joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10145468
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1019aca4], 0
mov dword [0x1019aca8], 0
mov dword [0x1019acb4], 0
mov ebx, dword [0x1019ac9c]
add ebx, 0xffffec41
mov dword [0x1019aca0], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x101455bc
jmp 0x101454ec
mov eax, dword [0x1019aca4]
mov ecx, dword [0x1019aca8]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, eax
add edi, 1
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1019aca4], edx
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1019aca8], edx
mov dword [0x1019aca0], 0x63e
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1019acac], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1019acac]
mov edx, dword [0x1019aca8]
mov byte [ebx + edx], cl
mov edx, dword [0x1019aca4]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1019aca8]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1019acb4], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x1019aca0], 0xff5
mov dword [0x1019ac9c], 0xc9e
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x2c], edi
jne 0x101454d5
mov dword [0x1019aca0], 0x22fd
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101455ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x1019ac9c]
mov esi, edx
add esi, 0xffffddef
mov dword [0x1019aca0], esi
add edx, 0xfffff1ae
mov dword [0x1019ac9c], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.10144dd2
lea ecx, [0x101442e4]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x40], edx
mov dword [esp + 0x2c], 0x14ae00
mov edx, dword [0x1019ac88]
mov dword [esp + 0x6c], edx
mov edx, dword [0x1019ac8c]
mov dword [esp + 0x7c], edx
mov dword [0x1019ac9c], 0x1a6c
mov edx, dword [0x1019ac90]
mov dword [esp + 0x28], edx
mov edx, dword [0x1019ac94]
mov dword [esp + 0x38], edx
mov edx, dword [0x1019ac98]
mov dword [esp + 0x74], edx
mov edx, dword [0x1019aca0]
add edx, 0xc86
mov dword [0x1019aca0], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x101456f6
mov eax, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov dword [0x1019aca0], 0x8e8
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x60], edx
mov dword [0x1019ac9c], 0x1277
call fcn.10144b89
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x10145731
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10144711
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1019aca0], 0xd4a
mov dword [esp + 8], eax
jmp 0x10145731
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1014571d
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10145683
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x101456f6
mov eax, dword [esp + 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x403e8a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x7000
push esi
push 0
push dword [0x41b584]
call fcn.004013f8
mov eax, dword [0x41b716]
add esp, 0xc
test eax, eax
jg 0x403eb5
and dword [0x41cb4c], 0
xor eax, eax
pop esi
ret
cmp eax, esi
ja 0x403ebb
mov esi, eax
push esi
push dword [0x41b584]
push dword [0x41a004]
call fcn.0040a1a3
add esp, 0xc
cmp dword [0x41cb78], 0
mov dword [0x41cb4c], eax
je 0x403f27
cmp eax, 0xffffffff
je 0x403f27
cmp eax, esi
je 0x403f33
test eax, eax
jl 0x403f27
mov ecx, dword [0x41a00c]
mov edx, dword [0x41cb7c]
inc ecx
call fcn.00402a1e
mov eax, dword [0x41cb4c]
test eax, eax
jne 0x403f20
push esi
push dword [0x41b584]
push dword [0x41a004]
call fcn.0040a1a3
add esp, 0xc
mov dword [0x41cb4c], eax
cmp eax, 0xffffffff
je 0x403f27
mov esi, eax
cmp eax, esi
je 0x403f33
push 2
pop ecx
jmp fcn.00403734
mov esi, dword [0x41b584]
mov ecx, dword [0x41a040]
mov dword [0x41cb48], esi
test byte [ecx + 0x28], 1
je 0x403f85
mov byte [0x41cb47], 1
test word [ecx + 0x28], 0x1300
jne 0x403f91
push edi
mov edi, eax
test edi, edi
je 0x403f7d
dec edi
call fcn.00409def
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00409e09
inc esi
test edi, edi
pop ecx
jne 0x403f61
mov eax, dword [0x41cb4c]
mov byte [0x41cb47], 0
pop edi
mov ecx, eax
dec eax
mov dword [0x41cb4c], eax
mov eax, ecx
pop esi
ret
push 0x100c
push dword [0x41a01c]
call fcn.004022e7
int3

Function at 0x405723
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
mov esi, dword [ebp + 0xb4]
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x405754
mov eax, dword [edi]
jmp 0x405756
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push eax
call ebx
test eax, eax
je 0x4057d4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x80], eax
push dword [ebp - 0x80]
lea eax, [ebp + 0x88]
push 0x4163b4
push eax
call fcn.004021b9
add esp, 0xc
cmp dword [esi + 0x18], 0x10
jb 0x40578d
mov eax, dword [edi]
jmp 0x40578f
mov eax, edi
lea ecx, [ebp + 0x88]
push ecx
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x7c]
push eax
call ebx
test eax, eax
je 0x4057ba
inc dword [ebp - 0x80]
jmp 0x40576c
push 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x7c]
push eax
mov ecx, esi
call fcn.00405353
xor eax, eax
inc eax
mov ecx, dword [ebp + 0xa8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aba0
add ebp, 0xac
leave
ret
Function at 0x4057ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x103
jb 0x405820
xor eax, eax
jmp 0x405861
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x208
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
mov ecx, esi
lea eax, [ebp - 0x310]
jne 0x405858
lea eax, [ebp - 0x108]
push eax
call fcn.00405353
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040aba0
leave
ret
Function at 0x409e09
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x426c68]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x41b728]
mov ecx, dword [0x426c70]
mov dword [0x426c68], eax
movzx eax, al
add eax, dword [0x426c6c]
imul eax, eax, 0x8088405
inc eax
mov dword [0x426c6c], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x41b728]
mov eax, dword [esp + 4]
mov dword [0x426c70], ecx
ret

Function at 0x409e99
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x41cb74]
mov esi, ecx
call fcn.00409e61
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004013a8
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.00409def
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.00409e09
inc esi
cmp esi, 0xc
pop ecx
jl 0x409ec8
cmp dword [0x41cb70], 0
movzx ax, byte [ebp - 5]
movzx eax, ax
pop esi
je 0x409f07
movzx cx, byte [0x41b70f]
cmp ax, cx
je 0x409f11
or eax, 0xffffffff
jmp 0x409f13
movzx cx, byte [0x41b715]
jmp 0x409efd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aba0
leave
ret

Function at 0x40aba0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a4c0]
jne 0x40abaa
repz ret
jmp fcn.0040c9dd

Function at 0x4123ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00412038
push eax
push esi
push dword [ebp + 8]
call fcn.00411fed
mov dword [ebp - 0xbc], eax
test dword [edi + edi*8 - 1], eax
dec dword [ebp + 0x5d88d445]
aam 0x50
Function at 0x41243f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], eax
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00412038
push eax
push esi
push dword [ebp + 8]
call fcn.00411fed
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00412028
je 0x4124f1
sub al, 0x34
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00412028
mov edi, 0x8d492ac9
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
mov edi, dword [eax - 0x3a]
inc ebp
invalid
Function at 0x412784
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4126ff
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41271d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41277b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x412762
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41276b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x412775
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x412757
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4126e1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4127c8
dec eax
je 0x4127bf
sub eax, 3
je 0x4127b6
mov dword [ebp - 4], 0x40
jmp 0x4127e5
mov dword [ebp - 4], 4
jmp 0x4127cb
mov dword [ebp - 4], 0x20
jmp 0x4127cb
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x412817
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x412797
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00412028
iretd
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412902
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00412038
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00411fed
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00412038
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00411fed
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00412028
cmpsd dword [esi], dword es:[edi]
fisubr word [ecx - 0x335a7fec]
cli
invalid
Function at 0x4141d6
Capabilities:
Access peb ldr_data

Disassembly:
inc esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x4141ec
invalid
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00412028
mov ah, 0x20
sub dword [bp + di - 0x7408], ecx
inc edi
cmp al, 0x8b
push esp
pop es
js 0x414206
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.00412028
mov eax, 0x49939983
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x414215
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x414215
call fcn.00412028
push edx
and eax, 0x5a8b1784
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00412028
jmp 0x414278
and dword [eax], 0
call fcn.0040c929
mov dword [eax], 9
or eax, 0xffffffff
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040cac0
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040cac0
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040cac0
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040cac0
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040cac0
mov dword [0x41203c], eax
call fcn.0040cac0
test eax, eax
jge 0x402550
push 8
call fcn.0040cac0
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040cac0
pop ecx
push 1
call fcn.0040cac0
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040cac0
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040cac0
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040cac0
jmp 0x402495

Function at 0x40cac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40cacf
pop dword [ebp - 0x3c]
mov eax, 0x280802dc
add eax, 0xd838c7f3
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3635a
push 0
mov eax, 0xe1f3b8ce
add eax, 0x1e4d280a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xe5af05d9
sub ecx, 0xe5aec9f2
mov edi, eax
mov ebx, 0xd301d5a5
sub ebx, 0xd2c099e1
add ebx, dword [ebp - 0x3c]
mov edx, 0xd8eb6dc5
sub dword [ebp - 0x18], eax
mov esi, dword [ebx]
add dword [ebp - 0x24], edx
add esi, edx
sub dword [ebp - 0x14], ebx
mov dword [edi], esi
xor dword [ebp - 0x1c], eax
add edi, 4
add ebx, 0xf6d335ea
add ebx, 0x92cca1a
loop 0x40cb28
add eax, 0x59f18b06
add eax, 0xa60f5769
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x409c30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54de3c
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5aa464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea edi, [esi + 8]
mov dword [esi], vtable.CCurlDownloader.0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x409c8d
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
lea edi, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x409cac
mov eax, dword [edi]
jmp 0x409cae
mov eax, edi
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x409ccf
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409cc0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00406720
lea ebx, [esi + 0x48]
mov byte [ebp - 4], 3
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 8
jb 0x409cf7
mov eax, dword [ebx]
jmp 0x409cf9
mov eax, ebx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x409d20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409d10
sub ecx, dword [ebp + 8]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.00406720
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x409d35
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x409d3d
mov ebx, dword [ebx]
push dword [ebp - 0x10]
push ecx
push edi
push ebx
lea ecx, [esi + 0x60]
call fcn.0041bd30
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2c]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x60]
push 1
push eax
mov dword [ebx + 0xf0], 0
mov byte [ebx + 0xf4], 0
call fcn.0041bff0
cmp dword [eax + 0x14], 8
jb 0x409d79
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x409d95
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406e80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409dd0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54de6f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5aa464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x409e4b
cmp dword [esi + 4], 0
je 0x409e2f
mov eax, dword [esi + 4]
test eax, eax
je 0x409e2f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x409e4b
mov ecx, esi
call fcn.0044eb70
push 0x50
push esi
call fcn.00509bb8
add esp, 8
push 0x50
call fcn.00509bc6
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 0
call fcn.004b4d60
sub esp, 0x18
mov ecx, 0x409ed0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x409e8d
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____cdecl___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x409ed0
mov dword [eax + 0x24], eax
push str.ABDEF
push edi
mov ecx, esi
call fcn.0044e920
mov dword [edi + 0xf0], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x409eae
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54df7a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5aa464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.004f527a
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x40a640
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004b437e
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x5a70e4
push eax
call fcn.004b5290
push edi
push esi
call fcn.004f55f0
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509b84
mov esp, ebp
pop ebp
ret 4