joyce8/EMBER2024-capa huggingface dataset:
Function at 0x531ce8b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5320c68d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esi + 4]
mov dword [esp + 0x14], 0
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
mov edx, dword [esp + 0x24]
push edx
lea ecx, [esi + 8]
mov byte [esp + 0x14], 1
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 2
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 3
call dword [sym.imp.cxlibw_2_6.dll_public:_void___thiscall_CXLib206::SWCharString::constructor_class_CXLib206::SWCharString_const__]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x531ee0b1
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5327d000]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.531edf87
mov eax, 0x53130000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR71.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x531ee113
cmp dword [ebp - 0x1c], 5
jb 0x531ee12b
jmp 0x531ee127
cmp dword [ebp - 0x10], 1
jne 0x531ee12b
cmp dword [ebp - 0x1c], 4
ja 0x531ee127
jne 0x531ee12b
cmp dword [ebp - 0x18], 0
jbe 0x531ee12b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x532378dc
call fcn.5313d000
test eax, eax
jge 0x531ee14c
mov byte [0x5327d044], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.531ed911
add ebp, 0x78
leave
ret
Function at 0x4e04a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbc000]
push edi
jmp 0x4e04ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e04c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e04b0
mov eax, 1
add ebx, ebx
jne 0x4e04d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e04e4
jne 0x4e04f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e04f4
dec eax
add ebx, ebx
jne 0x4e04f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e04c8
xor ecx, ecx
sub eax, 3
jb 0x4e050c
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e057e
sar eax, 1
mov ebp, eax
jmp 0x4e0517
add ebx, ebx
jne 0x4e0517
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4e0524
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4e0548
inc ecx
add ebx, ebx
jne 0x4e0534
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e0529
jne 0x4e0545
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e0529
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e0568
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e0559
jmp 0x4e04b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e0568
add edi, ecx
jmp 0x4e04b6
pop esi
mov edi, esi
mov ecx, 0x1bdb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e0586
cmp byte [edi], 0x13
jne 0x4e0586
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e058b
lea edi, [esi + 0xde000]
mov eax, dword [edi]
or eax, eax
je 0x4e0603
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1716ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x171760]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e05b8
mov ecx, edi
jns 0x4e05e7
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x171764]
or eax, eax
je 0x4e05fd
mov dword [ebx], eax
add ebx, 4
jmp 0x4e05d5
call dword [esi + 0x171774]
mov ebp, dword [esi + 0x171768]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e0637
sub esp, 0xffffff80
jmp 0x423418
Function at 0x4016e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
and dword [esp + 4], 0
push ebx
push edi
push 0x10
lea eax, [esp + 0x24]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x30]
push eax
push 0x10
push eax
push esi
call fcn.00407039
add esp, 0x20
test eax, eax
jne 0x4018df
mov ah, byte [esp + 0x20]
movzx ecx, byte [esp + 0x21]
movzx edx, byte [esp + 0x25]
or eax, ecx
movzx ecx, byte [esp + 0x22]
shl eax, 8
or eax, ecx
movzx ecx, byte [esp + 0x23]
shl eax, 8
or eax, ecx
movzx ecx, byte [esp + 0x24]
movzx ebx, byte [esp + 0x28]
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 0x26]
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 0x27]
shl ecx, 8
or ecx, edx
xor edx, edx
or eax, edx
movzx edx, byte [esp + 0x2d]
mov dword [esp + 0x14], eax
movzx eax, byte [esp + 0x29]
shl ebx, 8
or ebx, eax
movzx eax, byte [esp + 0x2a]
shl ebx, 8
or ebx, eax
movzx eax, byte [esp + 0x2b]
shl ebx, 8
or ebx, eax
movzx eax, byte [esp + 0x2c]
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x2e]
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x2f]
xor edi, edi
or edi, ecx
shl eax, 8
or eax, edx
xor ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x14]
xor edx, edx
or ebx, edx
mov dword [esi + 0x104], eax
xor eax, eax
mov dword [esp + 0x10], edi
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x100], edi
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esp + 8], 4
mov eax, ecx
shrd ecx, ebx, 1
shr ebx, 1
xor edx, edx
shl edi, 0x1f
or ebx, edi
and eax, 1
or ecx, edx
imul eax, eax, 0xe1000000
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
shrd edx, ebx, 1
shr ebx, 1
xor edi, edi
xor edi, edx
mov edx, dword [esp + 8]
xor eax, ebx
mov ebx, dword [esp + 0x1c]
mov dword [esi + edx*8 + 0x40], ecx
mov dword [esi + edx*8 + 0x44], ebx
mov dword [esi + edx*8 + 0xc0], edi
mov dword [esi + edx*8 + 0xc4], eax
sar edx, 1
test edx, edx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 8], edx
jg 0x4017f5
push 2
pop ebx
mov dword [esp + 8], ebx
cmp ebx, 1
lea edi, [esi + ebx*8 + 0xc0]
mov eax, dword [edi]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
lea edx, [esi + ebx*8 + 0x40]
mov dword [esp + 0x14], eax
mov eax, dword [edx]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
jle 0x4018d2
sub edi, edx
dec ebx
lea ecx, [edx + 8]
lea eax, [esi + 0x48]
mov dword [esp + 0xc], ebx
mov edx, dword [eax + 0x80]
mov ebx, dword [eax + 0x84]
xor edx, dword [esp + 0x10]
xor ebx, dword [esp + 0x14]
mov dword [edi + ecx], edx
mov dword [edi + ecx + 4], ebx
mov edx, dword [eax]
mov ebx, dword [eax + 4]
xor edx, dword [esp + 0x18]
xor ebx, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
add eax, 8
add ecx, 8
dec dword [esp + 0xc]
jne 0x401895
mov ebx, dword [esp + 8]
add ebx, ebx
cmp ebx, 8
mov dword [esp + 8], ebx
jle 0x40185e
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401d3f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push 0
push 8
push dword [esi + 0x144]
push dword [esi + 0x140]
call fcn.00451520
push 0
push 8
push dword [esi + 0x14c]
mov edi, edx
push dword [esi + 0x148]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
call fcn.00451520
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [esi + 0x150]
push eax
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 8], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
or eax, edi
jne 0x401da7
mov eax, dword [ebp - 0xc]
or eax, ebx
je 0x401e7f
push 0x10
lea eax, [ebp - 0x24]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x24], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x23], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0x22], al
mov al, byte [ebp - 8]
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0xc]
mov ecx, eax
mov edx, ebx
shrd ecx, edx, 0x18
shr edx, 0x18
mov byte [ebp - 0x20], cl
mov ecx, eax
mov edx, ebx
shrd ecx, edx, 0x10
mov byte [ebp - 0x1f], cl
mov ecx, eax
mov byte [ebp - 0x1d], al
mov eax, edi
shr eax, 0x18
mov byte [ebp - 0x1c], al
mov eax, edi
shr eax, 0x10
mov byte [ebp - 0x1b], al
shrd ecx, ebx, 8
mov eax, edi
shr eax, 8
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0x10]
shr edx, 0x10
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x14]
mov edx, edi
mov ecx, eax
shrd ecx, edx, 0x18
shr edx, 0x18
mov byte [ebp - 0x18], cl
mov edx, edi
mov ecx, eax
shrd ecx, edx, 0x10
mov byte [ebp - 0x17], cl
mov ecx, eax
shrd ecx, edi, 8
shr edi, 8
add esp, 0xc
shr ebx, 8
shr edx, 0x10
mov byte [ebp - 0x15], al
mov byte [ebp - 0x16], cl
xor eax, eax
lea edi, [esi + 0x170]
mov cl, byte [ebp + eax - 0x24]
xor byte [edi + eax], cl
inc eax
cmp eax, 0x10
jb 0x401e57
push edi
mov eax, esi
call fcn.00401982
pop ecx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dl, byte [edi + ecx]
add eax, ecx
xor byte [eax], dl
inc ecx
cmp ecx, 0x10
jb 0x401e6f
pop edi
xor eax, eax
pop ebx
leave
ret

Function at 0x401ed3
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
test ecx, ecx
jne 0x401f18
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
jmp 0x401f50
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
mov dword [eax + 0xe8], ecx
ret
Function at 0x404a35
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, eax
push 0x40
lea ebx, [esi + 0x68]
push 0x36
push ebx
call sub.msvcrt.dll_memset
push 0x40
lea edi, [esi + 0xa8]
push 0x5c
push edi
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x14
mov eax, edi
mov edi, dword [ebp + 8]
pop ecx
mov dl, byte [edi]
xor byte [eax - 0x40], dl
mov dl, byte [edi]
xor byte [eax], dl
inc edi
inc eax
dec ecx
jne 0x404a68
mov eax, esi
call fcn.00401ed3
push 0x40
push ebx
call fcn.0040484a
push 0x20
lea eax, [ebp - 0x20]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404bd0
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x405ecb
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
xor ebx, ebx
push esi
xor ecx, ecx
inc ebx
push edi
mov eax, ebx
mov esi, 0xff
mov edx, eax
and dl, 0x80
neg dl
lea edi, [eax + eax]
mov dword [ebp + ecx*4 - 0x80c], eax
mov dword [ebp + eax*4 - 0x40c], ecx
sbb edx, edx
and edx, 0x1b
xor edx, edi
xor edx, eax
and edx, esi
inc ecx
cmp ecx, 0x100
mov eax, edx
jl 0x405ee3
mov eax, ebx
mov ecx, 0x45f828
mov edx, eax
and dl, 0x80
neg dl
mov dword [ecx], eax
sbb edx, edx
and edx, 0x1b
add eax, eax
xor edx, eax
and edx, esi
add ecx, 4
cmp ecx, 0x45f850
mov eax, edx
jl 0x405f18
mov byte [0x45ef28], 0x63
mov byte [0x4610b3], 0
mov eax, dword [ebp + ebx*4 - 0x40c]
shl eax, 2
lea ecx, [ebp - 0x410]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, esi
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, esi
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, esi
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, esi
xor eax, edx
mov byte [ebx + 0x45ef28], al
mov byte [eax + 0x461050], bl
inc ebx
cmp ebx, 0x100
jl 0x405f47
xor edi, edi
movzx ecx, byte [edi + 0x45ef28]
mov eax, ecx
and al, 0x80
neg al
lea edx, [ecx + ecx]
sbb eax, eax
and eax, 0x1b
xor eax, edx
and eax, esi
mov edx, eax
xor eax, ecx
shl eax, 8
xor eax, ecx
shl eax, 8
xor eax, ecx
shl eax, 8
xor eax, edx
mov ecx, edi
shl ecx, 2
mov dword [ecx + 0x460c50], eax
rol eax, 8
mov dword [ecx + 0x460850], eax
rol eax, 8
mov dword [ecx + 0x460450], eax
rol eax, 8
mov dword [ecx + 0x460050], eax
movzx eax, byte [edi + 0x461050]
test eax, eax
je 0x406025
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3d4]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 4], eax
jmp 0x406029
and dword [ebp - 4], 0
movzx eax, byte [edi + 0x461050]
test eax, eax
je 0x406052
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3e8]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 0xc], eax
jmp 0x406056
and dword [ebp - 0xc], 0
movzx eax, byte [edi + 0x461050]
test eax, eax
je 0x40607f
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3d8]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 8], eax
jmp 0x406083
and dword [ebp - 8], 0
movzx eax, byte [edi + 0x461050]
test eax, eax
je 0x4060a9
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3e0]
mov ebx, esi
cdq
idiv ebx
mov edx, dword [ebp + edx*4 - 0x80c]
jmp 0x4060ab
xor edx, edx
shl edx, 8
xor edx, dword [ebp - 8]
shl edx, 8
xor edx, dword [ebp - 0xc]
shl edx, 8
xor edx, dword [ebp - 4]
inc edi
mov dword [ecx + 0x45fc50], edx
rol edx, 8
mov eax, edx
mov dword [ecx + 0x45f850], eax
rol eax, 8
mov dword [ecx + 0x45f428], eax
rol eax, 8
cmp edi, 0x100
mov dword [ecx + 0x45f028], eax
jl 0x405faa
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406397
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
push ebx
push esi
push edi
push 0x118
mov edi, eax
lea eax, [esp + 0x1c]
push 0
push eax
call sub.msvcrt.dll_memset
push dword [ebp + 0xc]
lea esi, [edi + 8]
push dword [ebp + 8]
lea eax, [esp + 0x2c]
mov dword [edi + 4], esi
call fcn.00406119
add esp, 0x14
test eax, eax
mov dword [esp + 0x14], eax
jne 0x406491
mov ecx, dword [esp + 0x18]
mov dword [edi], ecx
shl ecx, 4
add ecx, dword [esp + 0x1c]
push 4
mov eax, dword [ecx]
mov dword [esi], eax
pop edx
add ecx, edx
mov eax, dword [ecx]
add esi, edx
mov dword [esi], eax
add ecx, edx
mov eax, dword [ecx]
add esi, edx
mov dword [esi], eax
add ecx, edx
mov eax, dword [ecx]
add esi, edx
mov dword [esi], eax
mov edi, dword [edi]
add esi, edx
dec edi
sub ecx, 0x1c
jmp 0x406473
mov dword [esp + 0x10], edx
movzx eax, byte [ecx + 3]
movzx eax, byte [eax + 0x45ef28]
movzx ebx, byte [ecx + 2]
movzx ebx, byte [ebx + 0x45ef28]
mov eax, dword [eax*4 + 0x45f028]
xor eax, dword [ebx*4 + 0x45f428]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [ebx + 0x45ef28]
xor eax, dword [ebx*4 + 0x45f850]
mov ebx, dword [ecx]
and ebx, 0xff
movzx ebx, byte [ebx + 0x45ef28]
xor eax, dword [ebx*4 + 0x45fc50]
add ecx, edx
mov dword [esi], eax
add esi, edx
dec dword [esp + 0x10]
jne 0x406417
dec edi
sub ecx, 0x20
test edi, edi
jg 0x406413
mov eax, dword [ecx]
mov dword [esi], eax
add ecx, edx
mov eax, dword [ecx]
add esi, edx
mov dword [esi], eax
add esi, edx
add ecx, edx
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov ecx, 0x118
lea eax, [esp + 0x18]
dec ecx
mov byte [eax], 0
inc eax
test ecx, ecx
jne 0x40649a
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406ef4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
test al, 0xf
push ebx
mov ebx, ecx
je 0x406f09
push 0xffffffffffffffde
pop eax
jmp 0x406fcc
cmp dword [ebp + 0xc], 0
push esi
push edi
jne 0x406f73
test eax, eax
jbe 0x406fc8
mov ecx, dword [ebp + 0x10]
lea edi, [eax - 1]
sub ecx, ebx
shr edi, 4
push 0x10
mov dword [ebp - 4], ecx
inc edi
pop esi
push esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x14]
push 0
push dword [ebp + 8]
mov ecx, ebx
call fcn.00406ed5
add esp, 0x14
mov eax, esi
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
xor byte [ebx], cl
inc ebx
dec eax
jne 0x406f4c
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
add dword [ebp + 0x14], esi
sub dword [ebp - 4], esi
add esp, 0xc
dec edi
jne 0x406f2b
jmp 0x406fc8
test eax, eax
jbe 0x406fc8
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp + 0x14]
dec eax
shr eax, 4
inc eax
push 0x10
mov dword [ebp - 8], eax
pop esi
mov eax, dword [ebp + 0x14]
mov ecx, ebx
sub ecx, eax
mov dword [ebp - 4], esi
mov dl, byte [edi + eax]
xor dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
dec dword [ebp - 4]
jne 0x406f92
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
mov eax, ebx
call fcn.00406ed5
push esi
push ebx
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
add dword [ebp + 0x14], esi
add esp, 0x14
sub edi, esi
add ebx, esi
dec dword [ebp - 8]
jne 0x406f88
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x4073f6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x4524c8
call fcn.00407608
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x407431
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407431
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x407449
cmp eax, 0x20b
je 0x407436
mov dword [ebp - 0x1c], edi
jmp 0x40745d
cmp dword [ecx + 0x84], 0xe
jbe 0x407431
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x407457
cmp dword [ecx + 0x74], 0xe
jbe 0x407431
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x462c3c], 0xffffffff
or dword [0x462c40], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x45e5ec]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x45e5e8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x462c38], eax
call fcn.00407604
cmp dword [section..data], edi
jne 0x4074ba
push fcn.00407604
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.004075f2
push 0x4524c0
push 0x4524bc
call sub.msvcrt.dll__initterm
mov eax, dword [0x45e5e4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x45e5e0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x4524b8
push 0x45248c
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x407520
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x4075da
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x40756e
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x40753c
cmp ax, 0x22
jne 0x407529
cmp word [esi], 0x22
jne 0x407547
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x407555
cmp ax, 0x20
jbe 0x407542
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x40757b
movzx eax, word [ebp - 0x48]
jmp 0x40757e
cmp word [esi], 0x20
jbe 0x407547
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x40756e
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x40759f
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x4075d4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00407641
ret
Function at 0x407712
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi + 4], 0
push edi
jne 0x4077a4
push 0x65
call fcn.00448b23
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x66
mov dword [esi + 4], eax
call fcn.00448b4c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push dword [esi + 4]
call edi
push 0x67
mov dword [esi + 0x10], eax
call fcn.00448b4c
push eax
push dword [esi + 4]
call edi
push 0x68
mov dword [esi + 0x14], eax
call fcn.00448b4c
push eax
push dword [esi + 4]
call edi
push 0x69
mov dword [esi + 0x18], eax
call fcn.00448b4c
push eax
push dword [esi + 4]
call edi
push 0x6a
mov dword [esi + 0x1c], eax
call fcn.00448b4c
push eax
push dword [esi + 4]
call edi
push 0x6b
mov dword [esi + 0x20], eax
call fcn.00448b4c
push eax
push dword [esi + 4]
call edi
push 0x6c
mov dword [esi + 8], eax
call fcn.00448b4c
push eax
push dword [esi + 4]
call edi
mov dword [esi + 0xc], eax
pop edi
ret

Function at 0x407b58
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
call fcn.00446454
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 0xc], eax
je 0x407bd0
push ebx
push esi
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 2
jbe 0x407bc5
lea eax, [esi + 2]
push edi
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
push ebx
push ebx
push 2
push dword [ebp + 0xc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi - 2]
push eax
push edi
push dword [ebp + 0xc]
call fcn.004459ef
add esp, 0xc
lea eax, [edi + esi]
push edi
push dword [ebp + 8]
mov byte [eax - 2], bl
mov byte [eax - 1], bl
mov byte [eax], bl
call fcn.00407a64
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
pop ebp
ret 8