joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f1e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x452594]
sub esp, 8
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x42f1f6
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x14]
cmp ecx, 0x100
jne 0x42f248
cmp dword [esp + 0x18], 9
jne 0x42f26b
cmp dword [eax + 0x518], ebx
jle 0x42f26b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x42f22b
mov eax, dword [0x452594]
push eax
call fcn.0043a1c0
jmp 0x42f237
mov ecx, dword [0x452594]
push ecx
call fcn.0043a290
add esp, 4
cmp eax, ebx
je 0x42f266
mov eax, 4
pop ebx
add esp, 8
ret
cmp ecx, 5
jne 0x42f26b
mov edx, dword [0x45258c]
test byte [edx + 0x14], 0x10
je 0x42f26b
cmp byte [eax + 0x4c8], bl
je 0x42f26b
call fcn.0041c2d0
mov eax, dword [0x452594]
movsx ecx, word [eax + 0x1d8]
push ebp
push esi
cmp ecx, ebx
push edi
mov dword [esp + 0x14], ecx
je 0x42f2c3
mov dword [esp + 0x10], ebx
jle 0x42f2c3
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov esi, 0x1dc
jmp 0x42f297
mov eax, dword [0x452594]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push edi
push ecx
push edx
push ebp
push eax
call dword [esi + eax]
movsx ebx, ax
test bl, 0x5c
jne 0x42f2c3
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add esi, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x42f292
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret

Function at 0x42f3a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x452568]
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebp, eax
test ebp, ebp
je 0x42f3c8
mov ecx, dword [0x452568]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x304
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_RedrawWindow]
push eax
call edi
mov edx, dword [0x452568]
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 0
push edx
call ebx
mov esi, eax
test esi, esi
je 0x42f40e
push 0x100
push 0
push 0
push esi
call edi
push 2
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x42f3f7
mov eax, dword [0x45258c]
mov ecx, dword [eax + 0x1fc]
test ecx, ecx
jne 0x42f463
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
je 0x42f463
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x10]
push eax
call ebx
push 1
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
jne 0x42f442
mov edx, dword [0x452564]
push edx
call sub.MMFS2.dll_Ordinal_35
pop edi
pop esi
test ebp, ebp
pop ebp
pop ebx
je 0x42f485
mov eax, dword [0x452568]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x1c
ret
Function at 0x42f770
Capabilities:
Delete directory

Disassembly:
mov eax, dword [0x45251c]
test eax, eax
je 0x42e167
mov ecx, dword [0x452518]
test ecx, ecx
je 0x42e15a
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x45251c
call fcn.0041d1c0
add esp, 4
mov eax, dword [0x4525a4]
test eax, eax
je 0x42e184
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [0x4525a4], 0
mov eax, dword [0x4524f8]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x42e197
push eax
call esi
mov eax, dword [0x4524fc]
test eax, eax
je 0x42e1a3
push eax
call esi
pop esi
ret
call fcn.00417580
call fcn.00415750
mov eax, dword [0x452514]
test eax, eax
je 0x42f792
push 0
push 2
push eax
call sub.MMFS2.dll_Ordinal_191
call fcn.0041c800
call fcn.0042df10
call fcn.0043ef30
call fcn.004026c0
call fcn.004318c0
call fcn.0042e9f0
jmp 0x42e140
Function at 0x433710
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
mov ax, word [esi]
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x28]
push 2
push edx
push edi
mov dword [esp + 0x34], eax
call ebx
test eax, eax
jne 0x433747
pop edi
pop esi
pop ebx
add esp, 0xc
ret
movsx eax, word [esp + 0x20]
sub eax, 0
je 0x433797
sub eax, 2
je 0x43375f
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esi]
sub eax, 0
je 0x433778
sub eax, 2
je 0x433773
fld qword [0x44c850]
jmp 0x43377b
fld qword [esi + 8]
jmp 0x43377b
fild dword [esi + 8]
fstp qword [esp + 0x10]
lea eax, [esp + 0x1c]
push 0
push eax
lea ecx, [esp + 0x18]
push 8
push ecx
push edi
call ebx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov eax, dword [esi]
sub eax, 0
je 0x4337b1
sub eax, 2
je 0x4337a7
xor eax, eax
jmp 0x4337b4
fld qword [esi + 8]
call sub.MSVCRT.dll__ftol
jmp 0x4337b4
mov eax, dword [esi + 8]
lea edx, [esp + 0x1c]
mov dword [esp + 0xc], eax
push 0
push edx
lea eax, [esp + 0x14]
push 4
push eax
push edi
call ebx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x434f70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
lea eax, [esp]
lea ecx, [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push eax
push 2
push ecx
push esi
call edi
test eax, eax
je 0x43501b
cmp dword [esp + 0xc], 2
jb 0x43501b
movsx eax, word [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [ebx], eax
sub eax, 0
je 0x434fec
dec eax
je 0x43501b
dec eax
jne 0x43501b
lea edx, [esp + 0xc]
push 0
push edx
lea eax, [esp + 0x1c]
push 8
push eax
push esi
call edi
test eax, eax
je 0x43501b
cmp dword [esp + 0xc], 8
jb 0x43501b
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop edi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call edi
test eax, eax
je 0x43501b
cmp dword [esp + 0xc], 4
jb 0x43501b
mov edx, dword [esp + 0x10]
pop edi
mov dword [ebx + 8], edx
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x437bf0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
mov eax, dword [eax + 0x1fc]
test eax, eax
jne 0x437c0c
mov eax, 1
add esp, 0xc
ret 8
mov ecx, dword [eax + 0x1c]
push 0
mov dword [esp + 4], ecx
mov edx, dword [eax + 0x20]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x24]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 8]
push 0xc
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
ret 8

Function at 0x437c40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x437c5e
mov eax, 1
pop esi
add esp, 0xc
ret 8
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0xc]
push 0xc
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x437cb6
cmp dword [esp + 0x14], 0xc
jne 0x437cb6
mov eax, dword [esp + 4]
push 0
push eax
push esi
call fcn.00437cc0
push 0
mov ecx, dword [esp + 0xc]
push ecx
push esi
call fcn.00437d40
push 0
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.00437dc0
mov eax, 1
pop esi
add esp, 0xc
ret 8
xor eax, eax
pop esi
add esp, 0xc
ret 8

Function at 0x43b800
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
test esi, esi
je 0x43b8d8
mov ebp, dword [esp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ax, word [esp + 0x1c]
cmp ax, word [esi + 2]
jne 0x43b86f
mov al, byte [esi]
and al, 0x10
je 0x43b831
test ebp, ebp
jne 0x43b839
test al, al
jne 0x43b86f
test ebp, ebp
jne 0x43b86f
push 0x11
call ebx
test byte [esi], 8
movsx eax, ax
je 0x43b84b
test eax, eax
jge 0x43b86f
jmp 0x43b84f
test eax, eax
jl 0x43b86f
push 0x10
call ebx
test byte [esi], 4
movsx eax, ax
je 0x43b861
test eax, eax
jge 0x43b86b
jmp 0x43b865
test eax, eax
jl 0x43b86b
xor edi, edi
mov di, word [esi + 4]
test edi, edi
jne 0x43b879
cmp byte [esi], 0
js 0x43b8d8
add esi, 8
jmp 0x43b81c
mov al, byte [esi]
mov esi, dword [esp + 0x14]
test al, 0x40
jne 0x43b88d
cmp edi, 0x7d0
jl 0x43b8b3
jmp 0x43b895
cmp edi, 0x7d0
jge 0x43b8b3
push esi
call dword [sym.imp.USER32.dll_GetMenu]
test eax, eax
je 0x43b8d8
push 0
push edi
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 0xffffffff
je 0x43b8d8
test al, 1
jne 0x43b8d8
and edi, 0xffff
push 0
or edi, 0x10000
push edi
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x43ba00
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0x60
mov word [ebx], 0
jl 0x43ba53
cmp edi, 0x69
jg 0x43ba53
push esi
push 1
push 0x40
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov esi, eax
mov eax, dword [0x452558]
push 0x3f
push esi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [edi - 0x60]
push ecx
push esi
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x10
pop esi
jmp 0x43baa0
cmp edi, 0x70
jl 0x43ba75
cmp edi, 0x87
jg 0x43ba75
lea edx, [edi - 0x6f]
push edx
push 0x4522a8
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x43baa0
xor eax, eax
cmp dword [eax*8 + str._bf_tg_fh_ri], edi
je 0x43ba88
inc eax
cmp eax, 0x14
jl 0x43ba77
jmp 0x43baa0
mov eax, dword [eax*8 + 0x45220c]
mov ecx, dword [0x452558]
push 0x3f
push ebx
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
cmp byte [ebx], 0
jne 0x43bab0
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov byte [ebx], al
pop edi
pop ebx
ret

Function at 0x43bcc0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push 0
push 0x78
push edi
call ebx
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebp
push 0
push 0x79
push edi
call ebx
push eax
call ebp
xor esi, esi
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x12]
cmp esi, ecx
jne 0x43bd01
push esi
push eax
push edi
call fcn.0043bc70
add esp, 0xc
lea edx, [esi + 0x6e]
push 1
push edx
push edi
call ebx
push eax
call ebp
inc esi
cmp esi, 8
jl 0x43bcea
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x441330
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 0x1f6]
lea ecx, [esp + 0x14]
push ebx
push ecx
test eax, eax
lea edx, [esp + 0x18]
push 1
setne al
push edx
push edi
mov byte [esp + 0x24], al
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44139c
mov al, byte [esp + 0x10]
test al, al
je 0x441391
mov eax, dword [esi + 0x1f6]
push eax
call fcn.00402630
push edi
mov esi, eax
call fcn.004339b0
push esi
mov edi, eax
call fcn.00402630
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4413b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push edi
xor edi, edi
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esp + 0x13]
push 1
push ecx
push ebx
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x441444
mov al, byte [esp + 0xb]
push esi
test al, al
je 0x44143e
mov esi, dword [esp + 0x18]
mov edx, dword [esi + 0x1fe]
mov eax, dword [esi + 0x44]
push edx
push edi
push eax
push esi
call fcn.00440af0
mov eax, dword [esi + 0x1f6]
add esp, 0x10
test eax, eax
je 0x441443
push ebp
push eax
call fcn.00402630
mov ecx, dword [esi + 0x1f6]
push edi
push ecx
mov ebp, eax
call fcn.00404ba0
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], edi
push edx
push ebx
call fcn.00435130
push ebp
mov edi, eax
call fcn.00402630
add esp, 0x18
mov eax, edi
pop ebp
pop esi
pop edi
pop ebx
add esp, 8
ret
mov edi, 1
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 8
ret
Function at 0x443560
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
push ebp
mov dword [eax], ebx
mov ecx, dword [0x452594]
push esi
mov esi, dword [esp + 0x14]
mov ebp, dword [ecx + 0x90]
mov edx, dword [ecx + 0x11c]
and esi, 0x7fff
mov dword [esp + 0xc], ebx
add esi, ebp
mov dword [esp + 0x14], edx
mov ax, word [esi + 0x18]
cmp ax, bx
jl 0x443688
push edi
jmp 0x4435a6
mov edx, dword [esp + 0x18]
movsx eax, ax
lea edi, [eax*8]
sub edi, eax
lea edi, [eax + edi*4]
lea eax, [eax + edi*2]
mov edi, dword [ecx + 0x58]
lea eax, [edi + eax*2]
cmp dword [eax + 0x28], edx
jne 0x4435e8
xor edi, edi
cmp word [eax + 2], bx
jl 0x44366d
mov edi, dword [eax + 0x2c]
mov eax, dword [ecx + 0x120]
cmp eax, ebx
jne 0x44366d
mov dword [ecx + 0x120], esi
jmp 0x443667
mov dword [eax + 0x28], edx
mov ecx, dword [0x452594]
xor edi, edi
cmp word [ecx + 0x418], bx
je 0x443607
mov word [eax + 2], 0xffff
mov dword [eax + 0x2c], ebx
jmp 0x443667
mov cx, word [eax + 6]
cmp cx, bx
mov word [eax + 2], cx
jge 0x443619
mov dword [eax + 0x2c], ebx
jmp 0x443667
mov ecx, dword [0x452594]
cmp dword [ecx + 0x120], ebx
jne 0x443633
mov dword [ecx + 0x120], esi
mov ecx, dword [0x452594]
mov dx, word [eax + 6]
jmp 0x44363f
mov ecx, dword [0x452594]
mov ebp, dword [ecx + 0x1278]
movsx edx, dx
mov edx, dword [ebp + edx*8]
cmp edx, ebx
je 0x44366d
mov cx, word [edx + 0x16]
mov word [edx + 2], cx
mov edx, ecx
cmp dx, bx
jge 0x443639
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x2c], ecx
mov edi, ecx
mov ecx, dword [0x452594]
mov ebp, dword [esp + 0x10]
mov ax, word [esi + 0x1c]
add esi, 4
add ebp, edi
cmp ax, bx
mov dword [esp + 0x10], ebp
jge 0x4435a2
pop edi
mov eax, dword [ecx + 0x120]
cmp eax, ebx
je 0x4436dd
movsx eax, word [eax + 0x18]
lea edx, [eax*8]
sub edx, eax
lea edx, [eax + edx*4]
lea eax, [eax + edx*2]
mov edx, dword [ecx + 0x58]
lea eax, [edx + eax*2]
mov dword [ecx + 0x12c], eax
mov ecx, dword [0x452594]
movsx eax, word [eax + 2]
mov edx, dword [ecx + 0x1278]
mov eax, dword [edx + eax*8]
cmp eax, ebx
je 0x4436dd
mov edx, dword [esp + 0x18]
mov dword [ecx + 0x124], eax
mov ecx, dword [esp + 0xc]
pop esi
pop ebp
mov dword [edx], ecx
pop ebx
pop ecx
ret
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x839058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8391a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x83907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83906a
add dl, dl
jne 0x839089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8390dc
xor eax, eax
add dl, dl
jne 0x839096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83917d
add dl, dl
jne 0x8390a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8390b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8390bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8390c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8390d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x839075
mov eax, 1
add dl, dl
jne 0x8390ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8390f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8390e1
sub eax, ebx
mov ebx, 1
jne 0x839128
mov ecx, 1
add dl, dl
jne 0x83910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x839119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x839105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x839075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x83913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x83914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x839136
cmp eax, 0x7d00
jae 0x83916d
cmp eax, 0x500
jb 0x839168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x839075
cmp eax, 0x7f
ja 0x839170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x839075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x83919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x839075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404f0b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43d9cd
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
jne 0x404f32
push dword [ebp + 8]
call fcn.004255e2
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x404f31

Function at 0x404f24
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43d9cd
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
jne 0x404f32
push dword [ebp + 8]
call fcn.004255e2
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x404f31

Function at 0x406240
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
or eax, 0xffffffff
lea ecx, [ebp - 0x28]
push edi
mov word [ebp - 0x10], ax
xor edi, edi
xor eax, eax
mov dword [ebp - 8], edi
push 0x64
mov word [ebp - 0xe], ax
call fcn.00407a16
mov ecx, dword [ebp + 0x10]
call fcn.00407480
mov ebx, dword [ebp + 0xc]
cmp word [ebx], di
je 0x40646a
invalid
movsb byte es:[edi], byte [esi]
and al, 0
add byte [eax], al
Function at 0x409ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1
je 0x40b3d6
test byte [edi], dl
invalid
add byte [eax], al
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
and al, 0x2c
mov word [esp + 0x30], 1
call fcn.00420db6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b52a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x409faa
Function at 0x40fce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
sub esp, 0x10
mov dword [esp + 0x28], ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x30], 3
mov edx, dword [edi]
mov eax, dword [eax + edx*4]
mov edx, esp
movsx ecx, word [eax + 0xa]
mov dword [esp + 0x4c], ecx
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
inc ecx
add al, 0x89
inc edx
add al, 0x8b
inc ecx
or byte [ecx + 0x418b0842], cl
or al, 0x8d
mov esi, dword [ecx + eax]
add byte [eax], al
mov dword [edx + 0xc], eax
inc dword [eax]
call fcn.00408180

Function at 0x415cf8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415d20
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415d12
pop edi
pop esi
pop ebp
ret 4
Function at 0x42098c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c5283]
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], al
push 0x8000
push esi
mov edi, edx
call fcn.004246e6
pop ecx
push eax
call fcn.00424514
cmp dword [edi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x455d8f
lea ecx, [ebp - 0x18]
call fcn.00405ab8
mov ecx, edi
call fcn.00409837
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.00405a15
push dword [ebp - 0x18]
push 0x491d28
push esi
call fcn.004248e5
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x455daf
lea ecx, [ebp - 0x18]
call fcn.00405904
mov edi, dword [ebp - 8]
push esi
call fcn.00424aaa
pop ecx
cmp ebx, 0xffffffff
je 0x420a2a
push ebx
push esi
call fcn.004246e6
pop ecx
push eax
call fcn.00424514
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
jmp 0x420a12
jmp 0xfd455c6c
stosb byte es:[edi], al
cld
jne 0x455d2b
cwde
inc esi
add al, 0xff
xor al, 0xb8
call 0xd420e6b
pop ecx
mov eax, dword [esi + 4]
and dword [eax + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jb 0x455d92
jmp 0x7642096f
jne 0x455db0
call dword [0x48f340]
adc eax, 0x48f340
mov esi, eax
test esi, esi
jle 0x420992
jne 0x455dd2
test byte [ecx + 0x70000ce], 0x80
jmp 0x420992
shr dword [ecx], 1

Function at 0x455ecd
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
call 0x3a4076a6
jmp 0x455f2f
enter 0x4670, 0x44
nop
adc byte [esp + 0x18], cl
je 0x455f3d
xor al, al
ret
xor ecx, ecx
push esi
test edx, edx
jle 0x455f5f
add eax, 0xe8004a54
pop esp
xor byte [ebp + 0x3b1478f6], al
mov al, 0xfc
push eax
push dword [ebp + 0x7d]
or al, 0x41
add eax, 4
cmp ecx, edx
jl 0x455f49
mov al, 1
pop esi
ret