joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c49cf
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10009105
movzx eax, al
test eax, eax
jne 0x100c49fe
push 4
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10009385
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
leave
ret 4
Function at 0x102ef93e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
mov byte [esp + 4], 0xee
mov word [esp + 0xa5c], 0xf8
push ebx
mov word [esp + 0xa62], 0xe9
push dword [esp + 0x10]
mov byte [esp + 0x10], 0xb0
mov word [esp + 0xa68], 0xf0
mov byte [esp], 0xdf
jmp loc.10327465

Function at 0x102efbf6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
call fcn.1007a8c7
rcr al, cl
add esp, 0xc
pushal
pushfd
lea eax, [esp + 0xd68]
push edx
mov dword [esp + 0x24], eax
call fcn.1031a455

Function at 0x102f3a34
Capabilities:
Execute anti-debugging instructions

Disassembly:
test eax, eax
mov word [esp], 0x72c9
lea esp, [esp + 4]
jge 0x10312202
lea ecx, [ebx - 0x4d7d23e8]
mov cl, 0x70
jmp fcn.10332ced

Function at 0x102fb976
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov word [esp + 0x97e], si
jmp 0x103056dc
jmp 0x1031d883
mov word [esp], 0xd504
mov byte [esp], 0x51
mov word [esp + 0x980], 0xf6
call fcn.102f5e7d
jmp 0x103056f6

Function at 0x102fc78a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], edi
mov dword [esp], 0xce8c2ba3
call fcn.102f08ac

Function at 0x102fc7b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xa60], dx
jmp 0x103041e4
mov word [esp + 0xa62], ax
push eax
movsx dx, bl
movsx dx, cl
mov word [esp + 0xa6a], ax
lahf
pop eax
cdq
mov word [esp + 0xa68], di
pop edx
mov word [esp + 0xaa4], 0x53
lea eax, [ebx + 0x4a56e8ce]
lea esp, [esp + 0x2c]
jnp 0x10328e12
mov word [esp + 0xa7a], 0x79
cdq
lahf
mov word [esp + 0xa7c], si
rdtsc
mov word [esp + 0xa7e], 0x69
rdtsc
cdq
pushal
mov word [esp + 0xaa0], 0x6e
push dword [esp]
pushal
mov word [esp + 0xac6], 0x74
xchg edx, eax
setp al
mov word [esp + 0xac8], cx
movsx ax, dl
pop edx
mov dword [esp + 0x3c], 0x72
pushfd
call fcn.1034fa70
movzx ax, cl
mov word [esp + 0xa7a], 0x79
push esi
lahf
movsx ax, cl
mov word [esp + 0xa80], si
movzx dx, cl
cwde
setp al
mov word [esp + 0xa82], 0x69
not edx
movzx eax, cl
xchg ah, dh
push dword [esp]
mov word [esp + 0xa88], 0x6e
push 0xf6ebd0ec
movzx dx, al
lahf
mov word [esp + 0xa8e], 0x74
mov dl, byte [esp + 4]
mov word [esp + 0xa90], cx
lahf
mov dword [esp + 8], 0x72
cdq
mov eax, dword [esp + 8]
lea edx, [esp - 0x54ae37dc]
mov dword [esp + 8], 0x6f
jmp 0x1032d1cd
pushal
mov dl, byte [esp + 4]
lea edx, [edi + 0x327b2fea]
mov edx, dword [esp + 0x28]
push edi
push dword [esp + 4]
mov word [esp + 0xaba], ax
push dword [esp + 4]
jmp 0x10320048

Function at 0x102fc974
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x960], 0xe9
jmp 0x1034bbea
mov dword [esp + 0xc], ecx
call fcn.102f0ad6

Function at 0x1030d6f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x9ba], 0xec
mov byte [esp], 0x20
call fcn.1031132e
Function at 0x1030d70a
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dh
mov word [esp + 0xac0], si
setns dh
rdtsc
pop edx
pushfd
mov word [esp + 0xac2], 0x69
bswap edx
xchg edx, eax
mov word [esp + 0xac4], 0x6e
jmp 0x103185d2
movsx dx, bl
mov word [esp + 0xac6], 0x74
lahf
rdtsc
movzx ax, bl
mov word [esp + 0xac8], cx
movzx ax, al
not dl
mov dword [esp + 0x40], 0x72
cwde
mov eax, dword [esp + 0x40]
pushfd
lea edx, [edi - 0x73f2cd06]
lea edx, [esi + 0x4f565312]
mov dword [esp + 0x44], 0x6f
lea edx, [ebp + 0xb65acd7]
call fcn.10333a1d

Function at 0x1030f65f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0x48]
jb 0x1034f2db

Function at 0x10310ae0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov word [esp + 0x920], 0xc9
mov byte [esp], 0x74
mov word [esp + 0x922], 0xda
mov byte [esp + 8], 0xf6
push dword [esp]
mov word [esp + 0x928], 0xd1
call fcn.1034aabc

Function at 0x103110da
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
movzx dx, dl
rdtsc
mov word [esp + 0xa8c], cx
lahf
mov dword [esp + 4], 0x72
sete al
mov eax, dword [esp + 4]
mov dh, bl
movzx dx, cl
pushfd
mov dword [esp + 8], 0x6f
sete dh
mov edx, dword [esp + 8]
push dword [esp]
call fcn.1034c1f5
push 0x409f5e35
lea esp, [esp + 0x40]
jno 0x1034c838
mov word [esp + 0xa7e], 0x69
cwde
push 0xbb7b73e
mov word [esp + 0xa84], 0x6e
push 0xe821895d
rdtsc
lea edx, [eax*8 + 0x4cd89a9a]
mov word [esp + 0xa8a], 0x74
jmp 0x10306d76
call 0x10323c36
mov word [esp + 0xa2a], 0xed
mov word [esp + 4], 0xfadb
push edi
jmp 0x103411cd
call fcn.1032d2ba
lea edx, [edi + 0x7e2adef1]
mov word [esp + 0xa7e], 0x69
mov ax, 0xcad2
mov word [esp + 0xa80], 0x6e
pushfd
mov word [esp + 0xa86], 0x74
lea edx, [ebx - 0x19b34e7c]
mov word [esp + 0xa88], cx
pop eax
mov dl, 0xa3
setae al
push 0x72
cdq
pop eax
call fcn.102fcea2
jmp 0x10340327

Function at 0x10311c94
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x960], 0xee
push dword [esp]
call fcn.100c9c6d

Function at 0x10316504
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10343e70
lea esp, [esp + 0x30]
jb 0x1034f2db
movzx ax, bl
lea eax, [esp + 0xe4]
jmp 0x10344e33
push eax
pushfd
jmp loc.102f5b5f

Function at 0x10317851
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bl
jmp 0x10326387
clc
pushal
cmp edi, 0xffffffff
call fcn.102ed9b5
pushal
mov dword [esp + 0x24], 8
jmp 0x103034f2
pushal
lea esp, [esp + 0x44]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
clc
shld di, di, cl
mov edi, eax
stc
jmp 0x10310ac9

Function at 0x1031a6fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
not si
movsx si, al
movzx si, dl
lea esi, [esp + 0xa44]
jmp 0x103092b0

Function at 0x10324ea7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x7cc], 0x64cd
mov byte [esp], 0x7e
mov byte [esp + 0xc], 0x10
mov word [esp], 0x563
jmp 0x10331f46
mov word [esp + 0x7ce], 0x4f5c
mov byte [esp], 0x7d
mov word [esp + 0x7d0], 0x76d1
call fcn.10337092
mov dword [esp + 0x3c], eax
pushfd
jmp 0x1034d68a
lea esp, [esp + 0x40]
Function at 0x10324fcd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov word [esp + 0x8a6], 0x20
mov byte [esp + 4], dl
mov word [esp + 0x8a8], 0x4d
push ebp
pushfd
push dword [esp]
mov word [esp + 0x8b6], dx
pushfd
mov word [esp + 0x8bc], 0x6e
mov byte [esp + 4], ah
mov word [esp + 0x8be], 0x69
mov dword [esp], 0x7c3c4273
push ebp
push 0x6f3e26c9
mov word [esp + 0x8c8], 0x74
call fcn.102ee0e1

Function at 0x10326d66
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
jmp 0x102f4d84
lea esp, [esp + 0x2c]
jne 0x103510f7
push 0
push eax
jmp 0x102fb5c0

Function at 0x1032a780
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1032a770
mov word [esp + 0xb12], dx
mov byte [esp], bh
call fcn.1030a923
push 0x250d5632
stc
mov dword [esp], 0xd615af79
push 0xd39a2008
test eax, eax
pushfd
jmp 0x1034e217

Function at 0x1032ee7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x8ae], dx
mov byte [esp], 0x3d
jmp 0x10302e26
mov word [esp + 0x8b0], ax
jmp 0x1032ee62
jmp 0x10300eda
mov word [esp + 0x8ac], 0xf7
mov word [esp + 0xc], 0x648f
jmp 0x102ff4c3
mov word [esp + 0x8aa], 0xf6
mov dword [esp], 0x8d94e047
mov dword [esp], ecx
mov word [esp + 0x10], bx
jmp 0x1030e452
mov word [esp + 0x8b2], cx
mov dword [esp + 0x18], ebx
mov word [esp + 0x8b4], ax
call fcn.102f1b19
mov dword [esp + 4], 0xd6600ca6
mov word [esp + 0x842], 0xea
call fcn.1030c413

Function at 0x10334383
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cmp esi, 8
push 0x70014511
push 0x58fb3572
pushfd
lea esp, [esp + 0x34]
jb 0x1034f2db
movzx ax, dl
jmp 0x10307464

Function at 0x1033a083
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x8c]
ja 0x10344f24
mov word [esp + 0x91c], 0xee
pushal
mov word [esp + 0x93e], ax
pushfd
mov word [esp + 0x946], dx
pushfd
mov byte [esp + 4], 0xf8
mov word [esp + 0x94c], ax
jmp fcn.102f041d
push 0x9bdd5ca0
push 0x980cd597
mov word [esp + 0x924], 0xee
lea esp, [esp + 8]
jge 0x10349783
mov word [esp + 0x91e], ax
pushfd
pushfd
mov word [esp + 0x92a], dx
push 0xc63517ff
push dword [esp]
mov word [esp + 0x934], ax
lea esp, [esp + 0x10]
ja 0x102fb7f0
mov word [esp + 0x928], ax
push 0x9fac858b
mov word [esp + 0x92e], di
mov dword [esp], ebp
push dword [esp]
pushfd
mov word [esp + 0x7e4], 0xf4
pushal
lea esp, [esp + 0x2c]
jmp fcn.103002cf
push esp
jmp fcn.1032a101

Function at 0x1033c3c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xa0e], 0xed
call fcn.102eea31
Function at 0x1033c3d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp loc.10348842
push 0x18627924
pushal
mov word [esp + 0xa28], 0xa1
pushal
mov word [esp + 4], bx
jmp 0x1032160d
mov word [esp + 0xa26], 0xaf
pushfd
push 0xe7110a1b
mov dword [esp], esi
mov word [esp + 0xa30], dx
jmp 0x1034ed84
mov byte [esp], 0xa
mov word [esp + 0xa7c], 0xf6
jmp 0x1033ac28
lea esp, [esp + 0x80]
jl 0x10316519
pushal
mov word [esp + 0xa24], 0xa1
jmp 0x10306296
call fcn.10326904
lea esp, [esp + 8]
jne 0x10349b2b
jge 0x1033142e
push esp
mov byte [esp], 0x97
pushfd
inc dword [esp + 0x1c]
mov byte [esp], 0xee
bt ecx, edi
test bx, cx
bt si, bx
cmp dword [esp + 0x1c], 3
mov byte [esp], 0x83
jmp 0x103232b3
call fcn.10314b39
jmp 0x102fc3d5
mov word [esp + 0xa4a], 0xaf
mov byte [esp + 8], al
pushfd
mov byte [esp], 0xa3
push esp
mov word [esp + 0xa54], dx
push dword [esp + 4]
mov word [esp + 0xa5a], ax
jmp 0x10316402
mov byte [esp + 4], bh
lea esp, [esp + 8]
jb 0x100a6362
push esi
cwde
mov esi, 0x208
pushfd
movzx ax, cl
lahf
mov dword [esp + 4], esi
push dword [esp]
pushal
movzx ax, dl
bswap ax
lea eax, [esp + 0xd72]
call fcn.1030b9c0
pushal
jmp 0x10340062
mov word [esp], 0xca24
mov byte [esp], al
mov word [esp + 0xa22], ax
mov dword [esp], 0x7fa83861
lea esp, [esp + 0x64]
jnp 0x10315346
pushfd
mov word [esp + 0x9c4], cx
pushfd
jmp 0x10333d9f
mov word [esp + 0x88c], 0xe9
push dword [esp + 4]
jmp 0x102f55cc
call fcn.10306c0a
jmp 0x1032a26c
pushal
call fcn.10347c99
mov dword [esp], ebx
mov word [esp + 0xa80], 0xb4
jmp 0x1030b5cd
movsx cx, al
lea ecx, [esp + 0xb68]
pushfd
push 0x267dd0cf
call fcn.1031967e
jmp 0x1032767b
mov ch, cl
lea ecx, [edi - 0x4787aadc]
mov byte [ebp - 4], 2
movsx cx, bl
movsx cx, dl
lea ecx, [ebp - 0x314]
pushal
call fcn.10346dd3
stc
xor eax, ebp
dec ah
call fcn.100a54ab
mov word [esp + 0xa7a], 0xed
jmp 0x10350f96
mov word [esp + 0xa32], ax
call fcn.10322d75
jmp 0x1030b52d

Function at 0x103418cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 0xb2a], 0x20
mov byte [esp], cl
jmp 0x10338eb6

Function at 0x10342508
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 0x982], dx
jmp 0x10348890
mov byte [esp + 4], 0x90
mov word [esp + 0x984], ax
jmp 0x10338eac

Function at 0x1034473b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 0x20], eax
call fcn.10307887
pushfd
bswap ax
lea eax, [esp + 0xe8]
jmp 0x1030dfc2
cmp dl, al
push edx
cmp esi, 8
push edi
lea esp, [esp + 0x30]
jb 0x1034f2db
jmp 0x10350565
jmp 0x1031fc18
Function at 0x10345f2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushal
lea esp, [esp + 0x44]
jne 0x10332265
cmp bl, 0x1b
stc
clc
xor esi, esi
test bh, 0x66
bt sp, 3
test cl, 0xeb
cmp dword [esp + 0x24], ebx
push edi
pushal
push ebp
call fcn.102fc664
pushal
lea esp, [esp + 0x28]
jb 0x1034f2db
not ah
movzx ax, cl
pushfd
lea eax, [esp + 0xe8]
pushal
mov dword [esp + 0x20], eax
jmp 0x1034f172
push dword [esp + 0x44]
pop dword [esp + 0x1c]
jmp 0x10351904
mov byte [esp], 0x70
pushfd
pushal
lea esp, [esp + 0x40]
call sub.KERNEL32.dll_Process32NextW
stc
clc
test eax, eax
pushfd
jmp 0x1031a83a

Function at 0x10348e72
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov word [esp + 0x7b4], 0x76d1
lea esp, [esp + 0x60]
jb 0x1031d89c
call fcn.10343c6d
mov byte [esp], bh
jmp 0x10330f7a

Function at 0x1034d959
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x844], 0xf4
mov dword [esp + 8], esi
mov byte [esp], 0x3c
lea esp, [esp + 0x6c]
jmp fcn.103002cf

Function at 0x103544a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x8fe], si
call fcn.102ee3e2

Function at 0x103544ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x8f0], 0xdc
jmp 0x1032d053
jmp 0x10349a46
mov byte [esp + 4], 0xd4
mov byte [esp], 0xdd
mov word [esp + 0x8f2], cx
call fcn.102fc673
jmp 0x103207f2

Function at 0x10354515
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xa74], dx
movzx edx, bl
movsx dx, al
mov word [esp + 0xa76], ax
movzx dx, bl
seta dl
jmp 0x10348161
mov word [esp + 0xa72], 0xad
jmp 0x10354cab
jmp 0x10334263
mov byte [esp + 4], dl
jmp 0x102fc12c

Function at 0x10354a24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 0x94c], 0xd1
mov dword [esp + 4], 0x71152cb7
jmp fcn.102f396e

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x55c0243
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x740c7cf0
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4023d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c0e5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x425040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
call fcn.00402200
lea ecx, [ebp + 0xc]
call fcn.00402200
push ecx
mov ecx, dword [ebp + 8]
mov esi, esp
mov dword [ebp - 0x10], esi
lea ecx, [ecx - 0x10]
call fcn.00402520
add eax, 0x10
mov dword [esi], eax
call fcn.004020e0
mov ecx, dword [ebp + 0xc]
mov ebx, eax
add ecx, 0xfffffff0
mov dword [ebp - 0x10], esi
call fcn.00402520
add eax, 0x10
mov dword [esi], eax
call fcn.004020e0
mov edi, eax
mov dword [ebp - 0x2c], 1
add esp, 4
mov dword [ebp - 0x28], ebx
mov eax, 0x614
mov dword [ebp - 0x24], edi
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
mov dword [ebp - 0x1e], 0
mov dword [ebp - 0x1a], 0
mov dword [ebp - 0x16], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push ebx
mov esi, eax
call fcn.0040a2df
push edi
call fcn.0040a2df
add esp, 8
test esi, esi
jne 0x4024a4
cmp dword [ebp - 0x1e], esi
jne 0x4024a4
lea edi, [esi + 1]
jmp 0x4024a6
xor edi, edi
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4024c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4024e6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4028d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40292b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40292b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402918
cmp esi, edx
jae 0x40292b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402906
cmp esi, edx
jae 0x40292b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x402940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c125
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x40]
call fcn.00401b30
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00401b30
mov byte [ebp - 4], 1
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x14]
cmp edi, 7
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
cmova edx, esi
test ebx, ebx
je 0x4029c8
lea eax, [ebx - 1]
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x5c
lea eax, [edx + ecx*2]
je 0x4029c2
cmp eax, edx
je 0x4029c8
sub eax, 2
cmp word [eax], 0x5c
jne 0x4029b5
sub eax, edx
sar eax, 1
jmp 0x4029cb
or eax, 0xffffffff
lea edx, [ebx - 1]
cmp eax, edx
jne 0x402a0e
cmp edi, 7
lea ecx, [ebp - 0x28]
cmova ecx, esi
test ebx, ebx
je 0x402a07
cmp edx, 0xffffffff
mov eax, 0xffffffff
cmovb eax, edx
cmp word [ecx + eax*2], 0x2f
lea eax, [ecx + eax*2]
je 0x402a01
cmp eax, ecx
je 0x402a07
sub eax, 2
cmp word [eax], 0x2f
jne 0x4029f4
sub eax, ecx
sar eax, 1
jmp 0x402a0a
or eax, 0xffffffff
cmp eax, edx
je 0x402a42
cmp ebx, edi
jae 0x402a2a
lea eax, [ebx + 1]
cmp edi, 7
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmova eax, esi
mov dword [eax + ebx*2], 0x5c
jmp 0x402a3c
push 0x5c
mov byte [ebp - 0x44], 0
push dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00403590
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], 7
lea eax, [ebp - 0x40]
cmova eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402a70
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.004011b0
mov edi, dword [ebp - 0x14]
mov ebx, 1
mov esi, dword [ebp - 0x28]
jmp 0x402a75
mov ebx, 0xfffffffe
cmp edi, 7
jbe 0x402aa5
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x402a9b
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402af9
push edi
push esi
call fcn.0040a2a9
add esp, 8
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x402adb
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402ad1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402af9
push ecx
push edx
call fcn.0040a2a9
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a26b
mov esp, ebp
pop ebp
ret
call fcn.0040d671
int3
Function at 0x406e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x406e85
mov dword [edi], 0
push 0
mov edx, 0x400000
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
cmp esi, edx
push eax
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x406e78
test ecx, ecx
je 0x406e85
test esi, esi
je 0x406e85
mov ecx, dword [ebp - 4]
jmp 0x406e3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x426600], ecx
inc eax
cmp eax, 0x100
jb 0x407035
cmp eax, 0x800
jae 0x407103
nop dword [eax]
mov edx, dword [eax*4 + 0x426200]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x426600]
mov dword [eax*4 + 0x426600], edx
inc eax
cmp eax, 0x800
jb 0x4070e0
lea ecx, [ebp - 0x24]
mov dword [0x4265e0], 0x407e80
call fcn.00407f80
test eax, eax
je 0x4071c6
mov edi, dword [ebp - 0x14]
xor ecx, ecx
mov esi, edi
mov eax, 0x425908
shr esi, 8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor edx, edx
nop dword [eax]
mov ebx, dword [ebp - 0x20]
cmp dword [eax - 8], ebx
jne 0x407157
mov ebx, dword [ebp - 0x1c]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp - 0x18]
jne 0x407157
cmp dword [eax], ebx
je 0x407174
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x407140
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a26b
mov esp, ebp
pop ebp
ret
sub ecx, 0
je 0x4071ad
sub ecx, 1
je 0x407191
sub ecx, 1
jne 0x4071c6
cmp esi, 6
jb 0x4071a2
jne 0x4071bc
cmp edi, 0xf
jae 0x4071bc
jmp 0x4071a2
cmp esi, 5
jb 0x4071a2
jne 0x4071bc
cmp edi, 6
jb 0x4071a2
cmp edi, 0xa
jne 0x4071bc
mov eax, 1
test eax, eax
jne 0x4071c6
jmp 0x4071bc
cmp esi, 6
jb 0x4071c6
jne 0x4071bc
cmp edi, 0x100c
je 0x4071c6
mov dword [0x4265e0], 0x407f20
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a26b
mov esp, ebp
pop ebp
ret