joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5909a7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x68edec]
jne 0x5909b1
repz ret
jmp fcn.0059a281

Function at 0x590bce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x590bff
call fcn.00597ad2
mov dword [eax], esi
call fcn.00597abf
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00591b80
add esp, 0x14
push 0x16
pop eax
jmp 0x590c54
test dword [ebp + 0xc], 0xfffffff9
jne 0x590bdb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x590c2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00597ae5
pop ecx
call fcn.00597abf
mov eax, dword [eax]
jmp 0x590c54
test al, 0x10
jne 0x590c52
test al, 1
je 0x590c52
test byte [ebp + 0xc], 2
je 0x590c52
call fcn.00597ad2
mov dword [eax], 5
call fcn.00597abf
mov dword [eax], 0xd
jmp 0x590c23
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5a51b4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0059a3f9
and dword [ebp - 4], 0
cmp dword [0x73a2c8], 0
mov ebx, eax
jne 0x5a5265
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5a5316
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6565a0
push edi
call esi
test eax, eax
je 0x5a5316
push eax
call fcn.0059a387
mov dword [esp], 0x656590
push edi
mov dword [0x73a2c8], eax
call esi
push eax
call fcn.0059a387
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x73a2cc], eax
call esi
push eax
call fcn.0059a387
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x73a2d0], eax
call esi
push eax
call fcn.0059a387
pop ecx
mov dword [0x73a2d8], eax
test eax, eax
je 0x5a5265
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0059a387
pop ecx
mov dword [0x73a2d4], eax
mov eax, dword [0x73a2d4]
cmp eax, ebx
je 0x5a52bd
cmp dword [0x73a2d8], ebx
je 0x5a52bd
push eax
call fcn.0059a402
push dword [0x73a2d8]
mov esi, eax
call fcn.0059a402
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5a52bd
test edi, edi
je 0x5a52bd
call esi
test eax, eax
je 0x5a52b4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5a52b4
test byte [ebp - 0xc], 1
jne 0x5a52bd
or dword [ebp + 0x10], 0x200000
jmp 0x5a52f6
mov eax, dword [0x73a2cc]
cmp eax, ebx
je 0x5a52f6
push eax
call fcn.0059a402
pop ecx
test eax, eax
je 0x5a52f6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5a52f6
mov eax, dword [0x73a2d0]
cmp eax, ebx
je 0x5a52f6
push eax
call fcn.0059a402
pop ecx
test eax, eax
je 0x5a52f6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x73a2c8]
call fcn.0059a402
pop ecx
test eax, eax
je 0x5a5316
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5a5318
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5af150
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x5af1cb
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.005adf32
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x5af187
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x5af19e
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.005adf32
add esp, 4
test eax, eax
jbe 0x5af1cb
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.005adf32
add esp, 4
cmp esi, eax
jb 0x5af1b0
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x46df00
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [eax]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 4]
lea esi, [edi + 0x7e]
mov dword [esp + 0x18], eax
mov edi, 5
mov dword [esp + 0x10], 3
mov ecx, ebx
mov eax, edx
shr ebx, 0x10
shr edx, 0x10
mov word [esp], ax
movzx eax, word [esp]
rol dx, 0xb
sub esi, 8
rol word [esp], 0xd
mov ebp, eax
not ebp
and ebp, ecx
sub edx, ebp
mov ebp, eax
movzx eax, word [esi + 6]
and ebp, ebx
sub edx, ebp
mov ebp, ebx
sub dx, word [esi + 8]
not ebp
and ebp, edx
sub word [esp], bp
mov ebp, ebx
and ebp, ecx
sub word [esp], bp
mov ebp, ecx
sub word [esp], ax
not ebp
movzx eax, word [esp]
rol bx, 0xe
and ebp, eax
sub ebx, ebp
mov ebp, edx
and ebp, ecx
sub ebx, ebp
mov ebp, edx
sub bx, word [esi + 4]
not ebp
rol cx, 0xf
and ebp, ebx
sub ecx, ebp
mov ebp, eax
and ebp, edx
sub ecx, ebp
sub cx, word [esi + 2]
sub edi, 1
jne 0x46df34
sub dword [esp + 0x10], 1
je 0x46dff0
xor eax, eax
mov ebp, dword [esp]
cmp dword [esp + 0x10], 2
sete al
and ebp, 0x3f
mov edi, eax
mov eax, dword [esp + 0x14]
add edi, 5
sub dx, word [eax + ebp*2]
mov ebp, ebx
and ebp, 0x3f
movzx ebp, word [eax + ebp*2]
sub word [esp], bp
mov ebp, ecx
and ebp, 0x3f
sub bx, word [eax + ebp*2]
mov ebp, edx
and ebp, 0x3f
sub cx, word [eax + ebp*2]
jmp 0x46df34
movzx eax, word [esp]
shl ebx, 0x10
movzx ecx, cx
mov edi, dword [esp + 0x18]
shl edx, 0x10
or ebx, ecx
or edx, eax
mov dword [edi], ebx
mov dword [edi + 4], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x482160
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x4821b8
test esi, esi
je 0x4821b8
mov edx, eax
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x54]
jmp 0x482195
test esi, esi
je 0x4821b0
movzx eax, byte [edi + edx]
add ecx, 1
add edx, 1
xor al, byte [ecx - 1]
add ebp, 1
sub esi, 1
and edx, 0xf
mov byte [ebp - 1], al
jne 0x482191
mov dword [esp + 0x1c], edx
mov dword [esp + 0x40], ecx
mov eax, dword [ebx + 0xc]
cmp esi, 0xf
bswap eax
jbe 0x482224
mov edi, esi
shr edi, 4
mov edx, edi
add edx, eax
jae 0x482240
neg eax
mov edi, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [esp + 0x5c]
mov edx, 1
mov eax, 0xc
mov dword [ebx + 0xc], 0
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x482201
shl edi, 4
sub esi, edi
add ebp, edi
add dword [esp + 0x40], edi
cmp esi, 0xf
ja 0x4821c2
test esi, esi
jne 0x482286
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov dword [eax], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], edx
mov dword [esp + 8], edi
shl edi, 4
mov dword [esp + 4], ebp
sub esi, edi
add ebp, edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp], eax
call dword [esp + 0x5c]
mov edx, dword [esp + 0x18]
add dword [esp + 0x40], edi
cmp esi, 0xf
mov eax, edx
bswap eax
mov dword [ebx + 0xc], eax
mov eax, edx
ja 0x4821c2
jmp 0x482224
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x54]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [esp + 0x5c]
mov eax, dword [esp + 0x18]
add eax, 1
mov edx, eax
test eax, eax
bswap edx
mov dword [ebx + 0xc], edx
jne 0x4822f8
mov edx, 1
mov al, 0xc
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x4822e5
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ebx, dword [esp + 0x54]
mov edx, dword [esp + 0x40]
lea ecx, [ebp + edi]
add ebx, edi
add edi, edx
nop
movzx edx, byte [ebx + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, esi
jne 0x482310
add dword [esp + 0x1c], eax
jmp 0x482228
Function at 0x408898
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088e3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088be
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b7
jmp 0x4088a9
cmp edx, ebx
je 0x4088fc
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42b7a0]
jmp 0x4088e3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, reloc.kernel32.dll_GetFileSize
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x462004]
jne 0x40100a
repz ret
jmp fcn.004014da

Function at 0x4042fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x462004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00401ca2
and dword [ebp - 0x14], 0
cmp dword [0x4648c8], 0
mov dword [ebp - 0x18], eax
jne 0x4043ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404456
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404456
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4648c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4648cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4648d0], eax
call edi
push eax
call esi
mov dword [0x4648d8], eax
test eax, eax
je 0x4043ae
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4648d4], eax
mov eax, dword [0x4648d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404407
cmp dword [0x4648d8], ecx
je 0x404407
push eax
call esi
push dword [0x4648d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404407
test ebx, ebx
je 0x404407
call edi
test eax, eax
je 0x4043fe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4043fe
test byte [ebp - 8], 1
jne 0x404407
or dword [ebp + 0x10], 0x200000
jmp 0x40443a
mov eax, dword [0x4648cc]
cmp eax, dword [ebp - 0x18]
je 0x40443a
push eax
call esi
test eax, eax
je 0x40443a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40443a
mov eax, dword [0x4648d0]
cmp eax, dword [ebp - 0x18]
je 0x40443a
push eax
call esi
test eax, eax
je 0x40443a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4648c8]
call esi
test eax, eax
je 0x404456
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404458
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x405690
Capabilities:
Allocate or change rwx memory
Create pipe
Execute shellcode via indirect call
Get common file path
Get file attributes
Get geographical location
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x462004]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ebx, ebx
xor esi, esi
cmp esi, 0x562d05
jne 0x4056c9
mov eax, dword [0x463934]
mov dword [0x4a0694], eax
cmp dword [0x4a030c], 0x3c
jne 0x4056d5
push ebx
call edi
inc esi
cmp esi, 0x5f6c74
jl 0x4056b7
cmp dword [0x4a030c], 0x7c
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jne 0x40575b
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [0x4a030c], 0x110a
jne 0x4057c2
push ebx
mov dword [0x4a0300], ebx
mov dword [0x4a0304], ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str.migicaranafojoyota_feganowofu_vuj_lelalezecebesijorabifovihapida
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
push ebx
push ebx
call fcn.0040100f
push ebx
push ebx
call fcn.0040100f
push ebx
push ebx
call fcn.0040100f
add esp, 0x18
push ebx
call fcn.004012d2
call fcn.00405440
xor ecx, ecx
cmp dword [0x4a030c], ebx
jbe 0x4057fc
mov eax, dword [0x4a0694]
mov dword [esp + 0x10], eax
mov eax, 0xa231
add dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov al, byte [edx + ecx]
mov edx, dword [0x4a0030]
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [0x4a030c]
jb 0x4057d1
push str.msimg32.dll
call esi
mov ecx, dword [0x4a030c]
mov edx, dword [0x4a0030]
lea eax, [esp + 0x14]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00405610
call fcn.00405460
mov edi, dword [sym.imp.USER32.dll_GetMonitorInfoA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetAtomNameA]
xor esi, esi
lea eax, [esp + 0x28]
push eax
push 0
call edi
push 0
push 0
push 0
call ebx
cmp esi, 0x1a01e
jle 0x405859
cmp dword [esp + 0x30], 0xf5bed7
jne 0x405862
inc esi
cmp esi, 0x1ece7a52
jl 0x405836
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
cmp esi, 0x12e6c3
jne 0x40587d
call fcn.00405430
cmp dword [0x4a030c], 0x3dc
mov dword [0x4a0034], 0x8e46a6f0
jne 0x4058b7
xor ecx, ecx
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x24], ecx
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push str.rixovohucivununiboneb_huzurucurajo_jajonaberewevale_sivakawizematec
call ebx
inc esi
cmp esi, 0x1519a5
jl 0x405870
mov ecx, dword [esp + 0x454]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x8a0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008a01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8a007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a006a
add dl, dl
jne 0x8a0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a00dc
xor eax, eax
add dl, dl
jne 0x8a0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a017d
add dl, dl
jne 0x8a00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8a00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8a0075
mov eax, 1
add dl, dl
jne 0x8a00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a00e1
sub eax, ebx
mov ebx, 1
jne 0x8a0128
mov ecx, 1
add dl, dl
jne 0x8a010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8a0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8a013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8a014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a0136
cmp eax, 0x7d00
jae 0x8a016d
cmp eax, 0x500
jb 0x8a0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a0075
cmp eax, 0x7f
ja 0x8a0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8a019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8a0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10515e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10515ea
pushal
call 0x10515f0
pop ebp
sub ebp, 0x10
sub ebp, 0xc515e0
jmp 0x1051606
mov eax, 0xc515e0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e1
mov edx, 0x98776fc3
xor byte [eax], dl
inc eax
dec ecx
jne 0x105161d
jmp 0x1051630
dec eax
push cs
dec eax
dec edx
inc ebx
ret
Function at 0x413e70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44527d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x457080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.004136a0
mov edi, eax
test edi, edi
je 0x413ef2
cmp edi, 0x459468
je 0x413ed0
mov esi, dword [edi]
mov eax, 0x66666667
mov ecx, dword [edi + 4]
sub ecx, esi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.00418150
mov eax, dword [edi + 0x10]
mov ecx, edi
mov dword [0x457b14], eax
mov eax, dword [edi + 0xc]
mov dword [0x457b10], eax
call fcn.004029d0
push 0x14
push edi
call fcn.004237b1
add esp, 8
push 4
call fcn.0042377c
mov dword [ebp - 0x18], eax
mov dword [eax], 0x413250
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x41bb10
push 0
push 0
call fcn.0042e42d
add esp, 0x1c
mov dword [ebp - 0x34], eax
test eax, eax
je 0x413fd5
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x413fce
push ecx
push eax
call fcn.00422f40
add esp, 8
test eax, eax
jne 0x413fce
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 2
push eax
call fcn.00402880
mov byte [ebp - 4], 3
mov eax, 0x66666667
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub ecx, esi
imul ecx
mov byte [0x459408], 1
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.00418150
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
mov dword [0x457b14], eax
mov eax, dword [ebp - 0x20]
mov dword [0x457b10], eax
call fcn.00413b10
lea ecx, [ebp - 0x2c]
call fcn.004029d0
mov eax, dword [0x457b14]
lea ecx, [ebp - 0x34]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
call fcn.00417c30
jmp 0x413f50
push 1
call fcn.00422601
push 6
mov dword [ebp - 0x30], 0
call fcn.00422601
int3
Function at 0x4144e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x414512
jl 0x414505
test ecx, ecx
jne 0x414512
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4145d2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00416ad0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x41457e
jg 0x41453d
test esi, esi
je 0x41457e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x414555
mov eax, dword [esp + 0x10]
jl 0x41454f
cmp eax, esi
jae 0x414555
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00424b80
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x41459f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x4145bb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x414524
jl 0x4145bb
test ecx, ecx
jne 0x414524
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x414610
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x414610
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.00424b80
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x414679
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x414636
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x414664
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0042f0fb
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x414679
cmp edi, eax
ja 0x414642
test edi, edi
je 0x414679
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0042f0fb
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4170f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445460
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x457080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
lea eax, [ecx + 4]
mov dword [ebp - 0x14], ecx
lea ebx, [ecx + 0x24]
mov dword [ecx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
lea edi, [ecx + 0x28]
mov dword [ebp - 0x14], eax
push 8
mov dword [eax], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
call fcn.0042377c
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004227d0
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [eax + 0x34], esi
call fcn.004172a0
mov eax, dword [ebp - 0x10]
lea edx, [eax + 8]
lea ecx, [eax + 0x14]
lea esi, [eax + 4]
mov dword [eax + 0x10], edx
mov dword [eax + 0xc], esi
mov esi, eax
mov dword [eax + 0x1c], ecx
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [0x459484]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x459480]
mov dword [ebx], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret