joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fbe4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00410fd8
test byte [ebp + 0xd], 0xc0
jne 0x40fc08
mov eax, dword [0x444124]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x40fc15
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40fc42
je 0x40fc54
sub ecx, 0x100
je 0x40fc62
sub ecx, 0x100
je 0x40fc69
sub ecx, 0x100
je 0x40fc5b
jmp 0x40fc70
sub ecx, 0x600
je 0x40fc69
sub ecx, 0x100
je 0x40fc54
jmp 0x40fc70
mov edi, 1
jmp 0x40fc75
mov edi, 2
jmp 0x40fc75
mov edi, 4
jmp 0x40fc75
mov edi, 5
jmp 0x40fc75
mov edi, 3
test byte [ebp + 0xd], 1
je 0x40fc9c
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x443b90]
test al, 0x80
je 0x40fc95
mov ebx, 0x80
jmp 0x40fcae
mov ebx, 1
jmp 0x40fcae
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40fcae
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40fcc0
je 0x40fcc9
dec eax
je 0x40fcd2
jmp 0x40fcdb
mov dword [ebp - 4], connect
jmp 0x40fcea
mov dword [ebp - 4], 0x40000000
jmp 0x40fcea
mov dword [ebp - 4], 0xc0000000
jmp 0x40fcea
push 1
call fcn.004113d0
pop ecx
mov ebx, eax
jmp 0x40fdda
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x40fd06
sub eax, 0x10
je 0x40fd0d
sub eax, 0x10
je 0x40fd16
sub eax, 0x10
je 0x40fd1f
jmp 0x40fd1f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40fd26
mov dword [ebp - 8], 1
jmp 0x40fd26
mov dword [ebp - 8], 2
jmp 0x40fd26
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40fd93
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40fd88
test byte [ebp + 0xd], 1
je 0x40fd83
mov ebx, 0x50
jmp 0x40fd88
mov ebx, 2
push ebx
call fcn.004113d0
pop ecx
mov ebx, eax
jmp 0x40fdda
mov edi, esi
push edi
call fcn.0040fb48
pop ecx
test eax, eax
je 0x40fda7
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40fdb3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004110f8
add esp, 8
mov ebx, eax
inc eax
jne 0x40fdda
push 4
call fcn.004113d0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0041100c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410298
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x4102b4
call fcn.0041143c
jmp 0x410323
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x4102d0
call fcn.0041143c
jmp 0x410323
cmp dword [0x449c50], 1
je 0x410321
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.004152f0
pop ecx
cmp al, 0x41
jl 0x410321
cmp al, 0x5a
jg 0x410321
cmp byte [ebp - 0x107], 0x3a
jne 0x410321
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x410321
call fcn.0041143c
jmp 0x410323
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x410d78
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.0040c704
pop ecx
mov ebx, eax
test eax, eax
jne 0x410d9c
xor eax, eax
jmp 0x410e45
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x410dbd
cmp esi, 0x104
jb 0x410dc8
push ebx
call fcn.0040c714
pop ecx
xor eax, eax
jmp 0x410e45
cmp byte [ebx + 1], 0x3a
jne 0x410df8
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x410df8
push ebx
call fcn.0040c714
pop ecx
xor eax, eax
jmp 0x410e45
inc esi
test edi, edi
je 0x410e3b
cmp esi, dword [ebp + 0x10]
jbe 0x410e0d
push ebx
call fcn.0040c714
pop ecx
xor eax, eax
jmp 0x410e45
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.0040c714
pop ecx
mov eax, edi
jmp 0x410e45
push esi
push ebx
call fcn.0040c724
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x410e94
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x410eda
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x410ec8
cmp eax, dword [ebp + 0x10]
jle 0x410f63
call fcn.00415470
mov dword [eax], 8
xor eax, eax
jmp 0x410fd0
cmp dword [0x449c50], 1
jne 0x410f1f
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x410f63
xor eax, eax
jmp 0x410fd0
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x410f5f
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
jmp 0x410f63
xor eax, eax
jmp 0x410fd0
lea edx, [ebp - 0x10c]
push edx
call fcn.0040e6cc
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x410f84
call fcn.00415470
mov dword [eax], 0x22
xor eax, eax
jmp 0x410fd0
test edi, edi
jne 0x410fa7
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040c704
pop ecx
mov edi, eax
test eax, eax
jne 0x410fa7
call fcn.00415470
mov dword [eax], 8
xor eax, eax
jmp 0x410fd0
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415408
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x41546a
call fcn.004153b8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0040e6cc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0040e6cc
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4154e8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4450c4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4155c2
cmp dword [0x4450c0], 0
jne 0x4155c2
cmp dword [0x445340], 0
je 0x41557c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00415298
add esp, 8
mov ebx, eax
test eax, eax
jne 0x415562
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00415298
add esp, 8
mov ebx, eax
test eax, eax
jne 0x415562
lea ebx, [ebp - 0x84]
jmp 0x415563
inc ebx
call fcn.004154a4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4155fd
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4450c8
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0040e6cc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4450cb
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4155fd
cmp dword [0x4450c0], 0
je 0x4155dc
cmp dword [0x4450c0], 0xffffffff
je 0x4155fd
push esi
call dword [0x4450c0]
pop ecx
mov eax, dword [0x4450c4]
test eax, eax
je 0x4155fd
cmp dword [0x4450c4], 0xffffffff
je 0x4155fd
cmp byte [eax], 0
je 0x4155fd
push esi
push eax
call fcn.00415408
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4165fc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x449c68], 0
jne 0x41667d
cmp dword [0x449c88], 0
jne 0x41662c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x449c88], eax
test eax, eax
jne 0x41662c
push str.GetEnvironmentStrings_failed
call fcn.00415614
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x449c88]
jmp 0x416640
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0040e6cc
pop ecx
mov edi, eax
test eax, eax
jne 0x416638
lea edi, [ebp + 1]
push edi
call fcn.0040c704
pop ecx
mov ebx, eax
mov dword [0x449c6c], ebx
test ebx, ebx
jne 0x41666a
xor eax, eax
jmp 0x416740
push edi
mov edx, dword [0x449c88]
push edx
push ebx
call fcn.0040e57c
add esp, 0xc
jmp 0x41669d
xor esi, esi
mov ebx, dword [0x449c68]
jmp 0x416697
push eax
call fcn.0040e6cc
pop ecx
test eax, eax
jne 0x416693
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x416687
lea ebx, [esi + 4]
push 4
mov dword [0x449c70], ebx
inc ebx
push ebx
call fcn.0040c268
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4166c0
xor eax, eax
jmp 0x416740
cmp dword [0x449c68], 0
jne 0x4166f1
xor esi, esi
mov ebx, dword [0x449c6c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4166e2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0040e6cc
pop ecx
mov edi, eax
test eax, eax
jne 0x4166d8
jmp 0x416722
xor esi, esi
mov ebx, dword [0x449c68]
mov eax, dword [esp]
mov edi, eax
jmp 0x41671c
push eax
call fcn.0040e6cc
pop ecx
test eax, eax
je 0x416711
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x416715
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x416700
mov eax, dword [0x449c68]
test eax, eax
je 0x416732
push eax
call fcn.0040c714
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x449c68], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x419790
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.004118dc
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x404a53
Capabilities:
Encrypt data using rc4 prga

Disassembly:
fisttp dword [edx - 0x75]
xchg ecx, eax
pop eax
mov ecx, dword [ebp + 0x4f]
cmp edx, 5
jae 0x404a6f
mov al, byte [ecx]
mov byte [edx + esi + 0x5c], al
inc dword [esi + 0x58]
inc ecx
inc dword [edi]
mov edx, dword [esi + 0x58]
sub ebx, 1
jne 0x404a56
mov dword [ebp + 8], ecx
cmp dword [esi + 0x58], 5
jb 0x404c51
cmp byte [esi + 0x5c], 0
jne 0x7bdc94
movzx ecx, byte [esi + 0x5d]
movzx eax, byte [esi + 0x5e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x5d]
shl ecx, 8
or ebp, ebx
movzx eax, byte [esi + 0x60]
sub dword [ecx + 0x66ecff1c], 0x4c
add cl, al
loope 0x404b0d
or ecx, eax
push esi
pop ax
add byte [ecx + 0x458b204e], cl
clc
xor edx, edx
mov dword [eax], edi
cld
cmp dword [ecx], ecx
and al, 0x72
loope 0x404a4d
inc esi
dec eax
jbe 0x404a86
ror dword [ecx], 0x39
push esi
and byte [edi], cl
cmp byte [eax + 1], 0
add byte [ecx], bh
push ebp
adc byte [ebx + 0xcf8f84], cl
add byte [ebp - 0x567af0f6], al
mov ebp, 0x95336fc3
add byte [ebx], dl
push ebp
wait
adc edi, 0x50
add byte [ebp + edi - 0x13], dh
dec esi
xor dword [eax + 0x300], edi
jle 0x404b06
mov edi, dword [esi + 0x10]
shl eax, cl
lea ecx, [eax + 0xa507a6]
lodsd eax, dword [esi]
add byte [eax + eax], al
add al, 0xd1
add byte [ecx + edx*8], al
jmp 0xc99b1f01
leave
rep stosw word es:[edi], ax
add eax, 0x34
add byte [ebx], dh
ror byte [ebx - 0x7cbff383], 0x66
salc
add byte [ecx + 0x46896646], cl
inc eax
mov dword [esi + 0x3c], eax
js 0x404b70
cmp byte [ebx + 0x4d89584e], cl
invalid
in eax, dx
push ebp
clc
inc ebp
mov ecx, esi
mov dword [eax - 0x7fe631a], edi
invalid
mov eax, dword [ebp + 0x14]
invalid

Function at 0x40c847
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor byte [ebp - 0x47], bh
jge 0x40c808
mov ecx, 0xff2d7400
add byte [ebp + ebp - 1], dh
cwde
or byte [edx], ch
push dword [0xe49812f8]
call dword [0x41959a]
jle 0x40c84e
jne 0x40c87f
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
call 0xb940c717
pop ecx
mov esi, eax
call 0xffcbf7d7
xchg dword [eax], esi
pop esi
pop ebp
stc
mov ebx, dword [edi]
push ebp
cmp eax, 0xc458b3e
cmp ebx, ebx
or byte [esi + 5], dh
add dword [eax - 1], 0x5d
ret

Function at 0x40f023
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x2d41af00
jecxz 0x40f048
scasb al, byte es:[edi]
push ds
add byte [eax - 0x14], ch
xchg edx, eax
inc ecx
mov byte [eax + 8], bh
mov eax, dword [eax - 1]
adc eax, 0xb94193ac
call esi
pop esi
adc eax, edx
add al, 0
pop esi
jmp dword ss:[sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x44a010
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [sym.imp.USER32.dll_GetKeyboardType]
push 1
mov edi, eax
call ebx
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ecx, [esp + 0xc]
mov edi, eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x84feb0
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
call ebx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test edi, edi
je 0x44a08f
mov edx, dword [0x64fd60]
push 0x64fa78
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalWebSite_Maps
push 0
lea eax, [esp + 0x1c]
push 1
push eax
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
pop edi
pop esi
mov dword [0x64fd5c], eax
pop ebx
add esp, 0x14
ret

Function at 0x524e0e
Capabilities:
Encode data using xor

Disassembly:
and byte [edi - 0x4a], dh
jno 0x524de2
dec edi
mov esp, 0x9d449a20
sub al, byte [edx + 0x29]
invalid
cld
scasb al, byte es:[edi]
fcomp dword [edx - 0x5c54ab66]
mov cl, 0x7f
sbb al, byte [ebx + 0x30053dac]
xchg ch, dl
cmp dword [esi - 0x52d95186], eax
ficom dword [eax - 0x34c6118d]
pushfd
mov ah, 0xc9
or al, 0xc9
std
stosb byte es:[edi], al
popfd
test dword [esi + 0x80a7a3a], edi
loopne 0x524e4c
pop ss
in eax, 0xbd
rcr dword [edx + 0x70], 0xcd
mov ebx, 0x2da821b7
mov ecx, 0x3ea70ad1
bound eax, qword [edx - 0xb]
and dword [eax + 0xad1b92d], ebp
cmpsd dword [esi], dword es:[edi]
bound eax, qword ds:[edx - 0xb]
mov dword [eax], ebx
mov cl, 2
mov bl, 0x9e
loope 0x524e86
loopne 0x524e89
jecxz 0x524dc4
or al, 0x68
add byte [ebx + edx], dh
dec edx
pop esp
dec edx
and byte [eax - 0x1d], bh
in al, dx
mov al, 0x8a
shr dword [edx - 0x351f5930], 0xa3
sal byte [ebx], cl
fbld tbyte [ebx - 0x2e96e5dc]
mov al, cl
stosb byte es:[edi], al
shl byte [esi - 0x2d5c3520], 1
xor ebx, edi
mov dword [0xd1691a24], eax
cmpsb byte [esi], byte es:[edi]
loopne 0x524e19
mov dword [0xa3df33d2], eax
and al, 0x1a
imul edx, ecx, 0x96617e88
mov byte [esi + 0x61], bh
xchg esi, eax
sub al, 0x1c
cmp al, 0x84
pop esp
push esi
jo 0x524e48
jo 0x524eb0
arpl word ds:[edx - 0x19589c40], dx
mov al, 0x63
fild dword [ebx - 0x1fed9d0f]
stosb byte es:[edi], al
int1
bound edx, qword [edx]
loopne 0x524e35
sub eax, 0xf08ac2d1
jle 0x524e82
lcall 0x6be6, 0x674f0ef8
salc
mov ah, 0xb4
das
push esi
cld
int1
pop edx
add byte [esp + edi*4], bl
lds ecx, [edx + eax*8]
pushal
not dword [eax]
push esp
or byte [ebx + 0x7107fde4], ch
aad 0x94
jno 0x524e87
Function at 0x5b846d
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x8b
or byte ds:[eax + 0x23], ah
mov edi, 0x83d90e73
dec ecx
call 0xf321fec0
xor eax, 0x87c6a385
scasb al, byte es:[edi]
adc byte [edi - 6], bh
mov al, 0x12
jno 0x5b848c
lodsd eax, dword [esi]
or dl, byte ss:[esi - 0x7a09fad2]
lcall 0x17e3, 0xf8e8265c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4016b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x4231d4
push esi
call fcn.0040a94c
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4016e1
push eax
push dword [ebp + 0xc]
push esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0
push ebx
call fcn.0040af5f
push ebx
call fcn.0040b5b2
mov ecx, dword [sym.imp.tier0.dll_g_pMemAlloc]
mov edi, eax
add esp, 0x10
mov ecx, dword [ecx]
lea edx, [edi + 2]
push edx
mov esi, dword [ecx]
call dword [esi + 4]
lea ecx, [edi + 1]
mov esi, eax
push ecx
push 0
push esi
mov dword [ebp - 4], esi
call fcn.00407550
push ebx
call fcn.0040b9ca
push ebx
push edi
push 1
push esi
call fcn.0040ab49
push 0x20
mov byte [esi + edi], 0
call fcn.00402390
mov ecx, eax
add esp, 0x24
mov eax, dword [ebp + 0xc]
test ecx, ecx
je 0x40174d
push eax
call fcn.00402330
mov esi, eax
mov eax, dword [ebp + 0xc]
jmp 0x40174f
xor esi, esi
mov edi, dword [ebp - 4]
mov ecx, esi
push 0
push 0
push edi
push eax
call fcn.004028f0
push ebx
call fcn.0040a865
mov eax, dword [sym.imp.tier0.dll_g_pMemAlloc]
add esp, 4
mov ecx, dword [eax]
push edi
mov eax, dword [ecx]
call dword [eax + 0x14]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406f51
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406f90
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406f90
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406f90
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406f90
cmp dword [ecx + 0x74], 0xe
jbe 0x406f90
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40b3ab
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00406470
mov eax, dword [0x42b1e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00416be0
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x40b3ed
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x40b549
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00422130
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x42f930]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041885b
mov ecx, dword [esi*4 + 0x42f930]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x40b542
cmp eax, dword [edi + ecx + 0x24]
jne 0x40b542
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b542
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041885b
add esp, 0x14
test edx, edx
jl 0x40b542
jg 0x40b4b8
test eax, eax
jb 0x40b542
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x40b542
jl 0x40b4d2
cmp dword [ebp - 0x1008], eax
ja 0x40b542
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x40b4f0
test ebx, ebx
je 0x40b529
cmp ecx, edi
jae 0x40b529
mov al, byte [ecx]
cmp al, 0xd
jne 0x40b50a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x40b516
cmp byte [ecx + 1], 0xa
jne 0x40b516
inc ecx
jmp 0x40b516
movzx eax, al
movsx eax, byte [eax + 0x42b408]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x40b4f0
cmp edx, ebx
jne 0x40b4f0
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x40b547
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040645c
leave
ret

Function at 0x4161b0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00415cd7