push dword [eax]
mov dword [eax], 0xb3a082c3
push eax
push edi
jmp 0x4424da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4424e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4424d0
mov eax, 1
add ebx, ebx
jne 0x4424f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4424e8
jne 0x442504
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4424e8
xor ecx, ecx
sub eax, 3
jb 0x442518
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44258a
mov ebp, eax
add ebx, ebx
jne 0x442523
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x442530
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x442554
inc ecx
add ebx, ebx
jne 0x442540
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x442535
jne 0x442551
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x442535
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x442574
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x442565
jmp 0x4424d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x442574
add edi, ecx
jmp 0x4424d6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xd08
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x442596
cmp byte [edi], 0x11
jne 0x442596
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44259b
lea edi, [esi + 0x3f000]
mov eax, dword [edi]
or eax, eax
je 0x44260a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x46250]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x462a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4425c8
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x462a8]
or eax, eax
je 0x442604
mov dword [ebx], eax
add ebx, 4
jmp 0x4425e5
call dword [esi + 0x462a4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x44263b
cmp al, 0xef
ja 0x44262e
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x442610
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x44261d
mov ebp, dword [esi + 0x462ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44266f
sub esp, 0xffffff80
jmp 0x40ce72
Function at 0x10006724
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
xor eax, eax
mov dword [edi], 0x100015dc
mov dword [edi + 0x38], eax
push 0x10001670
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
call fcn.100046a1
mov dword [edi + 4], eax
test eax, eax
je 0x100067db
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x10001688
push eax
call esi
push 0x10001698
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push 0x100016ac
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
push 0x100016bc
push dword [edi + 4]
mov dword [edi + 0x18], eax
call esi
push 0x100016d0
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call esi
mov ebx, 0x100016e8
push ebx
push dword [edi + 4]
mov dword [edi + 0x20], eax
call esi
push ebx
push dword [edi + 4]
mov dword [edi + 0x24], eax
call esi
push 0x100016f4
push dword [edi + 4]
mov dword [edi + 0x28], eax
call esi
push 0x10001710
push dword [edi + 4]
mov dword [edi + 0x2c], eax
call esi
push 0x10001724
push dword [edi + 4]
mov dword [edi + 0x30], eax
call esi
pop esi
mov dword [edi + 0x34], eax
mov dword [edi + 8], 1
pop ebx
mov eax, edi
pop edi
ret
Function at 0x408cd0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x40c
mov eax, dword [0x82507c]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x83204c]
push ebx
mov ebx, dword [0x831ea8]
push edi
mov edi, eax
cmp eax, 0x5dd
jne 0x408d1c
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
mov eax, dword [0x83204c]
push esi
mov esi, dword [str._t:n_n]
cmp eax, 0x930
jne 0x408d37
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x83204c]
mov dword [0x827e34], esi
pop esi
cmp eax, 0x114e
jne 0x408d60
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x83204c]
cmp eax, 0x2f
jne 0x408d7d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push edi
push ebx
call fcn.00408b90
mov ecx, dword [esp + 0x418]
add esp, 8
pop edi
pop ebx
xor ecx, esp
call fcn.004015ad
add esp, 0x40c
ret
Function at 0x940058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9401a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x94007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x94006a
add dl, dl
jne 0x940089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9400dc
xor eax, eax
add dl, dl
jne 0x940096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x94017d
add dl, dl
jne 0x9400a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9400b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9400bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9400c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9400d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x940075
mov eax, 1
add dl, dl
jne 0x9400ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9400f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9400e1
sub eax, ebx
mov ebx, 1
jne 0x940128
mov ecx, 1
add dl, dl
jne 0x94010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x940119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x940105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x940075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x94013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x94014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x940136
cmp eax, 0x7d00
jae 0x94016d
cmp eax, 0x500
jb 0x940168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x940075
cmp eax, 0x7f
ja 0x940170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x940075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x94019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x940075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403250
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 0xc]
push ebx
mov ebx, ecx
test al, al
je 0x40339a
cmp al, 0x38
ja 0x40339a
cmp dword [ebp + 8], 0
je 0x40339a
movups xmm0, xmmword [section..data]
push esi
push edi
movups xmmword [ebx], xmm0
lea edi, [ebx + 0x48]
mov ecx, 0x400
movups xmm0, xmmword [0x40c010]
mov esi, 0x40c048
movups xmmword [ebx + 0x10], xmm0
movups xmm0, xmmword [0x40c020]
movups xmmword [ebx + 0x20], xmm0
movups xmm0, xmmword [0x40c030]
movups xmmword [ebx + 0x30], xmm0
movq xmm0, qword [0x40c040]
movq qword [ebx + 0x40], xmm0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
xor edi, edi
movzx ecx, al
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], ecx
nop dword [eax + eax]
xor edx, edx
lea eax, [edi + 1]
div ecx
movzx eax, byte [edi + esi]
shl eax, 8
movzx ecx, byte [edx + esi]
xor edx, edx
or ecx, eax
lea eax, [edi + 2]
div dword [ebp + 0xc]
shl ecx, 8
movzx eax, byte [edx + esi]
xor edx, edx
or ecx, eax
lea eax, [edi + 3]
div dword [ebp + 0xc]
shl ecx, 8
movzx eax, byte [edx + esi]
xor edx, edx
or ecx, eax
mov eax, dword [ebp - 4]
xor dword [ebx + eax*4], ecx
lea eax, [edi + 4]
mov ecx, dword [ebp + 0xc]
div ecx
mov eax, dword [ebp - 4]
inc eax
mov edi, edx
mov dword [ebp - 4], eax
cmp eax, 0x12
jb 0x4032d0
mov dword [ebp + 0xc], 0
xor esi, esi
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00402b40
mov eax, dword [ebp + 0xc]
mov dword [ebx + esi*4], eax
mov eax, dword [ebp + 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jb 0x403334
lea esi, [ebx + 0x4c]
mov dword [ebp - 4], 4
mov edi, 0x80
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00402b40
mov eax, dword [ebp + 0xc]
mov dword [esi - 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], eax
add esi, 8
sub edi, 1
jne 0x403367
sub dword [ebp - 4], 1
jne 0x403362
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40887d
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x40d04c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xc4], ebx
lea ecx, [ebx + 0x110]
mov dword [ebp - 0xbc], 0
call fcn.00402710
lea edi, [ebx + 0x1158]
mov dword [ebp - 4], 0
mov dword [ebp - 0xc8], edi
lea ecx, [edi + 0x68]
mov dword [edi], 0x4092ac
mov dword [edi + 0x10], 0x4092b4
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
push esi
mov ecx, edi
mov dword [ebp - 0xbc], 1
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char____]
mov eax, dword [edi]
mov dword [ebp - 4], 2
mov dword [ebp - 0xc0], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea esi, [ebx + 0x1208]
mov byte [ebp - 4], 3
push 0xa8
mov dword [ebp - 0xc0], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040790c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
push pe_nt_image_headers32
lea eax, [ebx + 4]
mov byte [ebp - 4], 4
push 0
push eax
mov dword [ebx + 0x108], 0
mov dword [ebx + 0x10c], 0
mov dword [ebx], 0
call sub.VCRUNTIME140.dll_memset
push 0x38
lea eax, [ebp - 0xb8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x38
lea eax, [ebp - 0x80]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [str.169841]
mov dword [ebp - 0x80], eax
movzx eax, word [0x409378]
push 0x38
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movq xmm0, qword [0x409368]
add esp, 0x34
movzx eax, word [0x409370]
movq qword [ebp - 0x48], xmm0
mov word [ebp - 0x40], ax
xor edx, edx
nop word [eax + eax]
mov al, byte [ebp + edx - 0x48]
xor al, byte [ebp + edx - 0x80]
mov byte [ebp + edx - 0xb8], al
inc edx
cmp edx, 6
jl 0x403ab0
push 6
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebx + 0x110]
call fcn.00403250
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040794a
mov esp, ebp
pop ebp
ret
Function at 0x403fe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp byte [ebx], 2
je 0x40400d
lea eax, [ecx + 0x1168]
push str.The_entry_is_not_a_file.
push eax
call section..text
add esp, 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebx + 0x72]
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ebp + 8], edx
sub edx, eax
cmp edi, edx
jb 0x404055
jbe 0x40405a
mov eax, dword [esi + 8]
sub eax, dword [esi]
cmp edi, eax
jbe 0x40403f
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
push edi
call fcn.004036b0
mov ecx, dword [ebp - 4]
jmp 0x40405a
sub edi, edx
push edi
push 0
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp - 4]
add eax, edi
mov dword [esi + 4], eax
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x4040ae
push 0
push dword [ebx + 0x6e]
push dword [ebx + 0x6a]
push dword [ecx]
call fcn.00405350
mov edi, dword [ebp - 4]
push dword [edi]
push dword [ebx + 0x72]
push 1
push dword [esi]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x20
cmp eax, dword [ebx + 0x72]
je 0x4040ae
mov eax, dword [esi]
mov dword [esi + 4], eax
lea eax, [edi + 0x1168]
push str.Could_read_all_of_the_file_data.
push eax
call section..text
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4081d9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408218
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408218
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408218
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408218
cmp dword [ecx + 0x74], 0xe
jbe 0x408218
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407770
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x407015
lea edi, [esi - 0x6015]
push edi
or ebp, 0xffffffff
jmp 0x407792
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407799
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407788
mov eax, 1
add ebx, ebx
jne 0x4077ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4077a0
jne 0x4077bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4077a0
xor ecx, ecx
sub eax, 3
jb 0x4077d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407842
mov ebp, eax
add ebx, ebx
jne 0x4077db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4077e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40780c
inc ecx
add ebx, ebx
jne 0x4077f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4077ed
jne 0x407809
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4077ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40782c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40781d
jmp 0x40778e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40782c
add edi, ecx
jmp 0x40778e
pop esi
mov edi, esi
mov ecx, 1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40784a
cmp byte [edi], 0
jne 0x40784a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40784f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4078be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x72c0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7310]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40787c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7318]
or eax, eax
je 0x4078b8
mov dword [ebx], eax
add ebx, 4
jmp 0x407899
call dword [esi + 0x7314]
mov ebp, dword [esi + 0x731c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4078f2
sub esp, 0xffffff80
jmp section.UPX0