joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f79
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.004187a0
cmp dword [0x1dec5d0], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x28], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x401fb3
push 0
lea eax, [ebp - 0x84c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x4275d0]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x30], eax
mov eax, dword [0x4275d4]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x24], eax
call fcn.00401f6f
mov ecx, dword [0x4275d8]
mov eax, dword [0x4275dc]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x1dec5d0], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1dec5cc]
cmove eax, edx
xor edx, edx
cmp dword [0x1dec5d0], 0x3eb
mov dword [0x1dec5cc], eax
mov eax, dword [0x1debfbc]
cmove eax, edx
add ecx, ebx
mov dword [0x1debfbc], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x1dec5d0]
xor eax, edx
mov dword [0x1dec5c8], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x4020e8
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
lea eax, [ebp - 0x104c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1dec5d0]
sub edi, eax
cmp ecx, 0xc
jne 0x4020f6
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.00401f76
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x402142
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
jmp 0x401ff1
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416ed0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x426480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d95
mov dword [ebp - 0x14], eax
cmp dword [0x8263e0], esi
jne 0x416fc3
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x416f50
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4170a3
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4170a3
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4170a3
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x8263e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x8263e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x8263e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x8263f0], eax
test eax, eax
je 0x416fc0
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x8263ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x416fe8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x416fdb
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x416ffd
push 4
pop eax
jmp 0x4170a5
cmp dword [ebp - 0x14], esi
je 0x416ffd
push dword [0x8263e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x416fe2
mov eax, dword [0x8263ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41705b
cmp dword [0x8263f0], edi
je 0x41705b
push eax
call ebx
push dword [0x8263f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41705b
test eax, eax
je 0x41705b
call ecx
test eax, eax
je 0x417050
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x417050
test byte [ebp - 8], 1
jne 0x41705b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41708b
mov eax, dword [0x8263e4]
cmp eax, edi
je 0x417088
push eax
call ebx
test eax, eax
je 0x417088
call eax
mov esi, eax
test esi, esi
je 0x417088
mov eax, dword [0x8263e8]
cmp eax, edi
je 0x417088
push eax
call ebx
test eax, eax
je 0x417088
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x8263e0]
call ebx
test eax, eax
je 0x4170a3
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4170a5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406fc0
mov esp, ebp
pop ebp
ret
Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret

Function at 0x408810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40881f
pop dword [ebp - 0x34]
mov eax, 0x40881f
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x43164f8f
add dword [ebp - 0x44], 0xb3bf5bc
mov dword [ebp - 0x40], 0xe3566fa3
add dword [ebp - 0x40], 0x4edcdca2
mov dword [ebp - 0x3c], 0x4a725154
sub dword [ebp - 0x3c], 0xfe260d26
mov dword [ebp - 0x38], 0xfc766984
sub dword [ebp - 0x38], 0xfc766984
lea eax, [ebp - 0x44]
push eax
mov eax, 0xa09c05b3
sub eax, 0xa05ad51b
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x125dd7ce
add dword [ebp - 0x44], 0x62149188
mov dword [ebp - 0x40], 0xaf95c2c
sub dword [ebp - 0x40], 0xc98cfab7
mov dword [ebp - 0x3c], 0xb883d80e
add dword [ebp - 0x3c], 0xaaeb945e
mov dword [ebp - 0x38], 0x132a0567
sub dword [ebp - 0x38], 0x132a0567
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3bbe3
push 0
call eax
mov ecx, 0x962f4f9b
sub ecx, 0x962f004c
mov ebx, eax
mov edx, 0xe9a4f76c
add edx, 0x169cac94
add edx, dword [ebp - 0x34]
mov edi, 0xef089a1d
sub edi, 0x82cf48fb
mov dword [ebp - 0x20], 0x4b2911d0
mov esi, dword [edx]
xor dword [ebp - 0x28], 0x603b6083
xor esi, edi
add dword [ebp - 0xc], ebx
mov dword [ebx], esi
sub dword [ebp - 0x1c], ecx
add ebx, 4
add edx, 0xd86ffc52
sub edx, 0xd86ffc4e
loop 0x408937
add eax, 0x137c456c
sub eax, 0x137b155d
mov ebx, eax
add eax, 0x8bd0f608
sub eax, 0x8bd0f603
mov ecx, 0x2c3483c6
sub ecx, 0x2bf483c6
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1ca7989
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1ca7998
pop dword [ebp - 0x4c]
mov eax, 0x91facf3d
sub eax, 0x903055a5
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x8e491bd8
sub dword [ebp - 0x5c], 0x3ff6d68d
mov dword [ebp - 0x58], 0x76a5dd72
sub dword [ebp - 0x58], 0x4472912d
mov dword [ebp - 0x54], 0xc84dc840
add dword [ebp - 0x54], 0x83fe7bee
mov dword [ebp - 0x50], 0x6683b8b9
add dword [ebp - 0x50], 0x997c4747
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xedc6a4d4
add eax, 0x14049b80
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x6ff491cb
sub dword [ebp - 0x5c], 0xfb822875
mov dword [ebp - 0x58], 0x2395982c
add dword [ebp - 0x58], 0x1dd6c949
mov dword [ebp - 0x54], 0x4e0e09bb
add dword [ebp - 0x54], 0x156162b1
mov dword [ebp - 0x50], 0x6456324f
add dword [ebp - 0x50], 0x9ba9cdb1
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x2d0764aa
sub eax, 0x2b3c249e
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x41e4a
push 0
call eax
mov ecx, 0x4873
xor edx, edx
add edx, eax
mov edi, 0x1cf8a00
add edi, dword [ebp - 0x4c]
mov esi, 0xc6561e01
sub esi, 0xd9f9cd2a
xor dword [ebp - 0x3c], 0xff8ffd0f
mov ebx, dword [edi]
add dword [ebp - 0x40], 0xb1c64abe
add ebx, esi
mov dword [edx], ebx
add edx, 0xa6adea31
sub edx, 0xa6adea2d
add edi, 0xb2c7ff2c
add edi, 0x4d3800d8
loop 0x1ca7ab0
add eax, 0xce69f749
sub eax, 0xce68e2aa
xor ebx, ebx
add ebx, eax
add eax, 0xfb725319
add eax, 0x48dacec
mov ecx, 0x1c20000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40288e
pop dword [ebp - 0x20]
mov eax, 0x40288e
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x883a44e2
add dword [ebp - 0x30], 0xc6180069
mov dword [ebp - 0x2c], 0x42c6acdf
add dword [ebp - 0x2c], 0xef6c9f66
mov dword [ebp - 0x28], 0x5a67b725
add dword [ebp - 0x28], 0xf1e48d09
mov dword [ebp - 0x24], 0xbca82162
add dword [ebp - 0x24], 0x4357de9e
lea eax, [ebp - 0x30]
push eax
mov eax, 0x884ef6fe
sub eax, 0x880e869a
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x49ebfa3f
add dword [ebp - 0x30], 0x2a866f17
mov dword [ebp - 0x2c], 0x8912624
add dword [ebp - 0x2c], 0x38db3b51
mov dword [ebp - 0x28], 0x4bbfe63b
sub dword [ebp - 0x28], 0xe85079cf
mov dword [ebp - 0x24], 0x50a1afbd
sub dword [ebp - 0x24], 0x50a1afbd
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x5fd88580
add eax, 0xa067eb28
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35e66
push 0
call eax
mov ecx, 0x7cbd6230
sub ecx, 0x7cbd1cf9
mov edi, eax
mov esi, 0x50739b12
sub esi, 0x50329b12
add esi, dword [ebp - 0x20]
mov ebx, 0x417b7100
add ebx, 0xacb074b8
mov dword [ebp - 4], 0xf97749c3
mov edx, dword [esi]
mov dword [ebp - 0x10], 0xdca5fd8d
sub edx, ebx
xor dword [ebp - 0x10], esi
mov dword [edi], edx
add dword [ebp - 0x14], esi
add edi, 4
add esi, 0x2643154f
sub esi, 0x2643154b
loop 0x4029ab
add eax, 0x8b0c8b46
sub eax, 0x8b0b8397
mov ebx, eax
add eax, 0xe3559279
add eax, 0x1caa6d8c
mov ecx, 0xe4bd8377
add ecx, 0x1b827c89
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x429370
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp edi, 0x1f
jb 0x429510
test edx, 3
je 0x4293a2
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jmp 0x429387
xor eax, dword [edx]
lea edi, [edx + edi - 0x1b]
sub edx, edi
lea ebx, [ebx]
mov ecx, dword [edi + edx + 0xc]
mov ebx, dword [edi + edx + 8]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x400]
xor ecx, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 4]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x1400]
xor ecx, dword [ebp + ebx*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [ebp + esi*4 + 0x2c00]
xor ecx, dword [ebp + ebx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [ebp + esi*4 + 0x2400]
xor ecx, dword [ebp + eax*4 + 0x2800]
mov eax, dword [edi + edx + 0x18]
mov ebx, dword [edi + edx + 0x14]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x400]
xor eax, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 0x10]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x1400]
xor eax, dword [ebp + ebx*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [ebp + esi*4 + 0x2c00]
xor eax, dword [ebp + ebx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [ebp + esi*4 + 0x2400]
xor eax, dword [ebp + ecx*4 + 0x2800]
add edx, 0x18
jae 0x4293b0
add edi, 0x18
sub edx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [ebp + eax*4]
xor eax, dword [ebp + ebx*4 + 0xc00]
xor eax, dword [ebp + ecx*4 + 0x800]
xor eax, dword [ebp + esi*4 + 0x400]
add edx, 4
jb 0x429509
xor eax, dword [edi + edx]
jmp 0x4294d7
add edx, edi
add edi, 3
sub edi, edx
test edi, edi
je 0x429527
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jne 0x429514
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x412be0
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x350
call fcn.00412bf4
Function at 0x416a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov edi, dword [edx + 0x1c]
mov dword [esp + 0x5c], ecx
test edi, edi
je 0x417e8f
call fcn.00416aa3
Function at 0x419dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1d0
mov eax, dword [ebp + 8]
call fcn.00419dd7
Function at 0x424750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov edi, 0x200
xor esi, esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 2
cmp edi, 0x201
jae 0x4247c0
jmp 0x4247a1
mov esi, dword [ebp - 0x10]
jbe 0x424834
cmp edi, 0x201
jae 0x4247c0
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 0x200
lea ebx, [ebp - 0x434]
mov esi, edi
jmp 0x4247e7
sub edi, esi
je 0x4247db
mov edx, esi
lea ecx, [ebp - 0x24]
push edi
call fcn.0040d790
add esp, 4
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
push 0
call sub.KERNEL32.dll_SetLastError
push ebx
push esi
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov edi, eax
test eax, eax
jne 0x424804
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x424881
cmp edi, esi
jne 0x424790
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x42489f
lea edi, [esi + esi]
test esi, esi
mov esi, dword [ebp - 0x10]
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x4247a1
jmp 0x4247c0
mov eax, dword [ebp - 0x18]
cmp edi, eax
ja 0x4248b5
lea eax, [ebp - 0x34]
push edi
push ebx
push eax
call fcn.00431810
add esp, 0xc
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
test esi, esi
je 0x424873
add esi, esi
push 2
push esi
push dword [ebp - 0x14]
call fcn.00402ec0
add esp, 0xc
mov eax, dword [ebp + 8]
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
test esi, esi
jne 0x424863
jmp 0x424873
push 0x4a2930
push 0x28
push str.internal_error:_entered_unreachable_code_
call fcn.0047ecf0
add esp, 0xc
jmp 0x4248c4
push 0x4a2920
push eax
push edi
call fcn.004847e0
add esp, 0xc
ud2

Function at 0x424910
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
call sub.KERNEL32.dll_GetEnvironmentStringsW
test eax, eax
je 0x42492c
mov edx, eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], 0x4a2040
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x4296b0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x38]
push 0x4a2048
push eax
call fcn.0047ec60
add esp, 8
ud2
Function at 0x424e50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x430
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x43c]
push dword [ebp + 0x10]
call fcn.0044bca0
add esp, 4
mov eax, dword [ebp - 0x43c]
cmp eax, 0x80000000
jne 0x424e96
lea ecx, [ebp - 0x43c]
call fcn.00406430
mov dword [edi], 0x80000000
jmp 0x42502d
mov ecx, dword [ebp - 0x438]
mov esi, 0x200
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x20], ecx
cmp esi, 0x201
jae 0x424f00
jmp 0x424eee
jbe 0x424f7b
cmp esi, 0x201
jae 0x424f00
mov dword [ebp - 0x10], 0x200
lea ebx, [ebp - 0x43c]
mov edi, esi
jmp 0x424f2a
mov edi, dword [ebp - 0x14]
sub esi, edi
je 0x424f1e
mov edx, edi
lea ecx, [ebp - 0x2c]
push esi
call fcn.0040d790
add esp, 4
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 0
call sub.KERNEL32.dll_SetLastError
push edi
push ebx
push dword [ebp - 0x20]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov esi, eax
test eax, eax
jne 0x424f4e
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x42503a
cmp esi, edi
jne 0x424ee0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x425058
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x424eee
jmp 0x424f00
mov eax, dword [ebp - 0x10]
cmp esi, eax
ja 0x42506e
lea eax, [ebp - 0x3c]
push esi
push ebx
push eax
call fcn.00431810
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x424fba
add eax, eax
push 2
push eax
push dword [ebp - 0x1c]
call fcn.00402ec0
add esp, 0xc
cmp edi, 0x80000000
jne 0x425003
mov edi, dword [ebp + 8]
cmp bl, 3
mov dword [edi], 0x80000000
jne 0x425016
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
push edi
call eax
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x424ff1
push dword [ebx + 8]
push eax
push edi
call fcn.00402ec0
add esp, 0xc
push 4
push 0xc
push esi
call fcn.00402ec0
add esp, 0xc
mov edi, dword [ebp + 8]
jmp 0x425016
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
mov dword [edi + 0xc], ecx
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42502d
add eax, eax
push 2
push eax
push dword [ebp - 0x20]
call fcn.00402ec0
add esp, 0xc
mov eax, edi
add esp, 0x430
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
mov edi, 0x80000000
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x424faa
jmp 0x424fba
push 0x4a2930
push 0x28
push str.internal_error:_entered_unreachable_code_
call fcn.0047ecf0
add esp, 0xc
jmp 0x42507d
push 0x4a2920
push eax
push esi
call fcn.004847e0
add esp, 0xc
ud2