joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e984
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x43e9d8
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x4b8814]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x4b8c14]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x4b9014]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x4b9414]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x43e993
pop edi
pop esi
pop ebx
ret

Function at 0x462930
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x4629f0
xor ebx, ebx
lea esi, [ebp - 0x114]
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
call fcn.00405574
mov al, byte [edi + eax]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x46295a
xor edx, edx
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4629f0
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc edx
and dl, 0xff
mov esi, edx
and esi, 0xff
mov al, byte [ebp + esi - 0x114]
mov cl, byte [ebp - 0xd]
add cl, al
and cl, 0xff
mov byte [ebp - 0xd], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov cl, byte [ebp + ecx - 0x114]
mov byte [ebp + esi - 0x114], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov byte [ebp + ecx - 0x114], al
add al, byte [ebp + esi - 0x114]
and al, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x114]
mov eax, dword [ebp - 8]
mov byte [eax + ebx], cl
inc ebx
dec dword [ebp - 0x14]
jne 0x46298c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4629fc
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x462ab4
xor esi, esi
lea ecx, [ebp - 0x110]
mov eax, esi
cdq
idiv edi
mov al, byte [ebx + edx]
mov byte [ecx], al
inc esi
inc ecx
cmp esi, 0x100
jne 0x462a29
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x462ab4
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
inc edx
and dl, 0xff
xor eax, eax
mov al, dl
mov al, byte [ebp + eax - 0x110]
lea ecx, [eax + ecx]
and cl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [ebp + ebx - 0x110]
mov edi, edx
and edi, 0xff
mov byte [ebp + edi - 0x110], bl
xor ebx, ebx
mov bl, cl
mov byte [ebp + ebx - 0x110], al
xor ebx, ebx
mov bl, dl
add al, byte [ebp + ebx - 0x110]
and al, 0xff
mov ebx, dword [ebp - 4]
mov bl, byte [ebx + esi]
and eax, 0xff
xor bl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + esi], bl
inc esi
dec dword [ebp - 0x10]
jne 0x462a4f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4aabdc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x4dc1ec]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x438db5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a2dac
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004a3fd4
mov eax, dword [esi]
call fcn.004918ac
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x4aac4e
mov eax, dword [esi]
call fcn.004918ac
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.004918b8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x4aac72
mov eax, dword [esi]
call fcn.004918b8
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.004918a0
cmp eax, dword [ebp - 0x18]
jle 0x4aac88
mov eax, dword [esi]
call fcn.004918a0
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00491894
cmp eax, dword [ebp - 0xc]
jle 0x4aac9e
mov eax, dword [esi]
call fcn.00491894
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.004a9564
push eax
call fcn.0040799c
call fcn.00406e8c
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x4aad65
mov eax, ebx
call fcn.0040457c
cmp eax, 0x64
jge 0x4aad65
cmp dword [0x4c9158], 0
je 0x4aad65
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.004079ec
cmp dword [ebp - 8], 0
je 0x4aad65
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.004079ec
cmp dword [ebp - 8], 0
je 0x4aad28
mov bl, 2
jmp 0x4aad43
lea edx, [ebp - 0x20]
mov eax, dword [0x4e4834]
call fcn.004ade74
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x4aad41
xor ebx, ebx
jmp 0x4aad43
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4c9260]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.004a9564
push eax
call dword [0x4c9158]
mov eax, dword [0x4dbff4]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.004a6c98
push 4
mov eax, dword [ebp - 4]
call fcn.004a9564
push eax
call fcn.004079e4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438dbc
call fcn.00406e8c
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4cd378
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45b437
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4cd429
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4cd412
test esi, esi
jbe 0x4cd429
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a708
test eax, eax
jne 0x4cd404
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4cd429
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4cd3e1
jmp 0x4cd429
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4cd429
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b43e
ret
Function at 0x4cde58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x45c007
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004049cc
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4cde93
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4cdeac
lea eax, [ebp - 0x10]
mov edx, dword [0x4dbfdc]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404a2c
jmp 0x4cdebf
lea eax, [ebp - 0x10]
mov edx, dword [0x4dbfdc]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404a2c
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4cdecb
adc edx, 0
mov edx, dword [edx*4 + 0x4c9790]
call fcn.00404c2c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404c10
push eax
call fcn.00406bb4
mov esi, eax
cmp esi, 0xffffffff
je 0x4cdfd9
mov eax, 0x40
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4cdfcc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.0040705c
mov eax, edi
call fcn.00402744
mov eax, 0x18
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4cdfcc
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4cdfcc
cmp dx, 0x150
ja 0x4cdfcc
mov eax, edi
call fcn.00402744
mov eax, 0xe0
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4cdfcc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404a08
mov eax, edi
call fcn.00402744
push esi
call fcn.00406b6c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404d38
jne 0x4cdff1
inc ebx
cmp ebx, 0x19
jne 0x4cde85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c00e
lea eax, [ebp - 0x10]
call fcn.004049cc
ret
Function at 0x51feb8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4e5580
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x51feda
shr eax, 1
xor eax, 0xedb88320
jmp 0x51fedc
shr eax, 1
dec edx
jne 0x51fec8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x51fec1
mov byte [0x4e5980], 1
pop esi
pop ebx
ret

Function at 0x51fef8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4e5980], 0
jne 0x51ff0f
call fcn.0051feb8
mov eax, edi
dec eax
test eax, eax
jl 0x51ff38
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e5580]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x51ff19
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x40b9b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40b9c8
pop dword [ebp - 0x18]
mov eax, 0xc29c5f8
sub eax, 0xbe90c30
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x65c3e706
add dword [ebp - 0x28], 0xe88e5e45
mov dword [ebp - 0x24], 0x8bfc2f14
add dword [ebp - 0x24], 0xa6371d31
mov dword [ebp - 0x20], 0xe15d318e
add dword [ebp - 0x20], 0x6aef12a0
mov dword [ebp - 0x1c], 0x9366dc90
sub dword [ebp - 0x1c], 0x9366dc90
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x872cf339
add dword [ebp - 0x28], 0xed45761d
mov dword [ebp - 0x24], 0xb5c42146
add dword [ebp - 0x24], 0x8ba8402f
mov dword [ebp - 0x20], 0x853db14d
sub dword [ebp - 0x20], 0x21ce44e1
mov dword [ebp - 0x1c], 0x91f2b1d
sub dword [ebp - 0x1c], 0x91f2b1d
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x2f34169
sub eax, 0x2b27139
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3e7c9
push 0
call eax
mov ecx, 0x5e6c
xor ebx, ebx
add ebx, eax
mov esi, 0x421000
add esi, dword [ebp - 0x18]
mov edi, 0xb6cdd865
mov edx, dword [esi]
xor dword [ebp - 8], 0x1779b523
xor edx, edi
xor dword [ebp - 4], 0x7ff85033
mov dword [ebx], edx
mov dword [ebp - 8], 0x3b5a24f7
add ebx, 0x49bd075
sub ebx, 0x49bd071
add esi, 0x5d63630d
add esi, 0xa29c9cf7
loop 0x40bad5
add eax, 0x7750ed0a
add eax, 0x88b07f79
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xaf5d3734
sub ecx, 0xaf1d3734
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.298507a7
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.298507a7
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.298507a7
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.298507a7
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.298507a7
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.298507a7
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.298507a7
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x298507a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x298507b6
pop dword [ebp - 0x34]
mov eax, 0x618c42a6
add eax, 0xc7f8c510
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xc0b1bbf5
sub dword [ebp - 0x44], 0x725f76aa
mov dword [ebp - 0x40], 0xe1cc61ff
add dword [ebp - 0x40], 0x5066ea46
mov dword [ebp - 0x3c], 0x5376dfb0
add dword [ebp - 0x3c], 0xf8d5647e
mov dword [ebp - 0x38], 0x2465633c
add dword [ebp - 0x38], 0xdb9a9cc4
lea eax, [ebp - 0x44]
push eax
mov eax, 0x34d6084c
sub eax, 0xb50978c
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x680551fb
sub dword [ebp - 0x44], 0xf392e8a5
mov dword [ebp - 0x40], 0x477fc50d
add dword [ebp - 0x40], 0xf9ec9c68
mov dword [ebp - 0x3c], 0xc0e712fe
sub dword [ebp - 0x3c], 0x5d77a692
mov dword [ebp - 0x38], 0xf2c55955
add dword [ebp - 0x38], 0xd3aa6ab
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x6ca4d352
add eax, 0xbce09d66
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x458fe
push 0
call eax
mov ecx, 0x68949fc
add ecx, 0xf976f447
mov esi, eax
mov edx, 0x34202f6c
add edx, 0xf5693494
add edx, dword [ebp - 0x34]
mov ebx, 0x5d65d569
add ebx, 0xd837442f
add dword [ebp - 0x30], eax
mov edi, dword [edx]
xor dword [ebp - 0x1c], 0xbaa523d3
sub edi, ebx
add dword [ebp - 0x14], 0x5ccaade2
mov dword [esi], edi
add esi, 0x1a6c1ed0
sub esi, 0x1a6c1ecc
add edx, 0x8f09b161
add edx, 0x70f64ea3
loop 0x298508d8
add eax, 0x217070fb
add eax, 0xde907ae4
xor ebx, ebx
add ebx, eax
add eax, 0x68eb46be
sub eax, 0x68eb46b9
mov ecx, 0x607cc5d4
sub ecx, 0x36fcc5d4
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10005a48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10005a57
pop dword [ebp - 0x20]
mov eax, 0x10005a57
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x8f455c8c
add dword [ebp - 0x30], 0xbf0ce8bf
mov dword [ebp - 0x2c], 0xee35adb2
add dword [ebp - 0x2c], 0x43fd9e93
mov dword [ebp - 0x28], 0xe0cd0b42
add dword [ebp - 0x28], 0x6b7f38ec
mov dword [ebp - 0x24], 0xc932e473
add dword [ebp - 0x24], 0x36cd1b8d
lea eax, [ebp - 0x30]
push eax
mov eax, 0x9ec890a2
add eax, 0x71382f82
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x4acff50a
add dword [ebp - 0x30], 0x29a2744c
mov dword [ebp - 0x2c], 0x5c80890c
add dword [ebp - 0x2c], 0xe4ebd869
mov dword [ebp - 0x28], 0x67b55bd1
sub dword [ebp - 0x28], 0x445ef65
mov dword [ebp - 0x24], 0x48417487
sub dword [ebp - 0x24], 0x48417487
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xd176c4b5
sub eax, 0xc1760489
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3906e
push 0
call eax
mov ecx, 0x7cc06999
add ecx, 0x833fe2a3
mov esi, eax
mov edx, 0x938ae67d
add edx, 0x7c798d83
add edx, dword [ebp - 0x20]
mov ebx, 0xd5263b7a
add dword [ebp - 0x14], ecx
mov edi, dword [edx]
sub dword [ebp - 0x14], 0xb8ca8105
sub edi, ebx
xor dword [ebp - 4], edx
mov dword [esi], edi
mov dword [ebp - 0x18], 0x45f20f14
add esi, 0x8e52e86a
sub esi, 0x8e52e866
add edx, 0x4c679720
sub edx, 0x4c67971c
loop 0x10005b6e
add eax, 0x5229c0fb
add eax, 0xadd762c8
mov ebx, eax
add eax, 0xa3acd64
add eax, 0xf5c532a1
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret