joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405210
Capabilities:
Accept command line arguments
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor eax, eax
push ebp
push 0x4052b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
call fcn.00404f48
test al, al
je 0x40527e
mov eax, dword [0x4077a8]
mov eax, dword [eax]
call fcn.00404e64
test eax, eax
je 0x40527e
push 0x105
lea eax, [ebp - 0x105]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov eax, dword [0x40a7e0]
push eax
call sub.kernel32.dll_GetCommandLineA_1
push eax
lea eax, [ebp - 0x105]
push eax
call dword [0x407798]
mov edx, dword [0x4077a0]
mov dword [edx], eax
call fcn.00404ecc
xor ebx, ebx
test bl, bl
je 0x405299
push 0x10
push 0x4052c8
push 0x4052dc
call sub.user32.dll_GetActiveWindow
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4052c0
mov eax, dword [0x4077a8]
mov eax, dword [eax]
call fcn.00403b24
push eax
call sub.kernel32.dll_DeleteFileA
ret

Function at 0x401670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov eax, 0x4041a4
push esp
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [esp + 2]
mov dword [0x4041a0], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, 3
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [0x404190], eax
mov eax, edi
mov dword [ebp - 0x44], 0x40157b
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.pieta
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push edi
push dword [ebp - 0x38]
push edi
push edi
push 0x190
push 0x258
push 0xffffee08
push 0xffffee6c
push 0
push str.novice
push str.pieta
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x404198], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404198]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x40175a
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x40173f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1059d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1059d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1059d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1059d06a
add dl, dl
jne 0x1059d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1059d0dc
xor eax, eax
add dl, dl
jne 0x1059d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1059d17d
add dl, dl
jne 0x1059d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1059d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1059d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1059d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1059d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1059d075
mov eax, 1
add dl, dl
jne 0x1059d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1059d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1059d0e1
sub eax, ebx
mov ebx, 1
jne 0x1059d128
mov ecx, 1
add dl, dl
jne 0x1059d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1059d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1059d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1059d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1059d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1059d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1059d136
cmp eax, 0x7d00
jae 0x1059d16d
cmp eax, 0x500
jb 0x1059d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1059d075
cmp eax, 0x7f
ja 0x1059d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1059d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1059d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1059d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x924a
push 0
push 0x40
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x924a
push 0
push 0
push 0xf003f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x924a
mov esi, eax
push 0x403020
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x401070
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor eax, eax
pop esi
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x401c66
pop dword [ebp - 0x18]
mov eax, 0x953b0abd
add eax, 0x6b0511a9
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x279fa508
add dword [ebp - 0x28], 0x26b2a043
mov dword [ebp - 0x24], 0xd60bea08
sub dword [ebp - 0x24], 0xa3d89dc3
mov dword [ebp - 0x20], 0xb625120c
sub dword [ebp - 0x20], 0x69d8cdde
mov dword [ebp - 0x1c], 0xd8f132b3
sub dword [ebp - 0x1c], 0xd8f132b3
lea eax, [ebp - 0x28]
push eax
mov eax, 0xa80befe3
add eax, 0x58344071
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x62839468
add dword [ebp - 0x28], 0x11eed4ee
mov dword [ebp - 0x24], 0x44c23751
add dword [ebp - 0x24], 0xfcaa2a24
mov dword [ebp - 0x20], 0x87ca2a4f
add dword [ebp - 0x20], 0xdba5421d
mov dword [ebp - 0x1c], 0x8033c61a
sub dword [ebp - 0x1c], 0x8033c61a
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3d6c2
push 0
call eax
mov ecx, 0x551c8646
add ecx, 0xaae3dd7e
xor ebx, ebx
add ebx, eax
mov edi, 0x73c0bbf8
sub edi, 0x73804bf8
add edi, dword [ebp - 0x18]
mov edx, 0xb376afeb
sub edx, 0x93c6875c
add dword [ebp - 8], 0xc5b15897
mov esi, dword [edi]
add dword [ebp - 8], ebx
sub esi, edx
mov dword [ebp - 0x10], 0x835ec6d
mov dword [ebx], esi
xor dword [ebp - 0xc], edx
add ebx, 0xe2f3755b
sub ebx, 0xe2f37557
add edi, 0x4500a25a
add edi, 0xbaff5daa
loop 0x401d85
add eax, 0xaffc4c2b
add eax, 0x500535b8
mov ebx, eax
add eax, 0x6c19a70a
sub eax, 0x6c19a705
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40611c
pop dword [ebp - 0x10]
mov eax, 0x2fb168c7
sub eax, 0x2f7107ab
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1c82d977
add dword [ebp - 0x20], 0x31cf6bd4
mov dword [ebp - 0x1c], 0x51a7688
add dword [ebp - 0x1c], 0x2d18d5bd
mov dword [ebp - 0x18], 0x999ae3e2
sub dword [ebp - 0x18], 0x4d4e9fb4
mov dword [ebp - 0x14], 0x3fd566ec
sub dword [ebp - 0x14], 0x3fd566ec
lea eax, [ebp - 0x20]
push eax
mov eax, 0x3f0cb1bd
add eax, 0xc133bea3
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x4a000a80
add dword [ebp - 0x20], 0x2a725ed6
mov dword [ebp - 0x1c], 0x7fb94a0a
add dword [ebp - 0x1c], 0xc1b3176b
mov dword [ebp - 0x18], 0x46c4673d
sub dword [ebp - 0x18], 0xe354fad1
mov dword [ebp - 0x14], 0xa1a2fbde
add dword [ebp - 0x14], 0x5e5d0422
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x38aa7
push 0
call eax
mov ecx, 0x3a20fbd9
sub ecx, 0x3a20ab9e
mov edi, eax
mov esi, 0x3a312856
sub esi, 0x39f02856
add esi, dword [ebp - 0x10]
mov ebx, 0xcdae13eb
add ebx, 0xb427c5f8
xor dword [ebp - 4], edi
mov edx, dword [esi]
add dword [ebp - 8], 0xcdb0092d
xor edx, ebx
sub dword [ebp - 8], 0x35d28fc9
mov dword [edi], edx
xor dword [ebp - 8], ebx
add edi, 4
add esi, 4
loop 0x406239
add eax, 0x133bf
xor ebx, ebx
add ebx, eax
add eax, 0x120f9a8e
sub eax, 0x120f9a89
mov ecx, 0x8f7a5904
add ecx, 0x70c5a6fc
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4053b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1
je 0x406949
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x54], 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], eax
or eax, 1
mov dword [0x4c7488], 0
push 0x43b74c
mov dword [0x4c7480], eax
mov dword [0x4c7490], 0
mov dword [0x4c7494], 1
call fcn.00422ea0
add esp, 4
jmp 0x4053cf

Function at 0x4053f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 0x2c], 1
call fcn.00420f16
mov edx, eax
mov dword [esp + 0x30], eax
add esp, 4
test edx, edx
je 0x406ac1
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x4c], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x48], 1
mov dword [esp + 0x14], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x58], eax
jmp 0x4054bd

Function at 0x4055e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [esi - 0x77], al
je 0x405612
and byte [ebx - 0x7af0fe02], al
jne 0x4055fc
add byte [eax], al
add byte [ecx + 0xf182444], cl
test al, bh
add al, byte [eax]
add byte [eax + 0x4c72893d], al
add byte [eax], al
jne 0x43ecfb
push dword [ebp + 8]
call fcn.0044c547
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call dword [ebp - 0x75]
in al, dx
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
jne 0x43ed2a
call fcn.0044059c
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0043a250
add esp, 0x14
or eax, 0xffffffff
jmp 0x43edef
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x43ed5a
cmp esi, ebx
jne 0x43ed5a
call fcn.0044059c
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0043a250
add esp, 0x14
or eax, 0xffffffff
jmp 0x43eded
mov dword [ebp - 0x14], 0x42
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
cmp edi, 0x3fffffff
jbe 0x43ed78
in al, dx
inc edx
add byte [eax], al
add byte [ecx + 0x7589e875], cl
loopne 0x43ece9
mov dword [ebp - 0x1c], 0x7fffffff
jmp 0x43ed7e
lea eax, [edi + edi]
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
call dword [ebp + 8]
add esp, 0x10
mov dword [ebp + 0x14], eax
cmp esi, ebx
je 0x43eded
cmp eax, ebx
jl 0x43edde
dec dword [ebp - 0x1c]
js 0x43edab
mov eax, dword [ebp - 0x20]
mov byte [eax], bl
inc dword [ebp - 0x20]
jmp 0x43edbc
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.0044592a
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x43edde
dec dword [ebp - 0x1c]
js 0x43edc8
mov eax, dword [ebp - 0x20]
mov byte [eax], bl
jmp 0x43edd9
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.0044592a
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x43edde
mov eax, dword [ebp + 0x14]
jmp 0x43eded
xor eax, eax
cmp dword [ebp - 0x1c], ebx
mov word [esi + edi*2 - 2], ax
setge al
dec eax
dec eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4057f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x18]
jmp 0x405671

Function at 0x40580e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, ch
add dh, byte [edi - 0x3774ffff]
xor ecx, ecx
jmp 0x405823

Function at 0x405883
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add al, 0
add byte [ebx - 0x97af789], cl

Function at 0x40661e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp esi, 7
jne 0x4066d5
mov eax, dword [ebp + 8]
xor esi, esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [ecx]
mov edx, dword [eax + ecx*4]
movsx eax, word [edx + 8]
cmp eax, 0x47
je 0x406b35
cmp eax, 0x48
je 0x43ee2a
cmp eax, 0x7f
je 0x43ee50
test esi, esi
jne 0x406667
test eax, eax
je 0x406675
cmp eax, 0x40
je 0x406689
lea eax, [ecx + 1]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [esp + 0x40]
jmp 0x406636
mov eax, dword [edx]
cmp eax, 4
jl 0x43ee36
cmp eax, 0x27
jge 0x43ee36
cmp dword [esp + 0x14], 8
je 0x43ee87
cmp dword [esp + 0x20], 1
jne 0x43eea5
mov esi, edi
mov ecx, esi
call fcn.00404dc0
mov dword [esi + 0xc], 9
mov byte [esi], 0
cmp byte [esp + 0x51], 0
mov eax, dword [esp + 0x2c]
jne 0x43eec1
cmp byte [esp + 0x50], 0
je 0x43eedc
mov byte [esp + 0x51], 1
dec dword [esp + 0x48]
lea ecx, [esp + 0xe0]
call fcn.00404dc0
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
jmp 0x4054c0
inc esi
jmp 0x40665a
pop ebp
adc byte [edi], cl
test ch, dl
add byte [eax], al
add bh, bh
jne 0x43ee49
lea ecx, [ebp - 0x10]
call fcn.00438998
cmp dword [ebp + 8], ebx
jne 0x43ee70
dec ebp
invalid
call fcn.0044059c
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
add byte [eax], al
call fcn.0043a250
add esp, 0x14
cmp byte [ebp - 4], bl
je 0x43ee66
mov eax, dword [ebp - 8]
and dword [eax + 0x70], 0xfffffffd
mov eax, 0x7fffffff
jmp 0x43ef09
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x43ee42
mov esi, 0x7fffffff
cmp dword [ebp + 0x10], esi
jbe 0x43eea9
call fcn.0044059c
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0043a250
add esp, 0x14
cmp byte [ebp - 4], bl
je 0x43eea5
mov eax, dword [ebp - 8]
and dword [eax + 0x70], 0xfffffffd
mov eax, esi
jmp 0x43ef09
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], ebx
jne 0x43eece
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.0044c5d0
add esp, 0xc
cmp byte [ebp - 4], bl
pop ebp
cld
je 0x43ef09
mov ecx, dword [ebp - 8]
and dword [ecx + 0x70], 0xfffffffd
jmp 0x43ef09
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0043d62e
inc dword [ebp + 8]
mov esi, eax
movzx eax, byte [edi]
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0043d62e
add esp, 0x10
inc edi
dec dword [ebp + 0x10]
je 0x43ef01
invalid
cmp esi, ebx
je 0x43ef01
cmp esi, eax
je 0x43eece
sub esi, eax
mov eax, esi
jmp 0x43eec0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414d39
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, eax
cmp esi, ebx
jne 0x414d5e
push ebx
push ebx
push 2
xor ecx, ecx
pop eax
call fcn.004162f3
xor al, al
jmp 0x414e03
call fcn.0041472a
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push ebx
push esi
call fcn.0043d411
push esi
call fcn.0043d319
push ebx
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0043d411
mov eax, dword [ebp - 4]
add esp, 0x1c
cmp eax, ebx
jg 0x414d95
push ebx
push ebx
push 0xc
jmp 0x414d4f
inc eax
push eax
call fcn.00435804
push dword [ebp + 8]
mov esi, eax
push 1
push dword [ebp - 4]
mov byte [esi], bl
push esi
call fcn.0043d043
add esp, 0x14
cmp eax, 1
je 0x414dbf
push esi
call fcn.004394ea
pop ecx
jmp 0x414d4b
mov edx, dword [ebp - 4]
mov byte [esi + edx], bl
mov ecx, esi
mov eax, esi
cmp byte [esi], bl
je 0x414de8
mov dl, byte [ecx]
cmp dl, 0xd
jne 0x414de0
mov byte [eax], 0xa
inc eax
inc ecx
cmp byte [ecx], 0xa
jne 0x414de4
jmp 0x414de3
mov byte [eax], dl
inc eax
inc ecx
cmp byte [ecx], bl
jne 0x414dcd
push ebx
push ebx
mov byte [eax], bl
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 8]
push esi
call fcn.004394ea
xor eax, eax
cmp byte [edi + 0x44], bl
pop ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4214f4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x421509
xor eax, eax
jmp 0x4215dd
push ebx
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [fcn.0045822c]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
jne 0x421534
xor eax, eax
jmp 0x4215dc
push esi
mov esi, dword [0x45811c]
push edi
lea eax, [ebp + 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 4], edi
mov dword [ebp + 8], edi
call esi
test eax, eax
je 0x4215d2
cmp dword [ebp + 8], 2
jne 0x4215d2
mov eax, 0x5a4d
cmp word [ebp - 4], ax
jne 0x4215d2
push edi
push edi
push 0x3c
push ebx
mov ebx, dword [0x458118]
call ebx
push edi
lea eax, [ebp + 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call esi
test eax, eax
je 0x4215cd
cmp dword [ebp + 8], 2
jne 0x4215cd
movzx eax, word [ebp - 4]
push edi
push edi
push eax
push dword [ebp - 8]
call ebx
push edi
lea eax, [ebp + 8]
push eax
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 8]
push eax
push edi
call esi
test eax, eax
je 0x4215ca
cmp dword [ebp + 8], 4
jne 0x4215ca
cmp dword [ebp - 0xc], 0x4550
push edi
jne 0x4215d3
call dword [fcn.0045827c]
xor eax, eax
inc eax
jmp 0x4215db
push edi
jmp 0x4215d3
push dword [ebp - 8]
jmp 0x4215d3
push ebx
call dword [fcn.0045827c]
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret

Function at 0x432d29
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
push edi
xor edi, edi
and edx, 7
cmp ecx, 5
jae 0x432d48
xor eax, eax
jmp 0x432e4b
sub ecx, 4
add ecx, eax
push ebx
mov dword [ebp - 4], ecx
push esi
lea esi, [edi + eax]
jmp 0x432d62
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x432d67
inc esi
cmp esi, dword [ebp - 4]
jb 0x432d57
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, eax
sub edi, eax
cmp esi, dword [ebp - 4]
jae 0x432e35
cmp ecx, 2
jbe 0x432e03
xor edx, edx
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x432e2a
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
add edi, 5
mov ebx, ecx
sub ebx, edi
test edx, edx
je 0x432de0
and edx, 6
shl edx, 2
mov ecx, edx
mov eax, ebx
shr eax, cl
mov dword [ebp - 8], ecx
inc eax
test al, 0xfe
jne 0x432ddb
mov eax, 0x100
shl eax, cl
dec eax
xor ebx, eax
sub ebx, edi
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, ebx
shr ecx, 8
mov byte [esi + 1], bl
mov byte [esi + 2], cl
mov ecx, ebx
shr ebx, 0x18
shr ecx, 0x10
and bl, 1
neg bl
mov byte [esi + 3], cl
mov byte [esi + 4], bl
jmp 0x432d52
shr edx, cl
test edx, edx
je 0x432d85
cmp edx, 4
ja 0x432e2a
cmp edx, 3
je 0x432e2a
mov ecx, edx
shr ecx, 1
movzx ecx, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
jne 0x432d85
or edx, 8
shr edx, 1
inc edi
jmp 0x432d52
push 2
pop eax
shr edx, cl
cmp eax, ecx
mov ecx, dword [ebp + 0xc]
sbb eax, eax
not eax
and eax, edx
pop esi
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
leave
ret
Function at 0x43766e
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x452f0a
call fcn.0043f7ed
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x437780
cmp byte [esi + 0x42], bl
je 0x437780
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x4376aa
xor al, al
jmp 0x437782
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.004363e2
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004361e4
mov ecx, eax
call fcn.00435cc7
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004361e4
mov ecx, eax
call fcn.00435cc7
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x43771a
dec eax
je 0x43771e
dec eax
dec eax
je 0x43777c
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402013
mov al, bl
jmp 0x437782
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004361e4
mov ecx, eax
call fcn.00435cc7
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x43775e
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004361e4
mov ecx, eax
call fcn.00435cc7
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0044217d
add esp, 0x10
cmp edi, eax
jne 0x437708
cmp byte [esi + 0x42], 0
je 0x43777c
test edi, edi
jne 0x4376b8
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00403d11
jmp 0x4376b8
mov bl, 1
jmp 0x43770a
mov al, 1
call fcn.0043f870
ret
Function at 0x10033b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10033b3f
pop dword [ebp - 0x4c]
mov eax, 0xebdddacb
add eax, 0x24256074
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x38e23f02
add dword [ebp - 0x5c], 0x15700649
mov dword [ebp - 0x58], 0x3d58090e
sub dword [ebp - 0x58], 0xb24bcc9
mov dword [ebp - 0x54], 0x32e397dd
add dword [ebp - 0x54], 0x1968ac51
mov dword [ebp - 0x50], 0xde550f6f
sub dword [ebp - 0x50], 0xde550f6f
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x410a0508
add eax, 0xcef9db74
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xd909f291
sub dword [ebp - 0x5c], 0x6497893b
mov dword [ebp - 0x58], 0xa616031f
sub dword [ebp - 0x58], 0x64a9a1aa
mov dword [ebp - 0x54], 0x72d4b6a2
add dword [ebp - 0x54], 0xf09ab5ca
mov dword [ebp - 0x50], 0x7552279e
add dword [ebp - 0x50], 0x8aadd862
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x43a53
push 0
call eax
mov ecx, 0x91987241
sub ecx, 0x91981229
xor edi, edi
add edi, eax
mov edx, 0xd16a5c6c
add edx, 0x3e9cb594
add edx, dword [ebp - 0x4c]
mov esi, 0x21e671a4
add esi, 0xe9b5c0ff
add dword [ebp - 4], esi
mov ebx, dword [edx]
sub dword [ebp - 4], 0x8c3f4b01
xor ebx, esi
mov dword [ebp - 0x1c], 0xcf5ba291
mov dword [edi], ebx
xor dword [ebp - 0x34], 0xbd1b99ed
add edi, 0xc7f56080
add edi, 0x380a9f84
add edx, 0xac2b030
add edx, 0xf53d4fd4
loop 0x10033c5e
add eax, 0x17333
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x668ec368
add ecx, 0xa9713c98
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret