joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101200f3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10111182
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10120162
cmp esi, dword [ebp - 4]
je 0x1012015d
cmp dword [ebp + 0xc], 0
je 0x1012015d
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1012013a
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1011fc45
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10120164
xor eax, eax
inc eax
jmp 0x10120164
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x101201c9
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10149040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10111182
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10111182
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10120240
cmp word [ecx], dx
je 0x10120240
mov eax, dword [0x10136b74]
push edi
dec eax
push eax
push 0x10136a60
call fcn.10120168
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x101202b3
cmp word [eax], dx
je 0x101202b3
mov eax, dword [edi]
test eax, eax
je 0x10120264
cmp word [eax], dx
je 0x10120264
lea eax, [ebp - 0x10]
push eax
call fcn.1011fb4b
jmp 0x1012026d
lea eax, [ebp - 0x10]
push eax
call fcn.1011fbe6
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x101202dd
mov eax, dword [0x10136a5c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10136750
call fcn.10120168
add esp, 0xc
test al, al
je 0x101202dd
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x101202a8
cmp word [eax], di
je 0x101202a8
lea eax, [ebp - 0x10]
push eax
call fcn.1011fb4b
pop ecx
jmp 0x101202df
lea eax, [ebp - 0x10]
push eax
call fcn.1011fbe6
jmp 0x101202a5
mov eax, dword [edi]
test eax, eax
je 0x101202ca
cmp word [eax], dx
je 0x101202ca
lea eax, [ebp - 0x10]
push eax
call fcn.1011fb00
pop ecx
jmp 0x101202dd
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x101203a8
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1011ffed
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x101203a8
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x101203a8
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x101203a8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10120335
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10117f8c
test ebx, ebx
je 0x101203a3
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10117f8c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x101203a8
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x101203a8
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100fd070
add esp, 0x10
xor eax, eax
inc eax
jmp 0x101203aa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10081279
leave
ret
Function at 0x1012314d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.101230c9
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x101232bc
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x101232bc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10123271
jg 0x101231a9
test eax, eax
je 0x10123267
push 1
push 0x1000
call fcn.10115138
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x101231cc
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1012325e
push 0x8000
push ebx
call fcn.10122ffa
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x101231f5
jg 0x101231f0
cmp ecx, 0x1000
jb 0x101231f5
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1011ac7a
add esp, 0x10
cmp eax, 0xffffffff
je 0x1012323a
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x101231f0
jl 0x10123221
test ecx, ecx
jne 0x101231e2
push dword [ebp - 0xc]
push ebx
call fcn.10122ffa
push esi
call fcn.101109dd
add esp, 0xc
xor ebx, ebx
jmp 0x101232ca
cmp byte [edi + 0x24], 0
je 0x10123251
cmp dword [edi + 0x20], 5
jne 0x10123251
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1012325c
mov ebx, dword [edi + 0x18]
jmp 0x1012325e
xor ebx, ebx
push esi
call fcn.101109dd
pop ecx
jmp 0x101232ca
test ecx, ecx
jg 0x10123233
jl 0x10123271
test eax, eax
jae 0x10123233
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1011b924
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10123291
cmp byte [edi + 0x1c], 0
je 0x10123233
jmp 0x101232c2
push ebx
call fcn.1011e001
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10123233
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x101232ca
cmp byte [edi + 0x1c], 0
je 0x101232c7
mov ebx, dword [edi + 0x18]
jmp 0x101232ca
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1011b924
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10125b50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10125b7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10125b7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x10000000
mov dword [esp], str..PhysicalDrive0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0x405540
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
leave
ret
Function at 0x402e70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00402ed0

Function at 0x402ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x40e050]
test esi, esi
jle 0x402fbd
mov edi, dword [0x40e054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x402f04
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402fb6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x402ef0
mov dword [esp], eax
mov ebx, eax
call fcn.00403810
test eax, eax
mov edi, eax
je 0x402ffa
lea ebx, [esi + esi*2]
mov esi, dword [0x40e054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00403910
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x40e054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402fda
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x402faf
sub eax, 0x40
and eax, 0xffffffbf
je 0x402faf
mov eax, dword [esp + 0x20]
add ebx, dword [0x40e054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x402fc4
add dword [0x40e050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x402f0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00402e70
mov eax, dword [0x40e054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00402e70
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00402e70
lea esi, [esi]
Function at 0x4034c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40e408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40e400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x403515
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40350e
test esi, esi
je 0x40350e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4034f0
mov dword [esp], 0x40e408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403730
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x403768
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40375e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40376a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x403750
xor eax, eax
pop ebx
pop esi
ret
Function at 0x407442
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0040c221
push 0x4405bc
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0041bb67
add esp, 0xc
test eax, eax
je 0x40748a
cmp dword [ebp - 4], 0
je 0x407478
push dword [ebp - 4]
call fcn.0041b6c6
pop ecx
push str._n_BIN_file_not_found._n
call fcn.00401036
pop ecx
xor al, al
jmp 0x407524
imul eax, dword [esi + 0xa0018], 0x4c
push ebx
xor ebx, ebx
push edi
mov edi, ebx
movzx eax, byte [eax + esi + 0x298]
mov dword [ebp + 8], eax
mov byte [ebp + 0xf], bl
jmp 0x4074f9
imul eax, dword [esi + 0xa0014], 0x120
cmp ebx, dword [eax + esi + 0xc00]
jge 0x407511
movzx ecx, byte [ebp + 0xf]
or ecx, 0xffffff00
test edi, edi
jle 0x4074d8
mov eax, edi
shl ecx, 8
or ecx, 0xff
sub eax, 1
jne 0x4074ca
mov eax, dword [esi + 0x8fb5c]
mov eax, dword [eax]
and dword [eax + ebx*4], ecx
lea ecx, [edi + 1]
cmp ecx, dword [ebp + 8]
lea eax, [ebx + 1]
cmovl eax, ebx
xor edi, edi
cmp ecx, dword [ebp + 8]
mov ebx, eax
cmovl edi, ecx
push dword [ebp - 4]
lea eax, [ebp + 0xf]
push 1
push 1
push eax
call fcn.0041bf47
add esp, 0x10
cmp eax, 1
je 0x4074a7
cmp dword [ebp - 4], 0
pop edi
pop ebx
je 0x407522
push dword [ebp - 4]
call fcn.0041b6c6
pop ecx
mov al, 1
pop esi
leave
ret 8

Function at 0x40814c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x44067c
push dword [ebp + 8]
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
push eax
call fcn.0041bb67
add esp, 0xc
test eax, eax
je 0x40818e
cmp dword [ebp + 8], 0
je 0x40817c
push dword [ebp + 8]
call fcn.0041b6c6
pop ecx
push str._nError_Opening_save_file._n
call fcn.00401036
pop ecx
xor al, al
jmp 0x408228
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
imul eax, dword [esi + 0xa0018], 0x4c
movzx ecx, byte [eax + esi + 0x298]
imul eax, dword [esi + 0xa0014], 0x120
mov dword [ebp - 8], ecx
cmp dword [eax + esi + 0xc00], edi
jle 0x408214
xor ebx, ebx
test ecx, ecx
je 0x408200
xor ecx, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + 0x8fb5c]
push dword [ebp + 8]
push 1
mov eax, dword [eax]
push 1
mov eax, dword [eax + edi*4]
shr eax, cl
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
call fcn.0041ba4e
add esp, 0x10
cmp eax, 1
jne 0x40822c
mov ecx, dword [ebp + 0xc]
inc ebx
add ecx, 8
mov dword [ebp + 0xc], ecx
cmp ebx, dword [ebp - 8]
jl 0x4081c6
mov ecx, dword [ebp - 8]
imul eax, dword [esi + 0xa0014], 0x120
inc edi
cmp edi, dword [eax + esi + 0xc00]
jl 0x4081bb
cmp dword [ebp + 8], 0
je 0x408223
push dword [ebp + 8]
call fcn.0041b6c6
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
push str._nError_writing_to_save_file._n
call fcn.00401036
cmp dword [ebp + 8], 0
pop ecx
je 0x408246
push dword [ebp + 8]
call fcn.0041b6c6
pop ecx
xor al, al
jmp 0x408225
Function at 0x409d44
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 1
imul eax, dword [edi + 0xa0014], 0x120
movzx esi, word [eax + edi + 0xcf0]
mov eax, dword [eax + edi + 0xc00]
cdq
idiv esi
xor esi, esi
push esi
mov ebx, eax
call fcn.0040bf34
imul ecx, dword [edi + 0xa0014], 0x120
cmp word [ecx + edi + 0xc96], si
je 0x409d98
push esi
mov ecx, edi
call fcn.0040be71
push 1
push 6
mov ecx, edi
call fcn.0040bf34
mov eax, ebx
mov ecx, edi
cdq
and edx, 0xff
add eax, edx
sar eax, 8
push eax
push str.Row_Erase
call fcn.0040bcb3
xor eax, eax
lea esi, [ebx - 0x100]
cmp ebx, 0x100
mov ecx, edi
cmovl esi, eax
cmp ebx, 0x100
cmovl eax, ebx
push eax
push 0x1a
call fcn.0040bf34
mov ecx, edi
call fcn.0040bd3e
mov ebx, esi
test esi, esi
jg 0x409db3
xor esi, esi
mov ecx, edi
inc esi
push esi
push esi
call fcn.0040bf34
imul eax, dword [edi + 0xa0014], 0x120
xor ebx, ebx
cmp word [eax + edi + 0xcd6], bx
jbe 0x409ea0
movzx ecx, word [eax + edi + 0xcd8]
xor edx, edx
movzx eax, word [eax + edi + 0xc04]
div ecx
push esi
push 0
mov ecx, edi
mov ebx, eax
call fcn.0040bf34
imul edx, dword [edi + 0xa0014], 0x120
xor eax, eax
cmp word [edx + edi + 0xc88], ax
je 0x409e6b
imul eax, dword [edi + 0xa0018], 0x4c
movzx ecx, byte [eax + edi + 0x294]
mov eax, dword [edx + edi + 0xc08]
cdq
idiv ecx
mov ecx, edi
push eax
call fcn.0040be71
push esi
push 8
mov ecx, edi
call fcn.0040bf34
xor eax, eax
lea esi, [ebx - 0x100]
mov ecx, 0x100
cmp ebx, ecx
cmovl esi, eax
cmp ebx, ecx
mov ecx, edi
cmovl eax, ebx
push eax
push 0x1c
call fcn.0040bf34
mov ebx, esi
test esi, esi
jg 0x409e6b
xor esi, esi
mov ecx, edi
inc esi
push esi
push esi
call fcn.0040bf34
xor ebx, ebx
imul eax, dword [edi + 0xa0014], 0x120
cmp word [eax + edi + 0xccc], bx
jbe 0x409f10
push esi
push ebx
mov ecx, edi
call fcn.0040bf34
mov eax, dword [edi + 0xa0014]
imul ecx, eax, 0x120
cmp word [ecx + edi + 0xc96], bx
je 0x409ef1
push dword [ecx + edi + 0xc18]
mov ecx, edi
call fcn.0040be71
push esi
push 6
mov ecx, edi
call fcn.0040bf34
mov eax, dword [edi + 0xa0014]
imul eax, eax, 0x120
mov ecx, edi
movzx eax, word [eax + edi + 0xccc]
push eax
call fcn.0040a3bc
push esi
push esi
mov ecx, edi
call fcn.0040bf34
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.0040be24
Function at 0x40cf94
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 1]
inc ebx
push ebx
push ebx
push eax
call fcn.0041bf47
movzx esi, byte [ebp - 1]
add esp, 0x10
and esi, 0x7f
cmp byte [ebp - 1], 0x7f
jbe 0x40cfd6
push dword [ebp + 8]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call fcn.0041bf47
movzx eax, byte [ebp - 1]
add esp, 0x10
shl eax, 7
add esi, eax
mov ebx, dword [ebp + 0xc]
xor edi, edi
test esi, esi
je 0x40cffd
push dword [ebp + 8]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.0041bf47
mov al, byte [ebp - 1]
add esp, 0x10
mov byte [edi + ebx], al
inc edi
cmp edi, esi
jl 0x40cfdf
mov byte [edi + ebx], 0
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40fa37
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
imul eax, dword [ecx + 0xa0018], 0x4c
mov edx, dword [ebp + 0xc]
push esi
mov esi, 0xffff
movzx ecx, byte [eax + ecx + 0x28c]
mov eax, dword [ebp + 0x10]
add eax, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp edx, eax
jae 0x40fab6
push ebx
push edi
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx + edx*4]
test ecx, ecx
je 0x40faac
mov dword [ebp + 0x10], ecx
movzx edi, bl
push 8
shl edi, 8
shr ebx, 8
pop edx
mov ecx, edi
lea eax, [esi + esi]
xor ecx, esi
add edi, edi
mov esi, eax
xor esi, 0x11021
and ecx, 0x8000
cmove esi, eax
sub edx, 1
jne 0x40fa7e
sub dword [ebp + 0x10], 1
jne 0x40fa72
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc edx
mov dword [ebp + 0xc], edx
cmp edx, eax
jb 0x40fa65
pop edi
pop ebx
movzx eax, si
pop esi
leave
ret 0xc

Function at 0x4123a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x443481], 0
je 0x412457
push ebx
push esi
push edi
push 0x4434cc
push 0x4434b4
push 0x41
pop ebx
push ebx
push 0x443440
push dword [0x4434c8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x3e8
push dword [0x4434c4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x412413
push dword [0x4434c8]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [0x4434c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x4434bc]
call esi
mov byte [0x443481], 0
push dword [0x4434c4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edi, dword [ebp + 8]
lea eax, [edi + 0x40]
cmp edi, 0x443481
ja 0x412445
mov ecx, 0x443441
cmp eax, ecx
jb 0x412445
sub ecx, edi
mov al, byte [ecx + edi]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x412438
jmp 0x412450
push 0x10
pop ecx
mov esi, 0x443441
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov al, 1
pop ebx
jmp 0x412459
xor al, al
pop ebp
ret 4
Function at 0x41245d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x442008]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x4c], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x48], 0
push edi
mov edi, ecx
test esi, esi
je 0x412491
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x47]
push eax
call fcn.00413c80
add esp, 0xc
inc esi
cmp esi, 0x41
jae 0x4124ad
push 0x41
pop eax
sub eax, esi
push eax
lea eax, [ebp - 0x48]
add eax, esi
push 0x5a
push eax
call fcn.00413420
add esp, 0xc
cmp byte [0x443481], 0
je 0x41255f
push 0x44348c
lea eax, [ebp - 0x4c]
push eax
push 0x41
lea eax, [ebp - 0x48]
push eax
push dword [0x4434bc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x3e8
push dword [0x4434c0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
test ebx, ebx
je 0x412528
cmp ebx, 0x102
jne 0x41252e
push dword [0x4434bc]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [0x4434c8]
mov ebx, eax
call esi
push dword [0x4434bc]
call esi
mov byte [0x443481], 0
mov dword [edi + 0x24], 2
jmp 0x41252e
xor ebx, ebx
inc ebx
mov dword [edi + 0x24], ebx
push dword [0x4434c0]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test ebx, ebx
jne 0x412561
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x4434bc]
mov ebx, eax
call esi
push dword [0x4434c8]
call esi
mov byte [0x443481], 0
jmp 0x412561
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004125a9
leave
ret 8

Function at 0x4239b5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00423834

Function at 0x424a66
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424726
Function at 0x4110f3
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004112a3
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4111f1
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x411194
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4111d7
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4111ab
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4111c6
test al, 0x40
je 0x4111bd
mov ecx, dword [edi + 0x20]
jmp 0x4111c4
test al, 0x80
je 0x4111d7
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4111d7
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x411163
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret