joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f35
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x100a148]
mov eax, dword [0x1008004]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], edi
jae 0x100611b
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x100a160]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x424], ebx
je 0x100611b
and dword [ebp - 0x414], 0
and dword [ebp - 0x420], 0
cmp dword [ebp + 0x10], 0
jne 0x1005fa6
xor eax, eax
jmp 0x100612f
test al, 0x20
je 0x1005fb9
push 2
push 0
push 0
push ecx
call fcn.01007180
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1006079
and dword [ebp - 0x40c], 0
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x410], edi
jbe 0x10060f5
mov ecx, dword [ebp - 0x410]
xor edi, edi
sub ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x1006028
mov edx, dword [ebp - 0x410]
inc dword [ebp - 0x410]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1006016
inc dword [ebp - 0x420]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x424]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x1005ff2
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10060a7
mov eax, dword [ebp - 0x418]
add dword [ebp - 0x414], eax
cmp eax, edi
jl 0x10060b3
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp + 0x10]
jb 0x1005fde
jmp 0x10060b3
push 0
lea ecx, [ebp - 0x418]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10060a7
mov eax, dword [ebp - 0x418]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x414], eax
jmp 0x10060b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x1006113
cmp dword [ebp - 0x40c], eax
je 0x10060ef
push 5
pop eax
cmp dword [ebp - 0x40c], eax
jne 0x10060e1
mov dword [0x10089b0], 9
mov dword [0x10089b4], eax
jmp 0x100612c
push dword [ebp - 0x40c]
call fcn.01005cd4
pop ecx
jmp 0x100612c
mov edi, dword [ebp - 0x41c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1006107
cmp byte [edi], 0x1a
je 0x1005f9f
mov dword [0x10089b0], 0x1c
jmp 0x1006125
sub eax, dword [ebp - 0x420]
jmp 0x100612f
mov dword [0x10089b0], 9
and dword [0x10089b4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002272
leave
ret
Function at 0x100701b
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 4
pop eax
call fcn.01007130
mov dword [ebp - 8], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1007117
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x4c]
xor esi, esi
cmp dword [0x10089bc], 2
jne 0x100709c
push 0x1001cd4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
je 0x100709c
push 0x1001cbc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x100709c
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], esi
call eax
cmp eax, 1
pop ecx
jne 0x100709c
cmp dword [ebp - 4], esi
jbe 0x100709c
mov esi, dword [ebp - 4]
mov edx, dword [0x10089bc]
mov ebx, edx
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 0x103
lea ecx, [edi - 1]
lea eax, [esi + edi - 1]
not ecx
inc ebx
and eax, ecx
mov dword [ebp - 4], eax
je 0x10070c5
add eax, edi
mov dword [ebp - 4], eax
lea ecx, [edi + edi]
cmp eax, ecx
jae 0x10070d1
mov dword [ebp - 4], ecx
mov eax, ecx
lea esi, [edi - 1]
not esi
and esi, dword [ebp - 8]
sub esi, eax
cmp edx, 1
jne 0x10070e3
push 0x11
pop edi
mov ecx, dword [ebp - 0xc]
add edi, ecx
cmp esi, edi
jb 0x1007117
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1007117
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1007117
xor eax, eax
inc eax
jmp 0x1007119
xor eax, eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007293
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x100a148]
jae 0x10073ee
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x100a160]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x10073ee
push 1
push esi
push ebx
call fcn.010063ba
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x10073f8
push 2
push esi
push ebx
call fcn.010063ba
add esp, 0xc
cmp eax, 0xffffffff
je 0x10073f8
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x100739b
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp + 8], eax
jne 0x1007331
mov dword [0x10089b0], 0xc
or esi, 0xffffffff
jmp 0x10073db
push 0x8000
push ebx
call fcn.010076b0
pop ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, 0x1000
cmp edi, eax
jge 0x100734c
mov eax, edi
push eax
push dword [ebp + 8]
push ebx
call fcn.01005f35
add esp, 0xc
cmp eax, 0xffffffff
je 0x1007366
sub edi, eax
test edi, edi
jg 0x1007341
jmp 0x100737c
cmp dword [0x10089b4], 5
jne 0x1007379
mov dword [0x10089b0], 0xd
or esi, 0xffffffff
push dword [ebp - 4]
push ebx
call fcn.010076b0
pop ecx
pop ecx
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10073db
jge 0x10073db
push 0
push dword [ebp + 0xc]
push ebx
call fcn.010063ba
push ebx
call fcn.01005eee
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x10073db
mov dword [0x10089b0], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x10089b4], eax
push 0
push dword [ebp - 8]
push ebx
call fcn.010063ba
add esp, 0xc
mov eax, esi
pop edi
jmp 0x10073fb
mov dword [0x10089b0], 9
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x7aa683
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x7aa6a9
push 0xf079c098
jmp 0x7aa6ac
pushfd
jmp 0x7aa68d
not bl
xchg ecx, esi
mov eax, edx
mov al, byte [esp]
jmp 0x7aa6e3
lea esi, [esp]
mov ebp, esp
setb ch
mov eax, 0x6c1ab146
jmp 0x7aa6f5
mov edi, dword [esp + 0x2c]
xchg bx, dx
mov si, 0x2b43
cpuid
lea esi, [esi + edi]
jmp 0x7aa6cd
sub esp, 0xc0
mov ebp, esp
inc ecx
jle 0x7aab78
ror ax, cl
rdtsc
setbe dh
jmp fcn.007aa96c
ror ax, cl
rdtsc
setbe dh
jmp fcn.007aa96c
jmp 0x7aa9c1

Function at 0x7ae5fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf edx, edx
mov dx, word [esp]
mov edx, dword [esp]
mov dx, ax
xchg dword [esp], eax
jmp 0x7ae65a
mov edx, dword [esp]
bsr dx, ax
lea edx, [esp + edx]
lea edx, [eax*4]
lea eax, [eax + 0x43]
jmp 0x7ae644

Function at 0x7ae9c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, ecx
call 0x7ae9d1
aas
rdtsc
cmp dx, 0xd3ce
xor eax, 0x65186768
xchg edx, eax
xchg dword [esp], ebp
jmp 0x7aea76
setnp dl
bswap eax
mov ax, word [esp]
push dword [esp]
ret 4
lea edx, reloc.WINMM.dll_midiStreamOut
not edx
mov dx, cx
xchg dword [esp], ebp
inc ax
add ax, 0xaa0d
jmp 0x7aea06
rdtsc
mov ax, 0xc7cc
or ax, di
mov dx, 0xf821
lea ebp, [ebp - 0x2e]
mov edx, dword [esp]
jmp 0x7aea2e

Function at 0x7ae9d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, ecx
call 0x7ae9d1
aas
rdtsc
cmp dx, 0xd3ce
xor eax, 0x65186768
xchg edx, eax
xchg dword [esp], ebp
jmp 0x7aea76
setnp dl
bswap eax
mov ax, word [esp]
push dword [esp]
ret 4
lea edx, reloc.WINMM.dll_midiStreamOut
not edx
mov dx, cx
xchg dword [esp], ebp
inc ax
add ax, 0xaa0d
jmp 0x7aea06
rdtsc
mov ax, 0xc7cc
or ax, di
mov dx, 0xf821
lea ebp, [ebp - 0x2e]
mov edx, dword [esp]
jmp 0x7aea2e

Function at 0x7afee2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 1]
jmp 0x7b02ab
lea esp, [esp + 1]
mov dword [esp + 0x3c], ebp
pushal
pop dword [esp + 0x15]
mov dword [esp + 0x54], esi

Function at 0x7affbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
bswap edi
lea esp, [esp + 2]
jmp 0x7aff32
Function at 0x7d289b
Capabilities:
Encrypt data using aes

Disassembly:
stc
call fcn.007d2a9a
sahf
jmp 0xbdc679a8
shl edx, 8
jmp 0x7d2871
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
movzx esi, byte [eax + 0xd]
jmp 0x7d2818
movzx esi, byte [edx]
pop edx
shl edx, 8
xor edx, esi
jmp 0x7d282e
shl edx, 8
jmp 0x7d287d
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
jmp 0x7d285b
xor edx, esi
shl edx, 8
xor edx, eax
jmp 0x7d28a5
lea esp, [esp + 4]
popal
lea edx, [edx + 0xb]
jmp 0x7d2850
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
jmp 0x7d28b3
mov esi, 0xff
jmp 0x7d28d7
and eax, esi
push ebp
pushal
jmp 0x7d28e1
mov edx, esp
xchg ebp, edi
mov cl, byte [esp]
xchg bh, dl
mov dword [esp + 8], eax
pushal
jmp 0x7d2a80
mov ebx, dword [ecx + 4]
jmp 0x7d292e
and edi, esi
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
neg ebp
and edi, 0xff0000
jmp 0x7d2904
and eax, 0xff000000
bt bp, ax
jmp 0x7d2966
not bh
mov edi, edx
shr edi, 8
jmp 0x7d291b
shr edi, 0x18
mov ebp, 0x222de833
mov bp, bx
mov bp, word [esp]
pushfd
jmp 0x7d2971
xor eax, edi
btc edi, edx
bswap edi
mov edi, edx
jmp 0x7d2950
movzx edi, byte [edi*4 + 0x7a80a0]
mov bp, si
jmp 0x7d29c5
pop ebp
lea esp, [esp + 0x44]
xor eax, 0x1000000
mov bh, byte [esp]
ror bh, 2
jmp 0x7d2947
xor eax, edi
mov edi, edx
neg ebp
call fcn.007d299b
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x7d2a03
lea esp, [esp + 0x48]
xor eax, dword [ecx]
jmp 0x7d2a13
xor eax, edi
mov di, word [esp]
sub esp, 0x1d
clc
lea esp, [esp + 1]
jmp 0x7d29ed
lea edi, [ecx + 0x10]
pushal
mov byte [esp + 7], al
mov byte [esp + 0x18], bh
jmp 0x7d2a60
mov dword [ebp], eax
pop ebp
jmp 0x7d2a4a
mov eax, dword [ecx + 8]
jmp 0x7d2a68
xor ebx, eax
cmc
push ebp
mov ebp, edi
jmp 0x7d2a21
xor eax, ebx
sub esp, 0x1d
pop word [esp + 0x16]
lea esp, [esp + 3]
jmp 0x7d2e66
lea esp, [esp + 0x20]
popal
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov eax, dword [ebp]
jmp 0x7d2989
lea esp, [esp + 0x38]
jmp 0x79ce94
mov eax, ebx
dec bh
mov ebx, 0x8b8d6f6e
add ebx, 0x74ed2936
jmp 0x7d2ab0
mov bx, word [esp]
xor edx, eax
lea ebx, [ebx + ebp]
mov dword [ecx + 0x1c], edx
jmp 0x7d2ad5
mov dword [ecx + 0x14], ebx
mov bl, al
lea ebx, [ebp*4]
mov dword [ecx + 0x18], eax
jmp 0x7d2cfc

Function at 0x7d2bab
Capabilities:
Encrypt data using aes

Disassembly:
movzx edi, byte [edi*4 + 0x7a80a0]
push ax
lea esp, [esp + 2]
jmp 0x7d2c0e

Function at 0x8b2b19
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
std
mov esi, 0x7c84c199
push word [esp + 0xf]
pop edx
jmp 0x8b2acf
mov ebp, dword [esp + 5]
ror si, cl
cpuid
jmp 0x8b2aae
xchg byte [esp + 0xd], al
mov ah, al
xchg word [esp + 1], ax
shr edi, cl
not ebp
mov dx, di
jmp 0x8b2b06
push dword [esp + 5]
xchg dword [esp + 0x16], ebx
mov word [esp + 8], bx
call 0x8b2b19
scasb al, byte es:[edi]
pop dword [esp + 0x10]
mov byte [esp + 0x13], bh
mov al, cl
jmp 0x8b2b43

Function at 0x8b7382
Capabilities:
Parse pe header

Disassembly:
call fcn.008b739d
test al, 0x21
mov cl, 0xd0
and eax, dword [esi - reloc.WINMM.dll_midiStreamOut]
bound esi, qword [esi - 0x5b4aa5dd]
xlatb
Function at 0x8b739d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.008b6250
jmp 0x8b73fa
mov dword [esp + 0x28], esi
push edi
push esi
push dword [esp + 6]
mov word [esp + 1], bx
mov dword [esp + 0x30], edi
jmp 0x8b73d1
lea esp, [esp + 0x30]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x8b756b
push eax
jmp 0x8b624b
mov dword [esp + 8], ebp
pushfd
push dword [esp + 1]
pushal
mov word [esp + 0xd], cx
pop dword [esp + 0xf]
jmp 0x8b739f
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x8b73e3
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x417058], 1
mov dword [0x417054], 1
mov dword [0x417050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x41700c], eax
mov eax, dword [0x417064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x417078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x417060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x411014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401568
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov dword [esp + 4], 0x412044
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x412047
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0x4015a9
cmp dword [ebp - 0x10], 0
jne 0x4015c1
mov dword [esp], str.ERROR_opening_file.__n
call sym._printf
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0xe4]
mov dword [esp], eax
call sym._AES_init_ctx
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401667
cmp dword [ebp - 0x14], 0xf
ja 0x40162b
mov eax, 0x10
sub eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sym._memset
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
lea eax, [ebp - 0xe4]
mov dword [esp], eax
call sym._AES_ECB_decrypt
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym._fwrite
jmp 0x4015d6
nop
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
nop
leave
ret
Function at 0x401681
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x60
call dbg.__main
mov dword [esp + 0x18], 0x656f643c
mov dword [esp + 0x1c], 0x477b762f
mov dword [esp + 0x20], 0x523b7666
mov dword [esp + 0x24], 0x6d352a53
mov dword [esp + 0x28], 0x5039213a
mov dword [esp + 0x2c], 0x2b453c4d
mov dword [esp + 0x30], 0x735f514f
mov dword [esp + 0x34], 0x4e2e3b48
mov dword [esp], str.enter_the_file_you_want_to_decrypt:
call sym._printf
lea eax, [esp + 0x4c]
mov dword [esp + 4], eax
mov dword [esp], 0x412085
call sym._scanf
mov dword [esp], str.enter_the_name_of_the_decrypted_file:
call sym._printf
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], 0x412085
call sym._scanf
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x4c]
mov dword [esp], eax
call sym._encryptFile
mov dword [esp], str.decryption_completed._n
call sym._printf
mov eax, 0
leave
ret
Function at 0x4019f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov byte [ebp - 0x18], al
mov byte [ebp - 5], 0
jmp 0x401a70
mov byte [ebp - 6], 0
jmp 0x401a66
movzx eax, byte [ebp - 5]
movzx edx, byte [ebp - 6]
mov ecx, dword [ebp + 0xc]
shl eax, 2
add eax, ecx
add eax, edx
movzx ebx, byte [eax]
movzx eax, byte [ebp - 0x18]
lea edx, [eax*4]
movzx eax, byte [ebp - 5]
add eax, edx
lea edx, [eax*4]
movzx eax, byte [ebp - 6]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 0x10]
add eax, edx
movzx edx, byte [eax]
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 6]
xor edx, ebx
mov ebx, dword [ebp + 0xc]
shl eax, 2
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 6], 1
cmp byte [ebp - 6], 3
jbe 0x401a0f
add byte [ebp - 5], 1
cmp byte [ebp - 5], 3
jbe 0x401a09
nop
nop
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401a7d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x401ad6
mov byte [ebp - 0xa], 0
jmp 0x401acc
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ecx, dword [ebp + 8]
shl eax, 2
add eax, ecx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx edx, byte [eax + str.cw]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x401a91
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x401a8b
nop
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402596
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x4025ef
mov byte [ebp - 0xa], 0
jmp 0x4025e5
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ecx, dword [ebp + 8]
shl eax, 2
add eax, ecx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx edx, byte [eax + 0x4121e0]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x4025aa
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x4025a4
nop
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x4027f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov byte [ebp - 5], 0
jmp 0x40282d
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
movzx ebx, byte [eax]
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
xor ebx, ecx
mov edx, ebx
mov byte [eax], dl
add byte [ebp - 5], 1
cmp byte [ebp - 5], 0xf
jbe 0x402802
nop
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x402936
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x10
jmp 0x402a1b
cmp dword [ebp - 0xc], 0x10
jne 0x4029ef
mov eax, dword [ebp + 8]
add eax, 0xb0
mov edx, dword [eax]
mov dword [ebp - 0x1c], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x18], edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x14], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sym._Cipher
mov dword [ebp - 0xc], 0xf
jmp 0x4029e2
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0xb0
movzx eax, byte [eax]
cmp al, 0xff
jne 0x4029ba
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0xb0
mov byte [eax], 0
jmp 0x4029de
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0xb0
movzx eax, byte [eax]
lea edx, [eax + 1]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, ecx
add eax, 0xb0
mov byte [eax], dl
jmp 0x4029e8
sub dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
jns 0x402994
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
add eax, edx
movzx ebx, byte [eax]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx ecx, byte [eax]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
add eax, edx
xor ebx, ecx
mov edx, ebx
mov byte [eax], dl
add dword [ebp - 8], 1
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jb 0x402950
nop
nop
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x402c90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x402cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x41706c]
test esi, esi
jle 0x402e10
mov eax, dword [0x417070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x402d24
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x402da7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402d10
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x402e37
mov eax, dword [0x417070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x417070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402e17
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x402da0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x402db0
add dword [0x41706c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x417070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402da0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x402d2e
mov eax, dword [0x417070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop

Function at 0x403360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x417088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x417080]
sub esp, 4
test ebx, ebx
je 0x4033b5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x4033ae
test eax, eax
jne 0x4033ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403390
mov dword [esp], 0x417088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4036f0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x403715
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x403720
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x403715
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x403768
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40375e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40376a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x403750
xor eax, eax
pop ebx
pop esi
ret