joyce8/EMBER2024-capa huggingface dataset:
Function at 0x585a20
Capabilities:
Read .ini file

Disassembly:
jmp 0x585a20
sub esp, 0x108
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x124]
push edi
push 0xff
lea ecx, [esp + 0x18]
push ecx
push 0
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x14]
push 0x5c
push edx
call fcn.006143f0
mov byte [eax + 1], 0
mov eax, esi
add esp, 8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x585a81
lea edi, [esp + 0x14]
sub eax, ecx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x585a90
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x14]
push eax
push 0xff
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
push ecx
push 0
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006111ee
add esp, 0x108
ret

Function at 0x587150
Capabilities:
Create thread

Disassembly:
jmp 0x587150
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov dword [esi], vtable.PingManager.0
push edi
xor edi, edi
push 0x1e
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.00408d28
push edi
push edi
push edi
push 0x4020ea
push edi
push edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], edi
call fcn.00614932
add esp, 0x18
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x5876f0
Capabilities:
Create raw socket
Initialize winsock library
Set socket configuration

Disassembly:
jmp 0x5876f0
sub esp, 0x198
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
xor eax, eax
push 0x18e
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00610b10
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x102
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x58774c
xor al, al
pop esi
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.006111ee
add esp, 0x198
ret
push 1
push 3
push 2
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x587734
push 4
lea ecx, [esp + 8]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x18], 0x7d0
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x587734
mov eax, dword [esi + 4]
push 4
lea edx, [esp + 8]
push edx
push 0x1005
push 0xffff
push eax
mov dword [esp + 0x18], 0x7d0
call sub.WSOCK32.dll_setsockopt
mov ecx, dword [esp + 0x198]
cmp eax, 0xffffffff
setne al
pop esi
xor ecx, esp
call fcn.006111ee
add esp, 0x198
ret
Function at 0x591fe0
Capabilities:
Create directory

Disassembly:
jmp 0x591fe0
sub esp, 0x210
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
push esi
call ecx
test eax, eax
je 0x59203a
push 0x7c9
mov ecx, 0x7c5388
call fcn.00408599
push eax
push 0x1d
push 0x7c5388
call fcn.0040198d
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.006111ee
add esp, 0x210
ret
mov eax, dword [0x7f68a0]
mov dword [esp + 4], 0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x665fa8
push eax
mov eax, dword [ecx + 0x134]
call eax
test eax, eax
je 0x592022
cmp dword [esi + 0xc], 0
jne 0x5920a1
push 0x666084
mov ecx, esi
call fcn.00404e7b
test eax, eax
jns 0x592085
push 0x7ca
jmp 0x592008
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call edx
cmp dword [esi + 0xc], 0
je 0x592164
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
push 0x3c
push 0x1e
push esi
call ecx
mov ecx, esi
call fcn.004118bf
push 0
mov ecx, 0x7f9c58
call fcn.00404ac0
push eax
lea edx, [esp + 0xc]
push str._sScreenShot
push edx
call fcn.00611035
add esp, 0xc
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x5920fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x5920fb
push 0x7cc
jmp 0x592008
push 0x104
lea ecx, [esp + 0x110]
push ecx
push 0x6660c4
push str.Capture
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00409304
lea eax, [esp + 0x10c]
push eax
push 0x7cd
mov ecx, 0x7c5388
call fcn.00408599
push eax
push 0x1d
push 0x7c5388
call fcn.0040198d
mov ecx, dword [esp + 0x14]
add esp, 0x10
push ecx
push 4
push 0
lea edx, [esp + 0x118]
push edx
push esi
call fcn.004085df
test eax, eax
js 0x592022
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov eax, 1
call fcn.006111ee
add esp, 0x210
ret
Function at 0x594640
Capabilities:
Read file on windows

Disassembly:
jmp 0x594640
sub esp, 0x208
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
mov edi, dword [esp + 0x214]
mov esi, ecx
mov dword [esp + 8], edi
test edi, edi
jne 0x59466e
xor eax, eax
jmp 0x59472a
push 0x666574
push edi
call fcn.00610fd7
lea edx, [esi + 0x30]
add esp, 8
mov dword [esi + 4], eax
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x594686
mov eax, dword [esi + 4]
test eax, eax
je 0x594667
push ebx
push ebp
push 2
push 0
push eax
call fcn.00614a5c
mov eax, dword [esi + 4]
push eax
call fcn.00614da4
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
mov ebx, eax
call fcn.00614a5c
add esp, 0x1c
mov ecx, esi
call fcn.0040b3d4
mov edx, dword [esi + 4]
push edx
push 1
lea edi, [esi + 0x18]
push 0xc
push edi
call fcn.00611708
mov eax, dword [edi]
sub eax, dword [esi + 0x1c]
add esp, 0x10
sub eax, dword [esi + 0x20]
lea ecx, [esi + 0x148]
push eax
call fcn.00406f55
test eax, eax
jne 0x594743
push eax
push 0x38
push 0x666590
call fcn.0040aec0
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push str.Bin_File_Version_Error_____s
push edx
call fcn.00611035
add esp, 0x18
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
xor ecx, esp
call fcn.006111ee
add esp, 0x208
ret 4
lea ecx, [esi + 0x148]
call fcn.00401497
test eax, eax
je 0x5947e7
lea edi, [ebx - 0xe]
push edi
call fcn.0060fcba
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x59477b
push eax
push 0x49
push 0x6665e0
call fcn.0040aec0
add esp, 0xc
jmp 0x594726
push edi
push 0
push eax
call fcn.00610b10
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 4]
add esp, 0xc
push ecx
push edi
push edx
push eax
lea ecx, [esi + 0x148]
call fcn.004024b9
test eax, eax
jne 0x5947c7
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push str.File_Open_Error_:__s
push edx
call fcn.00611035
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x1c]
jmp 0x59471d
mov ecx, dword [esi + 4]
push ecx
call fcn.00610cd6
mov eax, 1
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 0x2c], eax
jmp 0x594728
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esi + 0x24]
push 1
push eax
call fcn.00611708
mov eax, dword [esi + 0x20]
add esp, 0x10
test eax, eax
je 0x59481e
push eax
call fcn.0060fcba
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x20]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x28], eax
call fcn.00611708
add esp, 0x14
mov eax, dword [esi + 4]
push eax
push 1
lea ecx, [esi + 0x25]
push 1
push ecx
call fcn.00611708
mov edx, dword [esi + 4]
push edx
call fcn.00610cd6
add esp, 0x14
mov ecx, esi
mov dword [esi + 4], 0
call fcn.0040b1b8
test eax, eax
je 0x594726
call fcn.0040fadd
test eax, eax
je 0x594726
mov eax, 1
mov dword [esi + 0x2c], eax
jmp 0x594728
Function at 0x599320
Capabilities:
Resolve dns

Disassembly:
jmp 0x599320
sub esp, 0x114
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x18]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x599347
movsx eax, byte [esi]
push eax
call fcn.006151ca
add esp, 4
test eax, eax
je 0x5993bf
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x59942a
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x5993be
nop
movsx edx, word [esi + 0xa]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00613010
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x20]
push 0x666968
push eax
call fcn.00611035
mov ecx, dword [esi + 0xc]
inc edi
lea eax, [ecx + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x599380
pop edi
lea edx, [esp + 0x18]
push edx
push 0x20
push 0x7d4b7c
call fcn.00615115
mov eax, dword [0x7d4bc0]
mov esi, dword [esp + 0x130]
imul eax, eax, 0x58
add esp, 0xc
cmp si, word [eax + 0x7f0520]
jne 0x599407
cmp dword [0x7d4ba0], 0
je 0x599407
cmp dword [0x7d4bbc], 0
jne 0x599407
mov ecx, 0x7d4ba0
call fcn.00401d3e
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
mov eax, ecx
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
xor ecx, esp
call fcn.006111ee
add esp, 0x114
ret 8

Function at 0x5994b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x5994b0
sub esp, 0x2c
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
mov bl, 0x53
push edi
mov edi, ecx
cmp byte [esi + 1], bl
jb 0x5994e7
push 0
push 0xb6
push 0x66696c
call fcn.0040aec0
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x56734661
mov dword [esp + 0x14], 0x31313561
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x19], bl
mov dword [esp + 0x1a], 0x61637646
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov dword [esp + 0x21], 0x40215e59
mov dword [esp + 0x25], 0x5a767324
mov dword [esp + 0x29], 0x26317241
mov dword [esp + 0x2d], 0x2a21405e
mov dword [esp + 0x31], 0x786673
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x599544
sub eax, ecx
mov ecx, eax
xor edx, edx
lea ebx, [ecx - 1]
mov eax, ebp
div ebx
dec ecx
mov al, byte [esp + edx + 0x10]
xor byte [esi + 1], al
xor edx, edx
mov eax, ebp
div ecx
mov cl, byte [esp + edx + 0x10]
xor byte [esi + 2], cl
mov dl, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x599596
mov edi, dword [edi + 0x114]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push ebp
push esi
push eax
push edi
call edx
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006111ee
add esp, 0x2c
ret 8
Function at 0x59ae90
Capabilities:
Get file size

Disassembly:
jmp 0x59ae90
sub esp, 0x3a0
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x39c], eax
push esi
mov esi, dword [esp + 0x3b0]
push edi
mov edi, dword [esp + 0x3ac]
push 0x1ff
lea eax, [esp + 0x1a9]
push 0
push eax
mov byte [esp + 0x1b0], 0
call fcn.00610b10
add esp, 0xc
test esi, esi
je 0x59aef8
mov ecx, dword [esp + 0x3b0]
push esi
push ecx
push edi
lea edx, [esp + 0x1b0]
push str._s_line:_d__msg:_s_
push edx
call fcn.00611035
add esp, 0x14
jmp 0x59af16
mov eax, dword [esp + 0x3b0]
push eax
push edi
lea ecx, [esp + 0x1ac]
push str._s_line:_d_
push ecx
call fcn.00611035
add esp, 0x10
push 0xff
lea edx, [esp + 0xa9]
push 0
push edx
mov byte [esp + 0xb0], 0
call fcn.00610b10
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0xc]
push ecx
push edx
push eax
lea ecx, [esp + 0xb0]
push str.._Log_Debug__4d_02d_02d.txt
push ecx
call fcn.00611035
add esp, 0x14
cmp dword [0x7d6db4], 0
jne 0x59b071
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x59afef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa4]
push 0x666c90
push ecx
call fcn.00610fd7
mov esi, eax
add esp, 8
test esi, esi
je 0x59b071
call fcn.0040f335
push eax
lea edx, [esp + 0x1a8]
push edx
push 0x666c94
push esi
call fcn.00612331
push esi
call fcn.00610cd6
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.006111ee
add esp, 0x3a0
ret
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
ja 0x59b067
lea ecx, [esp + 0xa4]
push 0x666ca0
push ecx
call fcn.00610fd7
mov esi, eax
add esp, 8
test esi, esi
je 0x59b071
call fcn.0040f335
push eax
lea edx, [esp + 0x1a8]
push edx
push str._stime:_s_n
push esi
call fcn.00612331
push esi
call fcn.00610cd6
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.006111ee
add esp, 0x3a0
ret
mov dword [0x7d6db4], 1
mov ecx, dword [esp + 0x3a4]
pop edi
pop esi
xor ecx, esp
call fcn.006111ee
add esp, 0x3a0
ret
Function at 0x59b470
Capabilities:
Get file size

Disassembly:
jmp 0x59b470
sub esp, 0x2a0
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x29c], eax
cmp dword [0x7d6ad0], 0
mov ecx, dword [esp + 0x2a4]
mov eax, dword [esp + 0x2ac]
je 0x59b4eb
push eax
mov eax, dword [esp + 0x2ac]
push eax
push ecx
push 0x666b2c
push 0x7d69d0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x7d69d0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x59b686
int3
mov edx, dword [esp + 0x2a8]
test eax, eax
je 0x59b510
push eax
push edx
push ecx
lea eax, [esp + 0x1a8]
push 0x666b58
push eax
call fcn.00611035
add esp, 0x14
jmp 0x59b527
push edx
push ecx
lea eax, [esp + 0x1a4]
push 0x666b70
push eax
call fcn.00611035
add esp, 0x10
push 0xff
lea ecx, [esp + 0xa1]
push 0
push ecx
mov byte [esp + 0xa8], 0
call fcn.00610b10
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xa]
movzx ecx, word [esp + 6]
movzx edx, word [esp + 4]
push eax
push ecx
push edx
lea eax, [esp + 0xa8]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.00611035
add esp, 0x14
cmp dword [0x7d6de4], 0
jne 0x59b686
push esi
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x59b602
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xa4]
push 0x666ba0
push eax
call fcn.00610fd7
mov esi, eax
add esp, 8
test esi, esi
je 0x59b684
call fcn.0040f335
push eax
lea ecx, [esp + 0x1a8]
push ecx
push 0x666ba4
push esi
call fcn.00612331
push esi
call fcn.00610cd6
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.006111ee
add esp, 0x2a0
ret
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
ja 0x59b67a
lea eax, [esp + 0xa4]
push 0x666bb0
push eax
call fcn.00610fd7
mov esi, eax
add esp, 8
test esi, esi
je 0x59b684
call fcn.0040f335
push eax
lea ecx, [esp + 0x1a8]
push ecx
push 0x666bb4
push esi
call fcn.00612331
push esi
call fcn.00610cd6
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.006111ee
add esp, 0x2a0
ret
mov dword [0x7d6de4], 1
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.006111ee
add esp, 0x2a0
ret
Function at 0x607840
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x804
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
lea ecx, [ecx]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
lea esi, [eax + eax]
and edx, 0x1b
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
xor edx, esi
xor eax, edx
inc ecx
and eax, 0xff
cmp ecx, 0x100
jl 0x607860
mov eax, 1
mov ecx, 0x7fa7f0
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, 0xff
cmp ecx, 0x7fa818
jl 0x6078a0
mov byte [0x7f9ef0], 0x63
mov byte [0x7fc07b], 0
mov ebx, 1
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, [esp + 0x80c]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x7f9ef0], al
mov byte [eax + 0x7fc018], bl
inc ebx
cmp ebx, 0x100
jl 0x6078d8
xor ecx, ecx
lea ebx, [ebx]
movzx esi, byte [ecx + 0x7f9ef0]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x7fbc18], eax
rol eax, 8
mov dword [ecx*4 + 0x7fb818], eax
rol eax, 8
mov dword [ecx*4 + 0x7fb418], eax
rol eax, 8
mov dword [ecx*4 + 0x7fb018], eax
movzx eax, byte [ecx + 0x7fc018]
test eax, eax
je 0x607a06
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x607a0e
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x7fac18], edx
rol edx, 8
mov dword [ecx*4 + 0x7fa818], edx
rol edx, 8
mov dword [ecx*4 + 0x7fa3f0], edx
rol edx, 8
mov dword [ecx*4 + 0x7f9ff0], edx
inc ecx
cmp ecx, 0x100
jl 0x607950
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006111ee
add esp, 0x804
ret
Function at 0x607fd0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x607fd0
sub esp, 0x11c
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x118], eax
mov edx, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
mov eax, edx
sub eax, 0x80
push edi
mov edi, dword [esp + 0x124]
je 0x608021
sub eax, 0x40
je 0x608019
sub eax, 0x40
jne 0x6081d4
mov dword [edi], 0xe
jmp 0x608027
mov dword [edi], 0xc
jmp 0x608027
mov dword [edi], 0xa
push esi
push edx
push ecx
lea eax, [esp + 0x10]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.00410537
mov eax, dword [esp + 0x14]
shl eax, 4
add eax, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov ecx, dword [edi]
dec ecx
add esi, 0x10
sub eax, 0x10
test ecx, ecx
jle 0x6081bd
nop
movzx edx, byte [eax + 3]
movzx edx, byte [edx + 0x7f9ef0]
mov edx, dword [edx*4 + 0x7f9ff0]
movzx edi, byte [eax + 2]
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fa3f0]
movzx edi, byte [eax + 1]
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fa818]
mov edi, dword [eax]
and edi, 0xff
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fac18]
dec ecx
mov dword [esi], edx
mov edx, dword [eax + 4]
movzx edi, byte [eax + 7]
movzx edi, byte [edi + 0x7f9ef0]
and edx, 0xff
movzx edx, byte [edx + 0x7f9ef0]
mov edx, dword [edx*4 + 0x7fac18]
xor edx, dword [edi*4 + 0x7f9ff0]
movzx edi, byte [eax + 6]
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fa3f0]
movzx edi, byte [eax + 5]
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fa818]
add esi, 0x10
mov dword [esi - 0xc], edx
mov edx, dword [eax + 8]
movzx edi, byte [eax + 0xb]
movzx edi, byte [edi + 0x7f9ef0]
and edx, 0xff
movzx edx, byte [edx + 0x7f9ef0]
mov edx, dword [edx*4 + 0x7fac18]
xor edx, dword [edi*4 + 0x7f9ff0]
movzx edi, byte [eax + 0xa]
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fa3f0]
movzx edi, byte [eax + 9]
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fa818]
sub eax, 0x10
mov dword [esi - 8], edx
mov edx, dword [eax + 0x1c]
movzx edi, byte [eax + 0x1f]
movzx edi, byte [edi + 0x7f9ef0]
and edx, 0xff
movzx edx, byte [edx + 0x7f9ef0]
mov edx, dword [edx*4 + 0x7fac18]
xor edx, dword [edi*4 + 0x7f9ff0]
movzx edi, byte [eax + 0x1e]
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fa3f0]
movzx edi, byte [eax + 0x1d]
movzx edi, byte [edi + 0x7f9ef0]
xor edx, dword [edi*4 + 0x7fa818]
mov dword [esi - 4], edx
test ecx, ecx
jg 0x608070
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
pop esi
mov ecx, dword [esp + 0x11c]
pop edi
xor ecx, esp
call fcn.006111ee
add esp, 0x11c
ret
Function at 0x609460
Capabilities:
Read file on windows

Disassembly:
jmp 0x609460
sub esp, 0x730
mov eax, dword [0x7af4f8]
xor eax, esp
mov dword [esp + 0x72c], eax
mov eax, dword [esp + 0x738]
push ebx
mov ebx, dword [esp + 0x738]
push esi
mov esi, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
test ebx, ebx
jne 0x609499
xor eax, eax
jmp 0x60963c
test eax, eax
je 0x609492
push edi
push ebx
push 1
lea eax, [esp + 0x1a]
push 1
push eax
call fcn.00611708
push 0x200
xor edi, edi
lea ecx, [esp + 0x54c]
push edi
push ecx
add esi, 0x10
call fcn.00610b10
lea edx, [esp + 0x30]
push edx
push str._02X
push esi
call fcn.00613412
add esp, 0x28
test eax, eax
jle 0x60950e
lea esp, [esp]
cmp edi, 0x200
jge 0x60950e
mov al, byte [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
add esi, 2
push str._02X
mov byte [esp + edi + 0x540], al
push esi
inc edi
call fcn.00613412
add esp, 0xc
test eax, eax
jg 0x6094e0
push ebp
push 0x100
lea edx, [esp + 0x540]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.0040faa1
mov ebp, dword [esp + 0x758]
mov cl, byte [esp + 0x75c]
add esp, 0xc
xor edi, edi
mov byte [esp + 0x13], cl
test ebp, ebp
jle 0x6095ed
push ebx
push 0x10
lea edx, [esp + 0x144]
push 1
push edx
call fcn.00611708
add esp, 0x10
cmp eax, 0x10
jne 0x609616
lea eax, [esp + 0x13c]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.0040f100
mov ecx, dword [esp + 0x30]
xor eax, eax
add esp, 0x10
xor dl, dl
mov byte [esp + 0x15], al
mov byte [esp + 0x14], al
lea esi, [ecx + edi + 1]
mov cl, byte [esp + eax + 0x13c]
add byte [esp + 0x13], cl
mov byte [esi + eax - 1], cl
mov cl, byte [esp + eax + 0x13d]
add byte [esp + 0x14], cl
mov byte [esi + eax], cl
mov cl, byte [esp + eax + 0x13e]
add byte [esp + 0x15], cl
mov byte [esi + eax + 1], cl
mov cl, byte [esp + eax + 0x13f]
mov byte [esi + eax + 2], cl
add eax, 4
add dl, cl
cmp eax, 0x10
jl 0x609591
add dl, byte [esp + 0x15]
mov ebx, dword [esp + 0x1c]
add dl, byte [esp + 0x14]
add edi, 0x10
add byte [esp + 0x13], dl
cmp edi, ebp
jl 0x609545
push ebx
push 1
lea edx, [esp + 0x1f]
push 1
push edx
call fcn.00611708
mov al, byte [esp + 0x26]
add esp, 0x10
cmp al, byte [esp + 0x17]
jne 0x609624
cmp al, byte [esp + 0x13]
jne 0x609624
mov eax, 1
jmp 0x60963a
push 0
push 0x66f428
push 0x66f430
jmp 0x609630
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop edi
mov ecx, dword [esp + 0x734]
pop esi
pop ebx
xor ecx, esp
call fcn.006111ee
add esp, 0x730
ret 0x10

Function at 0x6111ee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x7af4f8]
jne 0x6111f8
repz ret
jmp fcn.0061b065