joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401070
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0x42c], ecx
mov eax, 0x400
cdq
xor ebx, ebx
push esi
lea ecx, [edi + edi]
mov dword [ebp - 0x424], esi
idiv ecx
mov dword [ebp - 0x41c], edi
push eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x404]
push ecx
push eax
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x408], ebx
call fcn.00407d50
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x414], esi
test esi, esi
je 0x401230
nop dword [eax + eax]
mov eax, dword [ebp - 0x408]
add eax, esi
mov dword [ebp - 0x420], eax
cmp eax, ebx
jbe 0x40113e
add ebx, ebx
or ebx, 1
cmp eax, ebx
ja 0x401102
mov eax, edi
imul eax, ebx
shl eax, 2
push eax
push dword [ebp - 0x40c]
call fcn.00405c30
add esp, 8
mov dword [ebp - 0x40c], eax
test eax, eax
je 0x40126a
mov dword [ebp - 0x410], ebx
test esi, esi
je 0x4011f5
mov ebx, dword [ebp - 0x41c]
lea ecx, [ebp - 0x404]
mov edx, dword [ebp - 0x40c]
mov eax, ebx
imul eax, dword [ebp - 0x408]
mov dword [ebp - 0x418], ecx
lea edi, [ebx + ebx]
lea eax, [edx + eax*4]
mov dword [ebp - 0x408], eax
lea edx, [ebx*4]
test ebx, ebx
jle 0x4011ce
mov esi, eax
mov edx, ecx
mov edi, ebx
nop dword [eax]
movzx ecx, byte [edx + 1]
lea edx, [edx + 2]
movzx eax, byte [edx - 2]
lea esi, [esi + 4]
shl ecx, 8
or ecx, eax
xor ecx, 0xffff8000
movzx eax, cx
sub eax, 0x8000
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi - 4], xmm0
sub edi, 1
jne 0x401180
mov ecx, dword [ebp - 0x418]
lea edx, [ebx*4]
mov eax, dword [ebp - 0x408]
lea edi, [ebx + ebx]
mov esi, dword [ebp - 0x414]
add eax, edx
add ecx, edi
sub esi, 1
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], esi
jne 0x401172
mov ebx, dword [ebp - 0x410]
mov edi, dword [ebp - 0x41c]
push dword [ebp - 0x424]
mov eax, dword [ebp - 0x420]
push dword [ebp - 0x428]
mov dword [ebp - 0x408], eax
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.00407d50
mov esi, eax
mov dword [ebp - 0x414], eax
add esp, 0x10
test esi, esi
jne 0x4010f0
mov ebx, dword [ebp - 0x408]
imul edi, ebx
shl edi, 2
push edi
push dword [ebp - 0x40c]
call fcn.00405c30
add esp, 8
test eax, eax
je 0x40126a
mov ecx, dword [ebp - 0x42c]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040257b
mov esp, ebp
pop ebp
ret
push str.Out_of_memory._n
push 2
call fcn.00405968
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call fcn.004057af
int3

Function at 0x402db8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402df7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402df7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402df7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402df7
cmp dword [ecx + 0x74], 0xe
jbe 0x402df7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409c1d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c6d0
push 0x41c6c8
push str.FlsAlloc
push 0x1e
call fcn.00409ade
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409c51
push dword [ebp + 8]
mov ecx, esi
call dword [0x41b11c]
call esi
jmp 0x409c57
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409c9b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c6e0
push 0x41c6d8
push str.FlsGetValue
push 0x20
call fcn.00409ade
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409cd2
push dword [ebp + 8]
mov ecx, esi
call dword [0x41b11c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40c14f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4280f8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40c18f
cmp byte [ebx], 0xa
jne 0x40c18f
or byte [eax + edi + 0x28], 4
jmp 0x40c194
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x40c292
mov al, byte [edx]
cmp al, 0x1a
je 0x40c274
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x40c1c3
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x40c1e8
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x40c1f2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x40c1a5
jmp 0x40c292
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c26f
cmp dword [ebp - 0xc], 0
je 0x40c26f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4280f8]
test byte [eax + edi + 0x28], 0x48
je 0x40c249
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x40c234
mov byte [esi], dl
jmp 0x40c245
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4280f8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x40c292
cmp byte [ebp - 1], 0xa
jne 0x40c258
cmp esi, ebx
jne 0x40c258
mov byte [esi], 0xa
jmp 0x40c291
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041332c
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x40c292
mov byte [esi], 0xd
jmp 0x40c291
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4280f8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40c28e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40c292
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40c29b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4280f8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40c2de
cmp word [esi], dx
jne 0x40c2de
or byte [edi + eax + 0x28], 4
jmp 0x40c2e3
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x40c41c
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x40c3fc
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x40c325
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x40c35b
cmp eax, edx
jae 0x40c367
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x40c2fd
jmp 0x40c41c
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c3f8
cmp dword [ebp - 0x14], 0
je 0x40c3f8
mov eax, dword [ebx*4 + 0x4280f8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x40c3d0
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x40c416
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4280f8]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x4280f8]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4280f8]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x40c419
pop ebx
cmp word [ebp - 4], bx
jne 0x40c3e1
cmp esi, dword [ebp + 0xc]
jne 0x40c3e1
mov word [esi], bx
jmp 0x40c419
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041332c
add esp, 0x10
cmp word [ebp - 4], bx
je 0x40c41c
push 0xd
jmp 0x40c415
mov ecx, dword [ebx*4 + 0x4280f8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40c413
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40c41c
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40cc3d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040caae
Function at 0x40dfe5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40e082
push ebx
push esi
call fcn.0040dfae
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040def7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40e02f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e081
push edi
push eax
call fcn.0040acb3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40e04f
call fcn.00409971
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e080
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040def7
add esp, 0x20
test eax, eax
jne 0x40e06e
push edi
call fcn.00409971
jmp 0x40e076
push ebx
call fcn.00409971
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x414095
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00414011
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x41420d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x41420d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4141bc
jg 0x4140ee
test eax, eax
je 0x4141b2
push 1
push 0x1000
call fcn.00409914
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x414114
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4141a9
push 0x8000
push ebx
call fcn.004086f4
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x414140
jg 0x41413b
cmp ecx, 0x1000
jb 0x414140
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00410f24
add esp, 0x10
cmp eax, 0xffffffff
je 0x414185
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x41413b
jl 0x41416c
test ecx, ecx
jne 0x41412d
push dword [ebp - 0xc]
push ebx
call fcn.004086f4
push esi
call fcn.00409971
add esp, 0xc
xor edi, edi
jmp 0x41421e
cmp byte [edi + 0x24], 0
je 0x41419c
cmp dword [edi + 0x20], 5
jne 0x41419c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4141a7
mov edi, dword [edi + 0x18]
jmp 0x4141a9
xor edi, edi
push esi
call fcn.00409971
pop ecx
jmp 0x41421e
test ecx, ecx
jg 0x41417e
jl 0x4141bc
test eax, eax
jae 0x41417e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041332c
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4141df
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x41417e
jmp 0x414216
push ebx
call fcn.0040e7d7
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41417e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x41421e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x41421b
mov edi, dword [edi + 0x18]
jmp 0x41421e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041332c
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x416950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41697d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41697d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404b1e
Capabilities:
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
push edi
mov edi, dword [ebx]
mov dword [ebp - 4], 0xc6ef3720
mov dword [ebp - 0x20], 0x9e3779b9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x20
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
lea ecx, [eax + edi]
mov eax, edi
shr eax, 5
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
add dword [ebp + 8], eax
push ecx
lea eax, [ebp - 8]
push eax
mov dword [0x440544], 0xffcf03fc
call fcn.00404472
mov eax, dword [ebp + 8]
xor eax, dword [ebp - 8]
push dword [ebp - 0x18]
and dword [0x440544], 0
or dword [0x44054c], 0xffffffff
sub esi, eax
mov eax, dword [ebp - 4]
lea edx, [eax + esi]
mov eax, esi
shr eax, 5
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
mov dword [0x440548], 0xff6b3619
call fcn.00404b01
and dword [ebp + 0xc], 0
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x1c]
xor eax, dword [ebp + 8]
xor eax, edx
sub edi, eax
mov eax, dword [ebp - 0x20]
add dword [ebp + 0xc], eax
sub dword [ebp - 4], eax
dec dword [ebp - 0xc]
jne 0x404b5e
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
pop ebx
leave
ret 8
Function at 0x40ad55
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426818]
jne 0x40ad5f
repz ret
jmp fcn.0040ea4d

Function at 0x40e6e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a53c
and dword [ebp - 4], 0
cmp dword [0x441518], 0
mov ebx, eax
jne 0x40e798
push 0x4038d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e849
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4038cc
push edi
call esi
test eax, eax
je 0x40e849
push eax
call fcn.0040a4ca
mov dword [esp], 0x4038bc
push edi
mov dword [0x441518], eax
call esi
push eax
call fcn.0040a4ca
mov dword [esp], 0x4038a8
push edi
mov dword [0x44151c], eax
call esi
push eax
call fcn.0040a4ca
mov dword [esp], 0x40388c
push edi
mov dword [0x441520], eax
call esi
push eax
call fcn.0040a4ca
pop ecx
mov dword [0x441528], eax
test eax, eax
je 0x40e798
push 0x403874
push edi
call esi
push eax
call fcn.0040a4ca
pop ecx
mov dword [0x441524], eax
mov eax, dword [0x441524]
cmp eax, ebx
je 0x40e7f0
cmp dword [0x441528], ebx
je 0x40e7f0
push eax
call fcn.0040a545
push dword [0x441528]
mov esi, eax
call fcn.0040a545
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40e7f0
test edi, edi
je 0x40e7f0
call esi
test eax, eax
je 0x40e7e7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40e7e7
test byte [ebp - 0xc], 1
jne 0x40e7f0
or dword [ebp + 0x10], 0x200000
jmp 0x40e829
mov eax, dword [0x44151c]
cmp eax, ebx
je 0x40e829
push eax
call fcn.0040a545
pop ecx
test eax, eax
je 0x40e829
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40e829
mov eax, dword [0x441520]
cmp eax, ebx
je 0x40e829
push eax
call fcn.0040a545
pop ecx
test eax, eax
je 0x40e829
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x441518]
call fcn.0040a545
pop ecx
test eax, eax
je 0x40e849
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40e84b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10025bc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10025bd5
pop dword [ebp - 0x28]
mov eax, 0x10025bd5
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x6b17684c
sub dword [ebp - 0x38], 0x1cc52301
mov dword [ebp - 0x34], 0xa4b850a7
add dword [ebp - 0x34], 0x8d7afb9e
mov dword [ebp - 0x30], 0x6eff892a
sub dword [ebp - 0x30], 0x22b344fc
mov dword [ebp - 0x2c], 0x337c1e2f
sub dword [ebp - 0x2c], 0x337c1e2f
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x3400c7aa
sub dword [ebp - 0x38], 0xbf8e5e54
mov dword [ebp - 0x34], 0xcebcc164
add dword [ebp - 0x34], 0x72afa011
mov dword [ebp - 0x30], 0x5a322664
sub dword [ebp - 0x30], 0xf6c2b9f8
mov dword [ebp - 0x2c], 0xb8621c3d
sub dword [ebp - 0x2c], 0xb8621c3d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x5c27b
push 0
call eax
mov ecx, 0x49eb
mov edx, eax
mov esi, 0x10061000
add esi, dword [ebp - 0x28]
mov ebx, 0x861fbe5b
add dword [ebp - 8], 0x8d7c8c67
mov edi, dword [esi]
xor dword [ebp - 0xc], 0x4df42b8b
xor edi, ebx
sub dword [ebp - 0xc], 0x5f04971d
mov dword [edx], edi
xor dword [ebp - 0x20], ecx
add edx, 0x7179c55b
sub edx, 0x7179c557
add esi, 0xcf5da95e
sub esi, 0xcf5da95a
loop 0x10025cd6
add eax, 0x11a7f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd5c3ff1e
add ecx, 0x3a3c00e2
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x424ddd
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x424e07
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x424e0d
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.0040fec0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.00446c5f
int3

Function at 0x4250e8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x4250f9
xor eax, eax
jmp 0x425115
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42511a
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.0040fec0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.00446c5f
int3

Function at 0x425298
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x4252c3
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4252c9
cmp dword [ebp - 4], esi
jne 0x4252e0
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.0040fec0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.00446c5f
lea ecx, [edi + 0xc]
call fcn.0040fec0
push eax
push 0xffffffffffffffff
push 0xd
call fcn.004468b5
int3

Function at 0x427e7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x427ec5
call fcn.00432044
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x427ec5
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x427ed2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x427f0e
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x427ef1
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x427efa
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x427f0c
test di, di
jne 0x427f0c
test dx, dx
je 0x427f0e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427f13
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x427f3e
cmp dword [esi + 0x80], 0
jne 0x427f3e
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.00432044
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x427f6e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x427f6e
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.004281da
jmp 0x427f70
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x427f77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.00432044
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x427fb7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x427fb7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00427fbf
jmp 0x427fb9
xor eax, eax
pop edi
pop esi
pop ebp
ret 8