joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4edb66fa
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x4edb671d
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x4edb6743
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x4edb672a
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x4edb67ee
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4edb6825
push esi
call fcn.4edbc03b
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4edb681e
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x4edb68a4
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4edb688e
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x4edb6848
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x4edb6887
cmp eax, 2
je 0x4edb688e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4edb683e
cmp eax, 3
je 0x4edb686b
cmp eax, 1
jne 0x4edb683e
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x4edb683e
mov eax, dword [ecx + 8]
mov edx, dword [esi + 0x144]
add eax, edx
mov dword [ecx + 8], eax
jmp 0x4edb683e
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.4edb66fa
pop esi
pop ebp
ret 4
cmp ecx, 0xcc
je 0x4edb68bb
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.4edb66fa
pop esi
pop ebp
ret 4

Function at 0x4edc8991
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, edx
mov edx, dword [eax + 0x1c]
mov edi, dword [ebx + 0x1c]
mov eax, dword [eax + 0xf4]
push edx
mov esi, ecx
shl edi, 3
push eax
lea ecx, [edi + edi]
push esi
mov dword [ebp - 8], edi
call fcn.4edc874e
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x4edc8a12
mov ebx, dword [ebp + 8]
mov edx, esi
sub ebx, esi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], eax
mov ecx, dword [ebx + edx]
mov eax, dword [edx]
xor esi, esi
test edi, edi
jbe 0x4edc8a03
mov edi, edi
movzx edx, byte [eax + 1]
movzx ebx, byte [eax]
add edx, esi
add ebx, edx
sar ebx, 1
mov byte [ecx], bl
inc ecx
xor esi, 1
add eax, 2
dec edi
jne 0x4edc89e1
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add edx, 4
dec eax
mov dword [ebp - 4], edx
mov dword [ebp + 8], eax
jne 0x4edc89d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4edc8aed
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax + 0x1c]
mov edi, dword [esi + 0x1c]
mov eax, dword [eax + 0xf4]
push edx
mov ebx, ecx
shl edi, 3
push eax
lea ecx, [edi + edi]
push ebx
mov dword [ebp - 0x14], edi
call fcn.4edc874e
mov esi, dword [esi + 0xc]
xor ecx, ecx
test esi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], esi
jle 0x4edc8b98
mov edx, ebx
mov dword [ebp - 0xc], edx
test edi, edi
mov eax, dword [ebp + 8]
mov esi, dword [eax + ecx*4]
mov eax, dword [edx]
mov dword [ebp - 4], 1
jbe 0x4edc8b87
mov ecx, dword [edx + 4]
sub ecx, eax
mov dword [ebp - 8], edi
movzx edi, byte [eax + ecx]
movzx edx, byte [ecx + eax + 1]
mov ebx, dword [ebp - 4]
add edx, edi
movzx edi, byte [eax + 1]
add edi, ebx
movzx ebx, byte [eax]
add edi, edx
mov edx, dword [ebp - 8]
add ebx, edi
sar ebx, 2
mov byte [esi], bl
mov ebx, dword [ebp - 4]
xor ebx, 3
inc esi
add eax, 2
dec edx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edx
jne 0x4edc8b48
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add edx, 8
inc ecx
cmp ecx, eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jl 0x4edc8b2d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5c9d80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17a000]
push edi
jmp 0x5c9d9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c9da1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c9d90
mov eax, 1
add ebx, ebx
jne 0x5c9db3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c9dc4
jne 0x5c9de3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c9de3
dec eax
add ebx, ebx
jne 0x5c9dd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5c9da8
add ebx, ebx
jne 0x5c9ddf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5c9e35
xor ecx, ecx
sub eax, 3
jb 0x5c9dfb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c9e6a
sar eax, 1
mov ebp, eax
jmp 0x5c9e06
add ebx, ebx
jne 0x5c9e06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c9dd4
inc ecx
add ebx, ebx
jne 0x5c9e14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c9dd4
add ebx, ebx
jne 0x5c9e21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c9e16
jne 0x5c9e32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c9e16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c9e54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c9e46
jmp 0x5c9d96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c9e54
add edi, ecx
jmp 0x5c9d96
pop esi
mov edi, esi
mov ecx, 0x15b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c9e72
cmp byte [edi], 0x11
jne 0x5c9e72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c9e77
lea edi, [esi + 0x1c4000]
mov eax, dword [edi]
or eax, eax
je 0x5c9eef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ef8cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1efa34]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c9ea4
mov ecx, edi
jns 0x5c9ed3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1efa38]
or eax, eax
je 0x5c9ee9
mov dword [ebx], eax
add ebx, 4
jmp 0x5c9ec1
call dword [esi + 0x1efa48]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5c9f20
cmp al, 0xef
ja 0x5c9f13
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5c9ef5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5c9f02
mov ebp, dword [esi + 0x1efa3c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5c9f54
sub esp, 0xffffff80
jmp 0x418db7
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100080d6
pop dword [ebp - 0x34]
mov eax, 0xe251745f
sub eax, 0xd250f389
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3cbaa
push 0
mov eax, 0x6c7be81f
add eax, 0xa3855845
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x553442f8
sub ecx, 0x5533ec10
mov esi, eax
mov edx, 0xa5926b8e
add edx, 0x6a6f1a72
add edx, dword [ebp - 0x34]
mov ebx, 0x5f6cbfa0
add ebx, 0x12c0b8d5
xor dword [ebp - 0x10], ecx
mov edi, dword [edx]
sub dword [ebp - 8], esi
xor edi, ebx
sub dword [ebp - 0xc], 0xa39a2ad0
mov dword [esi], edi
xor dword [ebp - 0x1c], esi
add esi, 0x98114e53
add esi, 0x67eeb1b1
add edx, 0x237a34cb
add edx, 0xdc85cb39
loop 0x10008135
add eax, 0x42428116
add eax, 0xbdbecd5d
xor ebx, ebx
add ebx, eax
add eax, 0x6bfc8e7
sub eax, 0x6bfc8e2
mov ecx, 0x7b1ffd33
sub ecx, 0x6b1ffd33
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4029ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x2c6008], 0x8088405
inc edx
mov dword [ebx + 0x2c6008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41c164
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41c195
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c17d
add dl, dl
jne 0x41c1a0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c1f1
xor eax, eax
add dl, dl
jne 0x41c1ad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c28e
add dl, dl
jne 0x41c1bc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c1c7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c1d2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c1dd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41c1e7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41c18c
mov eax, 1
add dl, dl
jne 0x41c1ff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c20a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c1f6
sub eax, ebx
mov ebx, 1
jne 0x41c23d
mov ecx, 1
add dl, dl
jne 0x41c223
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c22e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c21a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c18c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41c254
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c25f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c24b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c18c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41c2af
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41c18c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d9a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x2ada63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41da55
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41da3e
test esi, esi
jbe 0x41da55
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407ce4
test eax, eax
jne 0x41da30
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41da55
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41da0d
jmp 0x41da55
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41da55
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2ada6a
ret
Function at 0x41e2c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x2ae473
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004040d0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e2ff
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e318
lea eax, [ebp - 0x10]
mov edx, dword [0x2c82a4]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404130
jmp 0x41e32b
lea eax, [ebp - 0x10]
mov edx, dword [0x2c82a4]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404130
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41e337
adc edx, 0
mov edx, dword [edx*4 + 0x2c710c]
call fcn.00404320
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404304
push eax
call fcn.00405f1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41e445
mov eax, 0x40
call fcn.00402668
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.0040617c
test eax, eax
je 0x41e438
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41e438
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.004061dc
mov eax, edi
call fcn.00402688
mov eax, 0x18
call fcn.00402668
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.0040617c
test eax, eax
je 0x41e438
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41e438
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41e438
cmp dx, 0x150
ja 0x41e438
mov eax, edi
call fcn.00402688
mov eax, 0xe0
call fcn.00402668
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.0040617c
test eax, eax
je 0x41e438
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41e438
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.0040410c
mov eax, edi
call fcn.00402688
push esi
call fcn.00405ed4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040442c
jne 0x41e45d
inc ebx
cmp ebx, 0x19
jne 0x41e2f1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2ae47a
lea eax, [ebp - 0x10]
call fcn.004040d0
ret
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.2983bc8e
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2983bc8e
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.2983bc8e
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2983bc8e
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2983bc8e
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2983bc8e
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2983bc8e
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x2983bc8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x2983bc9d
pop dword [ebp - 0x28]
mov eax, 0x92076526
add eax, 0x977c5777
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x6c8503b0
add dword [ebp - 0x38], 0xe1cd419b
mov dword [ebp - 0x34], 0xcd5ead74
sub dword [ebp - 0x34], 0x9b2b612f
mov dword [ebp - 0x30], 0xef28058
add dword [ebp - 0x30], 0x3d59c3d6
mov dword [ebp - 0x2c], 0x79cd46a2
add dword [ebp - 0x2c], 0x8632b95e
lea eax, [ebp - 0x38]
push eax
mov eax, 0x28de0567
add eax, 0xa76b59
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xee330ca9
add dword [ebp - 0x38], 0x863f5cad
mov dword [ebp - 0x34], 0x867530f7
add dword [ebp - 0x34], 0xbaf7307e
mov dword [ebp - 0x30], 0xa37236e9
add dword [ebp - 0x30], 0xbffd3583
mov dword [ebp - 0x2c], 0xce99235c
sub dword [ebp - 0x2c], 0xce99235c
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x800ca144
sub eax, 0x5687308c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x472b8
push 0
call eax
mov ecx, 0x44a8
xor esi, esi
add esi, eax
mov edi, 0x32a9837b
add edi, 0xf6dfe085
add edi, dword [ebp - 0x28]
mov ebx, 0x38cb7e00
sub ebx, 0x69d7291c
mov dword [ebp - 0xc], 0xdca76af
mov edx, dword [edi]
xor edx, ebx
xor dword [ebp - 0x20], ecx
mov dword [esi], edx
add esi, 0xe3913e29
sub esi, 0xe3913e25
add edi, 0x6acb209f
add edi, 0x9534df65
loop 0x2983bdbb
add eax, 0x10573
mov ebx, eax
add eax, 0x223b5edc
sub eax, 0x223b5ed7
mov ecx, 0xff425df9
sub ecx, 0xd5c25df9
add ecx, dword [ebp - 0x28]
call ebx
leave
ret