joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c97a3
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x503870]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov eax, dword [0x50a714]
mov edi, dword [0x50b03c]
test eax, eax
je 0x53d072
mov esi, eax
call 0x559a70
push esi
call 0x5600be
add esp, 4
mov ebx, dword [0x50afd4]
push 0x4dd690
call 0x55a5a0
mov ecx, eax
call 0x55a0b0
mov esi, eax
mov eax, dword [0x50a4d4]
test eax, eax
jne 0x53d0af
push 0x4d5570
push 0x4d6680
call fcn.004e4000
add esp, 8
mov dword [0x50a4d4], eax
mov byte [eax + 0x12], 0
push esi
push eax
call 0x53f590
add esp, 8
mov dword [0x50a714], eax
test eax, eax
je 0x53d201
movsx esi, byte [eax + 8]
lea ecx, [esi - 6]
cmp ecx, 1
ja 0x53d0e8
mov ecx, dword [eax]
test ecx, ecx
je 0x53d0e8
mov edx, dword [ecx + 0x18]
mov edx, dword [edx]
mov edi, dword [ecx]
mov ebp, edx
mov byte [esp + 0x30], 0
jmp 0x53d0f1
xor edi, edi
xor ebp, ebp
mov byte [esp + 0x30], 1
add esi, 0xfffffffa
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], edi
cmp esi, 1
ja 0x53d119
mov eax, dword [eax]
test eax, eax
je 0x53d119
mov ecx, dword [eax + 0x18]
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov ebx, ecx
mov byte [esp + 0x4c], 0
jmp 0x53d124
xor ebx, ebx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x4c], 1
cmp byte [esp + 0x30], 0
je 0x53d131
mov al, byte [esp + 0x4c]
jmp 0x53d145
test edi, edi
je 0x53d13b
cmp edi, dword [esp + 0x44]
je 0x53d140
call 0x5846f9
cmp ebp, ebx
sete al
test al, al
jne 0x53d1c7
push 0x50
call 0x56008f
mov esi, eax
add esp, 4
mov dword [esp + 0x54], esi
mov dword [esp + 0x178], 0
test esi, esi
je 0x53d18f
test edi, edi
jne 0x53d18b
call 0x5846f9
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x53d17d
call 0x5846f9
lea eax, [ebp + 0x18]
push eax
push esi
call fcn.004ff0a0
mov esi, eax
jmp 0x53d191
mov eax, dword [edi]
jmp 0x53d173
xor esi, esi
mov dword [esp + 0x178], 0xffffffff
push esi
call fcn.005131b0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
call fcn.00500a80
mov dword [eax], esi
lea esi, [esp + 0x28]
call 0x55c040
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
jmp 0x53d124
mov dword [esp + 0x24], 0
mov dword [esp + 0x178], 1
push 0
call dword [0x4cd6fc]
test eax, eax
jge 0x53d21a
mov dword [esp + 0x178], 0xffffffff
mov eax, dword [esp + 0x24]
test eax, eax
je 0x53d201
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor al, al
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [esp + 0x24]
call fcn.004f73e0
test eax, eax
jl 0x53d1e6
mov eax, dword [esp + 0x24]
mov byte [esp + 0x17], 1
test eax, eax
jne 0x53d23e
Function at 0x401200
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
dec edx
bswap esi
dec edx
sbb edx, 0x5f
not edi
ror esi, 0x8c
sbb esi, 0xf1
inc ebx
rcl edx, 0x31
mov edi, 0xd3
add ebx, 0x61
rol ebx, 0xdc
neg edi
neg edi
rcl ebx, 0xd1
dec esi
bswap esi
sub esi, 0x61
dec edi
bswap eax
inc esi
rcr eax, 0x18
sub eax, 0x57
sbb eax, 4
dec ebx
dec esi
sub edi, 0x4a
ror edi, 0x28
imul edx
dec edi
add esi, 0x92
imul esi
or eax, 0x2b
add eax, 0xb9
or edi, 0xe7
not edi
add edx, 0xbc
imul esi
add edi, 0x75
rcr ebx, 0x1d
rol edi, 0x9f
rol ebx, 0xc0
or ebx, 0xea
not edi
inc edi
sbb eax, 0xe2
imul edx
ror esi, 0xc
rol ebx, 0x9d
not edx
xor ecx, ecx
xor edi, edi
and edi, 0x8e
and edx, 0xdf
imul eax
dec eax
inc esi
or ebx, 0x4d
bswap ebx
sbb ebx, 0x57
inc eax
sbb ebx, 0x24
bswap ebx
sub esi, 0x46
rcl esi, 0x3f
mov esi, 0x3c
ror eax, 0xbf
bswap eax
neg edi
neg edi
rol edi, 0xeb
neg eax
neg edx
dec eax
mov esi, 0x47
imul edi
rcr esi, 0xe3
inc edi
not ebx
or edi, 0x75
add ebx, 0x9c
imul edx
bswap edi
dec eax
imul ebx
not edx
bswap ebx
not ebx
imul ebx
dec ebx
not esi
dec edx
and edx, 0x66
bswap eax
dec eax
not ebx
rcl edx, 9
not eax
or edx, 0xe0
rcr edx, 0x84
neg eax
inc ebx
mov ecx, dword [ebp + 0xc]
and ebx, 0x50
imul ebx
bswap edi
ror eax, 0x22
add esi, 0xe4
bswap ebx
or edx, 0xde
ror esi, 0xec
imul esi
ror eax, 0x5e
rol edi, 0x35
sub eax, 0x37
imul esi
rcr eax, 0x84
and ebx, 0xbf
sbb esi, 0x4b
inc ebx
bswap edx
imul edx
sbb edi, 0x2d
ror edx, 0x3c
neg edi
sbb edx, 0x74
rcr ebx, 8
not esi
bswap eax
sbb eax, 0x46
ror esi, 0xeb
not esi
inc edi
mov ebx, 0x9a
dec esi
mov edx, 0x73
sbb ebx, 0xba
and eax, 0xc7
dec ebx
or edx, 8
not edx
sub edi, 0x5f
dec eax
dec ebx
dec eax
neg edx
not eax
bswap edi
rcr edi, 0xf8
neg esi
dec eax
neg eax
rol ebx, 0x4f
mov edi, dword [ebp + 8]
xor eax, ebx
xor eax, eax
xor ebx, esi
not byte [edi]
xor eax, eax
xor eax, ebx
xor esi, eax
mov esi, esi
mov ebx, esi
mov eax, esi
xor eax, esi
mov eax, esi
xor ebx, eax
add byte [edi], 0x87
xor esi, ebx
xor esi, eax
xor ebx, esi
mov ebx, ebx
xor esi, eax
xor esi, esi
mov esi, eax
xor esi, ebx
mov eax, ebx
sub byte [edi], 0x54
mov eax, esi
xor eax, esi
xor esi, eax
xor eax, ebx
mov eax, eax
xor esi, esi
xor esi, eax
xor eax, ebx
mov esi, ebx
imul byte [edi]
inc edi
loop 0x4013a3
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407895
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432600]
jne 0x40789f
repz ret
jmp fcn.00409c30
Function at 0x407f05
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406cb5
and dword [ebp - 4], 0
cmp dword [0x433790], 0
mov ebx, eax
jne 0x407fb6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408067
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408067
push eax
call fcn.00406c43
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x433790], eax
call esi
push eax
call fcn.00406c43
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433794], eax
call esi
push eax
call fcn.00406c43
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433798], eax
call esi
push eax
call fcn.00406c43
pop ecx
mov dword [0x4337a0], eax
test eax, eax
je 0x407fb6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406c43
pop ecx
mov dword [0x43379c], eax
mov eax, dword [0x43379c]
cmp eax, ebx
je 0x40800e
cmp dword [0x4337a0], ebx
je 0x40800e
push eax
call fcn.00406cbe
push dword [0x4337a0]
mov esi, eax
call fcn.00406cbe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40800e
test edi, edi
je 0x40800e
call esi
test eax, eax
je 0x408005
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408005
test byte [ebp - 0xc], 1
jne 0x40800e
or dword [ebp + 0x10], 0x200000
jmp 0x408047
mov eax, dword [0x433794]
cmp eax, ebx
je 0x408047
push eax
call fcn.00406cbe
pop ecx
test eax, eax
je 0x408047
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408047
mov eax, dword [0x433798]
cmp eax, ebx
je 0x408047
push eax
call fcn.00406cbe
pop ecx
test eax, eax
je 0x408047
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433790]
call fcn.00406cbe
pop ecx
test eax, eax
je 0x408067
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408069
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aa55
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [0x41458c], 0
je 0x40aa75
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov dword [0x41458c], 1
push 0x40
mov eax, 0x4121c8
add eax, 0x154
push eax
mov eax, 0x4121c8
add eax, 0x192
push eax
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
jmp 0x40aaa4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40af0b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x54], 0
push 1
lea eax, [ebp - 0x54]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0xc]
shl eax, 2
cmp dword [eax + eax*4 + 0x412648], 0xffffffff
je 0x40af5a
inc dword [ebp - 0xc]
jmp 0x40af3e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
shl ecx, 2
mov dword [ecx + ecx*4 + 0x412648], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
shl ecx, 2
mov dword [ecx + ecx*4 + 0x412650], eax
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 0x50]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
lea eax, [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 4]
xor eax, dword [ecx + 0x10]
mov ecx, dword [ebp - 0xc]
shl ecx, 2
mov dword [ecx + ecx*4 + 0x412654], eax
test dword [ebp - 0x4c], 0xffff
jne 0x40afdd
mov eax, dword [ebp - 0xc]
shl eax, 2
mov dword [eax + eax*4 + 0x412650], 4
mov eax, dword [ebp - 0xc]
shl eax, 2
cmp dword [eax + eax*4 + 0x412650], 4
je 0x40b00a
push 0
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
jmp 0x40b01f
push 0
push 0
mov eax, dword [ebp - 8]
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
jmp 0x40b024
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b029
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0040b12c
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b063
jmp 0x40b122
mov eax, dword [ebp - 4]
sub eax, 0x40
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040b12c
add esp, 0x14
test eax, eax
jne 0x40b094
jmp 0x40b11d
mov dword [ebp - 0x14], 0
jmp 0x40b0a3
inc dword [ebp - 0x14]
mov eax, dword [ebp - 4]
sub eax, 0x40
cmp eax, dword [ebp - 0x14]
jbe 0x40b0d2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dl, byte [eax + ecx + 0x40]
mov al, byte [edx + 0x4123f8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov byte [ecx + edx], al
jmp 0x40b0a0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x40b127
jmp 0x40b0d2
jmp 0x40b0d2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b12c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 0x18], 0
je 0x40b14b
mov dword [ebp - 0x14], 0xc0000000
jmp 0x40b152
mov dword [ebp - 0x14], 0x80000000
cmp dword [ebp + 0x18], 0
je 0x40b168
mov dword [ebp - 0xc], 2
jmp 0x40b16f
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x40b185
mov dword [ebp - 4], 2
jmp 0x40b18c
mov dword [ebp - 4], 3
cmp dword [ebp + 0x18], 0
je 0x40b1a2
mov dword [ebp - 0x10], 4
jmp 0x40b1a9
mov dword [ebp - 0x10], 2
cmp dword [ebp + 0x18], 0
je 0x40b1bf
mov dword [ebp - 8], 2
jmp 0x40b1c6
mov dword [ebp - 8], 4
push 0
push 0x80
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x40b1fd
xor eax, eax
jmp 0x40b298
push 0
mov eax, dword [ebp + 0x18]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x40b23b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x40b298
mov eax, dword [ebp + 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x40b283
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x40b298
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
jmp 0x40b298
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b29d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x5c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
push 1
lea eax, [ebp - 0x60]
push eax
push 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [ebp - 4], eax
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 0x64]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b420
cmp dword [ebp - 0x64], 0x40
jne 0x40b420
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
sub eax, 0x46534252
cmp eax, 1
sbb eax, eax
neg eax
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
je 0x40b41b
mov eax, dword [0x4121d8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x14]
cmp dword [eax + 0x30], ecx
jne 0x40b41b
mov dword [ebp - 0x14], 0
jmp 0x40b36d
inc dword [ebp - 0x14]
mov eax, dword [0x414588]
cmp dword [ebp - 0x14], eax
jge 0x40b3b7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x414c48]
push eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40b39d
jmp 0x40b3b7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x414c48]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
add dword [ebp - 0xc], eax
jmp 0x40b36a
mov eax, dword [0x414588]
cmp dword [ebp - 0x14], eax
jne 0x40b414
mov ebx, 0x1770
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
sub ebx, eax
sub ebx, 4
cmp ebx, dword [ebp - 0xc]
jle 0x40b414
mov eax, dword [ebp - 0xc]
add eax, 0x412e18
mov ecx, dword [0x414588]
mov dword [ecx*4 + 0x414c48], eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [0x414588]
mov eax, dword [eax*4 + 0x414c48]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
inc dword [0x414588]
mov dword [ebp - 0x1c], 1
jmp 0x40b43e
cmp dword [ebp + 0x14], 2
je 0x40b434
cmp dword [ebp + 0x14], 5
jne 0x40b43e
cmp dword [ebp + 8], 4
jne 0x40b43e
push 0
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov eax, dword [ebp - 0x1c]
jmp 0x40b45c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b6d6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax], 0xffffffff
jne 0x40b6f2
xor eax, eax
jmp 0x40b797
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x40b707
inc dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 4], eax
jae 0x40b732
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + ecx]
mov al, byte [edx + 0x412500]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov byte [ecx + edx], al
jmp 0x40b704
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov dword [ebp - 4], 0
jmp 0x40b762
inc dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 4], eax
jae 0x40b78d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + ecx]
mov al, byte [edx + 0x4123f8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov byte [ecx + edx], al
jmp 0x40b75f
mov eax, 1
jmp 0x40b797
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b88b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax], 0xffffffff
jne 0x40b8a4
xor eax, eax
jmp 0x40b8f0
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 1
je 0x40b8be
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 2
jne 0x40b8ce
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x40b8e6
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
sub eax, 0x40
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, 1
jmp 0x40b8f0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ba46
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
nop
leave
add esp, 4
popal
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
pushal
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x40ba82
inc dword [ebp - 0xc]
mov eax, dword [0x414588]
cmp dword [ebp - 0xc], eax
jge 0x40bab7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x414c48]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x40bab2
jmp 0x40bab7
jmp 0x40ba7f
mov eax, dword [0x414588]
cmp dword [ebp - 0xc], eax
jl 0x40bae1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040b029
add esp, 8
mov dword [ebp - 0x10], 1
jmp 0x40bb11
cmp dword [0x4120e4], 0
jne 0x40bb02
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
mov dword [ebp - 0x10], eax
jmp 0x40bb11
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x40bee6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
popal
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
pushal
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
jmp 0x40bf2e
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
shl eax, 2
cmp dword [eax + eax*4 + 0x412648], 0xffffffff
je 0x40bf62
mov eax, dword [ebp - 0x1c]
shl eax, 2
mov ecx, dword [ebp - 0x18]
cmp dword [eax + eax*4 + 0x412648], ecx
jne 0x40bf5d
jmp 0x40bf62
jmp 0x40bf2b
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*4]
add eax, 0x412648
push eax
call fcn.0040b461
add esp, 0x18
test eax, eax
je 0x40bfb6
cmp dword [ebp - 4], 0
je 0x40bfb1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
shl ecx, 2
add dword [ecx + ecx*4 + 0x41264c], eax
jmp 0x40bfd3
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 0x14

Function at 0x40e25d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x40e285
xor eax, eax
leave
ret
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub eax, ecx
je 0x40e2b9
dec eax
je 0x40e299
dec eax
je 0x40e2ab
jmp 0x40e281
cmp dword [ebp - 0x8c], ecx
jne 0x40e2a5
push 4
jmp 0x40e2bb
jbe 0x40e2ab
push 5
jmp 0x40e2bb
cmp dword [ebp - 0x90], 5
sbb eax, eax
add eax, 7
leave
ret
push 3
pop eax
leave
ret

Function at 0x410ed1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x14], esi
jle 0x410f03
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
push 4
pop ebx
lea ecx, [eax + esi]
mov eax, esi
cdq
idiv ebx
mov al, byte [edx + ebp + 0x10]
xor al, byte [ecx + edi]
inc esi
cmp esi, dword [ebp + 0x14]
mov byte [ecx], al
jl 0x410ee4
pop edi
pop ebx
pop esi
pop ebp
ret