joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ef40
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510852
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5555ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x46ef9c
mov dword [esi], 0x52a6f8
mov dword [esi + 0x10], 0x52a700
mov dword [esi + 0x68], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
push 0
lea edi, [esi + 0x18]
mov ecx, esi
push edi
call fcn.0046ecc0
lea edx, [esi + 0x10]
mov dword [ebp + 0xc], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 4
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edi
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0042dcd0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x46f02c
push 1
mov byte [ebp - 4], 5
call fcn.004e796a
add esp, 4
mov dword [ebx + 4], eax
jmp 0x46f02e
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov ecx, ebx
mov eax, dword [edi + 0x20]
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
mov dword [eax], 0
or edx, 2
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
and al, 2
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, ebx
mov dword [edi + 0x38], 0
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4730a7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4cca15
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cc615

Function at 0x4cca20
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cc798

Function at 0x4d2f5c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d26e0

Function at 0x4d2f67
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d291f

Function at 0x4d3ac7
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d3994

Function at 0x4dbfc7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x55ec60]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4dc008
cmp byte [edx], 0xa
jne 0x4dc008
or byte [eax + edi + 0x28], 4
jmp 0x4dc00d
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4dc0fe
mov al, byte [ebx]
cmp al, 0x1a
je 0x4dc0df
cmp al, 0xd
je 0x4dc036
mov byte [esi], al
inc esi
inc ebx
jmp 0x4dc0d4
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4dc056
cmp byte [eax], 0xa
jne 0x4dc04b
push 2
mov byte [esi], 0xa
pop eax
jmp 0x4dc051
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x4dc0d4
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4dc0cd
cmp dword [ebp - 0x14], 0
je 0x4dc0cd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x55ec60]
test byte [eax + edi + 0x28], 0x48
je 0x4dc0a4
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x4dc094
mov byte [esi], dl
jmp 0x4dc0d0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x55ec60]
mov byte [eax + edi + 0x2a], dl
jmp 0x4dc0d0
cmp byte [ebp - 1], 0xa
jne 0x4dc0b6
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4dc0b6
mov byte [esi], 0xa
jmp 0x4dc053
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004ddc65
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4dc0d1
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4dc01f
jmp 0x4dc0fe
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x55ec60]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4dc0f9
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4dc0fe
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc109
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x55ec60]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4dc14d
cmp word [edx], bx
jne 0x4dc14d
or byte [edi + eax + 0x28], 4
jmp 0x4dc152
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4dc2a6
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4dc286
cmp ax, word [ebp - 0x10]
je 0x4dc18b
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4dc27b
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4dc1b1
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4dc1a1
push ecx
pop eax
push 4
jmp 0x4dc1a6
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4dc275
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4dc26c
cmp dword [ebp - 0x18], 0
je 0x4dc26c
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x55ec60]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4dc238
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4dc1fc
mov word [esi], ax
jmp 0x4dc230
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x55ec60]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x55ec60]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x55ec60]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4dc27b
cmp word [ebp - 4], ax
jne 0x4dc24d
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4dc24d
mov word [esi], ax
add esi, 2
jmp 0x4dc27b
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004ddc65
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4dc278
jmp 0x4dc26f
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4dc16b
jmp 0x4dc2a6
mov ecx, dword [ecx*4 + 0x55ec60]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4dc29d
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4dc2a6
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e3d50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004e4360
add esp, 8
test al, al
je 0x4e3d75
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4e3d75
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4e4360
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4e5810
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e583b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e583b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x406ad1
pop dword [ebp - 0x14]
mov eax, 0x77e4e075
sub eax, 0x77a475a4
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xecf6868e
sub dword [ebp - 0x24], 0x9ea44143
mov dword [ebp - 0x20], 0x4d4c20fd
add dword [ebp - 0x20], 0xe4e72b48
mov dword [ebp - 0x1c], 0x800a0117
add dword [ebp - 0x1c], 0xcc424317
mov dword [ebp - 0x18], 0xcb04f829
add dword [ebp - 0x18], 0x34fb07d7
lea eax, [ebp - 0x24]
push eax
mov eax, 0xa90942f9
sub eax, 0xa8c872a5
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xd3f0e612
sub dword [ebp - 0x24], 0x5f7e7cbc
mov dword [ebp - 0x20], 0xdea54283
add dword [ebp - 0x20], 0x62c71ef2
mov dword [ebp - 0x1c], 0xb231ce9
add dword [ebp - 0x1c], 0x584c4f83
mov dword [ebp - 0x18], 0xb271cb3c
add dword [ebp - 0x18], 0x4d8e34c4
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x2d080a04
add eax, 0xd338c648
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3c4d6
push 0
call eax
mov ecx, 0x50ce84ad
add ecx, 0xaf31cd61
mov edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x14]
mov edx, 0x7110fa7
add edx, 0x38047d1e
add dword [ebp - 8], 0xc14829e
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0x60945d06
xor esi, edx
xor dword [ebp - 0xc], edi
mov dword [edi], esi
mov dword [ebp - 8], 0x440d95ea
add edi, 4
add ebx, 0xd75aea7
add ebx, 0xf28a515d
loop 0x406bed
add eax, 0x1ed2463c
add eax, 0xe12ef4cf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2a6122d4
sub ecx, 0x2a2122d4
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403e59
pop dword [ebp - 0x50]
mov eax, 0x403e59
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xadb4905
sub dword [ebp - 0x60], 0xbc8903ba
mov dword [ebp - 0x5c], 0xa7b5ea2e
add dword [ebp - 0x5c], 0x8a7d6217
mov dword [ebp - 0x58], 0x139739c5
add dword [ebp - 0x58], 0x38b50a69
mov dword [ebp - 0x54], 0xbba7320
sub dword [ebp - 0x54], 0xbba7320
lea eax, [ebp - 0x60]
push eax
mov eax, 0xd5fc4bf5
sub eax, 0xd5bbdb91
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb84ac913
sub dword [ebp - 0x60], 0x43d85fbd
mov dword [ebp - 0x5c], 0x428cec9d
add dword [ebp - 0x5c], 0xfedf74d8
mov dword [ebp - 0x58], 0x182a1c36
sub dword [ebp - 0x58], 0xb4baafca
mov dword [ebp - 0x54], 0xc3da4e76
sub dword [ebp - 0x54], 0xc3da4e76
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x4872b1a4
add eax, 0xb7cdbf04
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38bdd
push 0
call eax
mov ecx, 0x813f6fa1
add ecx, 0x7ec0e059
mov ebx, eax
mov edi, 0x4801d6b0
add edi, 0xb83f2950
add edi, dword [ebp - 0x50]
mov edx, 0x3fe6c726
add edx, 0x844b1d63
add dword [ebp - 0x40], edx
mov esi, dword [edi]
add dword [ebp - 0x30], 0xe4d368e3
add esi, edx
xor dword [ebp - 0x24], 0x7df86cd7
mov dword [ebx], esi
add dword [ebp - 4], 0xb7d460e0
add ebx, 0x7e786db9
add ebx, 0x8187924b
add edi, 0xd1d1d63c
add edi, 0x2e2e29c8
loop 0x403f76
add eax, 0x132bb
xor ebx, ebx
add ebx, eax
add eax, 0x60a3cd1a
sub eax, 0x60a3cd15
mov ecx, 0xca5d57e5
add ecx, 0x35e2a81b
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401f12
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push 0x7f02
mov esi, ecx
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [esi + 0x5c]
lea ecx, [ebp - 0x28]
push eax
call fcn.00402f56
push 0x3a
lea ecx, [ebp - 0x28]
call fcn.00403052
inc eax
neg eax
sbb eax, eax
inc eax
test al, al
je 0x4020ac
push edi
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00403c58
mov edi, 0x447348
push edi
push dword [ebp - 0x28]
call fcn.004347b0
neg eax
sbb eax, eax
pop ecx
neg eax
test al, al
pop ecx
je 0x401f9b
lea eax, [ebp - 0x34]
push 0x4400e8
push eax
lea ecx, [ebp - 0x28]
call fcn.0040366a
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403caf
lea ecx, [ebp - 0x34]
call fcn.00402fbc
jmp 0x401f62
lea ecx, [ebp - 0x10]
call fcn.00402ea1
mov edi, 0x104
lea ecx, [ebp - 0x10]
push edi
call fcn.004032cd
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x10]
call fcn.0040330b
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004030b3
cmp byte [eax], 0x5c
je 0x401fdd
push 0x4400e4
lea ecx, [ebp - 0x10]
call fcn.004034ca
mov eax, dword [ebp - 0x1c]
push dword [eax]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00403945
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
call fcn.00403163
lea ecx, [ebp - 0x34]
call fcn.00402fbc
xor edi, edi
cmp dword [ebp - 0x18], edi
jle 0x40209a
lea ebx, [esi + 0x84]
lea ecx, [ebp - 0x48]
call fcn.00404779
lea eax, [ebp - 0x48]
lea ecx, [esi + 0x10]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + edi*4]
push dword [eax]
call fcn.0040bf36
mov eax, dword [ebp - 0x1c]
push dword [eax + edi*4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00403945
add esp, 0xc
lea ecx, [ebp - 4]
push 1
push dword [ebp - 0x34]
call fcn.00404256
push dword [ebp - 4]
lea ecx, [ebp - 0x48]
call fcn.00404c50
push dword [ebp - 0x34]
mov ecx, ebx
call fcn.00403d99
cmp eax, 0xffffffff
jne 0x402078
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.00403caf
lea ecx, [ebp - 4]
call fcn.00404276
lea ecx, [ebp - 0x34]
call fcn.00402fbc
lea ecx, [ebp - 0x48]
call fcn.0040478c
inc edi
cmp edi, dword [ebp - 0x18]
jl 0x402014
lea ecx, [ebp - 0x10]
call fcn.00402fbc
lea ecx, [ebp - 0x1c]
call fcn.00403c65
pop ebx
pop edi
push 1
push 0
push 0
push dword [ebp - 0x28]
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, esi
call fcn.00401a4f
lea ecx, [ebp - 0x28]
call fcn.00402fbc
pop esi
leave
ret
Function at 0x404370
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 0xc]
mov al, bl
push esi
neg al
sbb eax, eax
push edi
and eax, 0xc0000000
mov esi, ecx
xor edi, edi
add eax, 0x80000000
cmp dword [ebp + 0x10], edi
mov dword [esi], 0x43d2d0
mov byte [esi + 0x1c], bl
jne 0x4043a7
mov cl, bl
neg cl
sbb ecx, ecx
add ecx, 3
mov dword [ebp + 0x10], ecx
push edi
push edi
push dword [ebp + 0x10]
xor ecx, ecx
test bl, bl
sete cl
push edi
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x4043ca
mov dword [esi + 4], edi
push 0x400
call fcn.004345c0
test bl, bl
pop ecx
mov dword [esi + 8], eax
jne 0x4043f0
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4043f0
lea ecx, [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x4043f2
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x404465
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x404495
cmp byte [esi + 0x1c], 0
jne 0x404495
cmp dword [ebp + 0xc], 0
je 0x404495
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0xc]
cmp dword [ebp + 0xc], eax
jbe 0x40448e
mov dword [ebp + 0xc], eax
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x40449c
xor eax, eax
jmp 0x404545
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov edx, dword [ebp + 8]
sub eax, ecx
mov dword [ebp - 4], edx
je 0x4044d7
cmp edi, eax
mov ebx, edi
jb 0x4044b4
mov ebx, eax
mov eax, dword [esi + 8]
push ebx
add eax, ecx
push eax
push edx
call fcn.00434840
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
add dword [esi + 0x10], ebx
add eax, ebx
add esp, 0xc
sub edi, ebx
add dword [esi + 0xc], ebx
mov dword [ebp - 4], eax
test edi, edi
je 0x404542
mov eax, dword [esi + 0x18]
mov ebx, edi
sub eax, dword [esi + 0xc]
cmp edi, eax
je 0x4044ed
shr ebx, 0xa
shl ebx, 0xa
test ebx, ebx
jbe 0x404512
lea eax, [esi + 0x14]
push 0
push eax
push ebx
push dword [ebp - 4]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x14]
add dword [ebp - 4], ebx
sub edi, ebx
add dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
test edi, edi
je 0x404542
lea eax, [esi + 0x14]
push 0
push eax
push 0x400
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push dword [esi + 8]
push dword [ebp - 4]
call fcn.00434840
add esp, 0xc
add dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x404620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x404653
mov ecx, dword [ebp + 0x10]
movzx edx, byte [eax]
and ecx, 0xff
xor ecx, edx
xor edx, edx
mov dl, byte [ebp + 0x11]
mov cx, word [ecx*2 + 0x4400f0]
xor cx, dx
inc eax
dec esi
mov dword [ebp + 0x10], ecx
jne 0x40462e
mov ax, word [ebp + 0x10]
pop esi
pop ebp
ret
Function at 0x4048c7
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx]
xor eax, eax
test ecx, ecx
je 0x404907
push edi
push esi
push ebx
mov edi, dword [ecx + 4]
xor esi, esi
test edi, edi
jle 0x4048fe
movzx edx, byte [esi + ecx + 8]
mov ebx, eax
and ebx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, ah
mov ax, word [edx*2 + 0x4400f0]
xor ax, bx
inc esi
cmp esi, edi
jl 0x4048db
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4048d2
pop ebx
pop esi
pop edi
ret

Function at 0x404aae
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
call fcn.00404949
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x404b2d
push esi
push 0x4008
call fcn.004345c0
xor esi, esi
pop ecx
cmp eax, esi
je 0x404ae5
mov dword [eax], esi
mov dword [eax + 4], esi
mov esi, eax
mov eax, dword [edi + 4]
test eax, eax
je 0x404af0
mov dword [eax], esi
jmp 0x404af2
mov dword [edi], esi
mov eax, 0x4000
mov dword [edi + 4], esi
cmp ebx, eax
mov dword [ebp - 4], ebx
jb 0x404b04
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 0
push eax
lea eax, [esi + 8]
push dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
add dword [esi + 4], eax
sub ebx, eax
mov eax, dword [ebp - 4]
add dword [edi + 0x10], eax
test ebx, ebx
jne 0x404acd
pop esi
mov ecx, edi
call fcn.004049fe
pop edi
pop ebx
leave
ret 4
Function at 0x405b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov edi, dword [esi + 0x2c]
mov dword [ebp - 8], ebx
cmp edi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
je 0x405b66
lea eax, [ebp - 0xc]
lea ecx, [esi + 0x1c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404cd4
cmp dword [ebp - 8], ebx
je 0x405b66
mov ecx, dword [ebp - 4]
movzx eax, byte [eax]
and ecx, 0xff
xor ecx, eax
xor eax, eax
mov al, byte [ebp - 3]
mov cx, word [ecx*2 + 0x4400f0]
xor cx, ax
dec edi
mov dword [ebp - 4], ecx
jne 0x405b2d
lea edi, [esi + 0x1c]
lea eax, [ebp - 4]
push 2
push eax
mov ecx, edi
call fcn.00404791
mov ecx, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.00405fbb
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x2c]
cmp eax, ebx
je 0x405baf
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404cd4
mov ecx, esi
mov ebx, eax
call fcn.00405fe7
xor byte [ebx], al
dec dword [ebp - 0x10]
jne 0x405b90
lea eax, [ebp - 4]
push 2
push eax
mov ecx, edi
call fcn.00404791
lea ebx, [esi + 0xc]
push 0x447348
push dword [ebx]
call fcn.004347b0
neg eax
sbb eax, eax
pop ecx
neg eax
test al, al
pop ecx
je 0x405c1c
mov eax, dword [esi + 0x2c]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
je 0x405c1c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
lea ecx, [esi + 0x1c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404cd4
push dword [ebp - 0x10]
mov ecx, ebx
mov edi, eax
call fcn.004030b3
mov al, byte [eax]
sub byte [edi], al
mov eax, dword [ebp - 0x10]
inc eax
cdq
idiv dword [esi + 0x10]
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jne 0x405bec
pop edi
pop esi
pop ebx
leave
ret