joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10
push ebx
push ebp
lea eax, [esp + 8]
push esi
xor ebx, ebx
push eax
push ebx
push ebx
push pe_nt_image_headers32
push str.Recent_Maps
push 0x49dc0c
mov ebp, 5
mov dword [esp + 0x24], ebx
call sub.Storm.dll_Ordinal_421
test eax, eax
je 0x470a40
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x470a40
push ebx
push 0x23e
push str.C:war2bneBattle.netgluMap.cpp
push eax
call sub.Storm.dll_Ordinal_401
mov ecx, dword [esp + 0xc]
mov esi, eax
push ebx
push ecx
push esi
push pe_nt_image_headers32
push str.Recent_Maps
push 0x49dc0c
mov dword [esp + 0x2c], esi
call sub.Storm.dll_Ordinal_421
test eax, eax
jne 0x4708ce
push ebx
push 0x245
push str.C:war2bneBattle.netgluMap.cpp
push esi
call sub.Storm.dll_Ordinal_403
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp esi, ebx
je 0x470a40
mov eax, dword [esp + 0xc]
push edi
cmp eax, ebx
mov dword [esp + 0x14], eax
mov edi, esi
jle 0x470a2e
jmp 0x4708ef
mov ebp, dword [esp + 0x1c]
cmp byte [edi], bl
je 0x470a2e
mov edx, ebp
dec ebp
test edx, edx
mov dword [esp + 0x1c], ebp
je 0x470a2e
push edi
call sub.Storm.dll_Ordinal_506
mov ecx, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x14]
inc ebp
push eax
push ecx
push edi
call fcn.00477d90
add esp, 0xc
test eax, eax
jbe 0x470a1a
push edi
call fcn.004734b0
add esp, 4
test eax, eax
jne 0x470947
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x470a1a
mov esi, dword [0x4d1a60]
cmp esi, ebx
jle 0x47097b
lea edx, [esi + 0x269]
push edi
push edx
call fcn.0047c900
add esp, 8
test eax, eax
je 0x470977
cmp esi, ebx
jne 0x47096e
mov esi, 0x4d1a5c
mov esi, dword [esi + 4]
cmp esi, ebx
jg 0x470951
jmp 0x47097b
cmp esi, ebx
jne 0x4709ab
push 0x5c
push edi
call fcn.0047c8d0
add esp, 8
cmp eax, ebx
je 0x47099b
mov byte [eax], bl
inc eax
push eax
push edi
push 0x14
call fcn.00470590
add esp, 0xc
jmp 0x470a16
mov eax, edi
push eax
push edi
push 0x14
call fcn.00470590
add esp, 0xc
jmp 0x470a16
mov edx, dword [esi]
cmp edx, ebx
je 0x4709d4
mov ecx, dword [esi + 4]
cmp ecx, ebx
jg 0x4709bc
not ecx
jmp 0x4709c3
mov eax, esi
sub eax, dword [edx + 4]
add ecx, eax
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
mov dword [esi], ebx
mov dword [esi + 4], ebx
cmp dword [esi], ebx
je 0x4709f2
push 0xffffffffffffffff
mov ecx, esi
call fcn.00471d50
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov eax, dword [0x4d1a5c]
mov dword [esi], eax
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov dword [eax + 4], esi
mov dword [0x4d1a5c], esi
mov al, byte [esi + 0x268]
or al, 0x10
mov byte [esi + 0x268], al
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add edi, ebp
sub eax, ebp
cmp eax, ebx
mov dword [esp + 0x14], eax
jg 0x4708eb
push ebx
push 0x281
push str.C:war2bneBattle.netgluMap.cpp
push esi
call sub.Storm.dll_Ordinal_403
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x489040
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0x100
mov edi, 0x4d54a8
push 0x100
push eax
push 0x4d54a8
rep stosd dword es:[edi], eax
mov byte [0x4aa388], 0
call fcn.0048a720
push 0x1df
push 0x27f
push 0
push 0
call fcn.004ebd35
call fcn.004051d0
mov ecx, 0x100
xor eax, eax
mov edi, 0x4d58a8
push 1
rep stosd dword es:[edi], eax
call fcn.00409d50
add esp, 0x20
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_GetTickCount
movsx esi, word [esp + 0x10]
movsx edi, word [esp + 0x18]
mov ebp, eax
xor ecx, ecx
mov bl, byte [ecx + 0x4d58a8]
xor edx, edx
mov dl, byte [ecx + 0x4d60ac]
mov eax, ebx
and eax, 0xff
sub edx, eax
mov eax, esi
imul eax, edx
cdq
idiv edi
add al, bl
mov byte [ecx + 0x4d54a8], al
inc ecx
cmp ecx, 0x400
jb 0x4890b5
push 0x100
push 0
push 0x4d54a8
call fcn.0048a720
add esp, 0xc
call sub.KERNEL32.dll_GetTickCount
mov ecx, eax
sub ecx, ebp
cmp ecx, 0x10
jae 0x48911c
mov edx, ebp
sub edx, eax
add edx, 0x10
push edx
call fcn.004604f0
add esp, 4
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
sub eax, ebp
cmp ecx, edx
jae 0x48913a
lea esi, [eax + ecx]
cmp esi, edx
jbe 0x48913a
mov dword [esp + 0x10], edx
jmp 0x4890a2
add ecx, eax
cmp ecx, edx
mov dword [esp + 0x10], ecx
jbe 0x4890a2
push 1
call fcn.00409d50
add esp, 4
cmp word [0x4d6530], 0
pop edi
pop esi
pop ebp
pop ebx
je 0x489173
push 0
call fcn.00489870
add esp, 4
mov word [0x4d6530], 0
pop ecx
ret

Function at 0x489180
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 ksa

Disassembly:
push ecx
cmp word [0x4d6530], 0
mov byte [0x4aa388], 1
jne 0x4891a5
push 1
call fcn.00489870
add esp, 4
mov word [0x4d6530], 1
push ebx
push ebp
push esi
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x4d60ac
mov esi, 0x4d54a8
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x4d58a8
rep movsd dword es:[edi], dword [esi]
push 1
call fcn.00409d50
add esp, 4
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_GetTickCount
movsx esi, word [esp + 0x10]
movsx edi, word [esp + 0x18]
mov ebp, eax
xor ecx, ecx
mov bl, byte [ecx + 0x4d58a8]
xor edx, edx
mov dl, byte [ecx + 0x4d60ac]
mov eax, ebx
and eax, 0xff
sub edx, eax
mov eax, esi
imul eax, edx
cdq
idiv edi
add al, bl
mov byte [ecx + 0x4d54a8], al
inc ecx
cmp ecx, 0x400
jb 0x4891ed
push 0x100
push 0
push 0x4d54a8
call fcn.0048a720
add esp, 0xc
call sub.KERNEL32.dll_GetTickCount
mov ecx, eax
sub ecx, ebp
cmp ecx, 0x10
jae 0x489254
mov edx, ebp
sub edx, eax
add edx, 0x10
push edx
call fcn.004604f0
add esp, 4
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
sub eax, ebp
cmp ecx, edx
jae 0x489272
lea esi, [eax + ecx]
cmp esi, edx
jbe 0x489272
mov dword [esp + 0x10], edx
jmp 0x4891da
add ecx, eax
cmp ecx, edx
mov dword [esp + 0x10], ecx
jbe 0x4891da
push 1
call fcn.00409d50
call fcn.004051d0
push 0x100
push 0
push 0x4d5ca8
call fcn.0048a720
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x48a1d0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
sub esp, 0x8a4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 0x10], esi
push esi
lea eax, [esp + 0xb0]
push str.screen_03d.PCX
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0xac]
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x48a235
call ebp
cmp eax, 2
jne 0x48a235
lea edx, [esp + 0xac]
push 0xe
push edx
call fcn.00489b40
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
jne 0x48a253
inc esi
cmp esi, 0x3e8
jl 0x48a1f2
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x48a253
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8a4
ret
push 0x100
lea eax, [esp + 0x4b8]
push 0
push eax
call fcn.0048a830
add esp, 0xc
call fcn.00489510
xor ebp, ebp
lea ecx, [esp + 0x24]
push ebp
lea edx, [esp + 0x18]
push ecx
push edx
push ebp
push ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x28], ebp
call sub.Storm.dll_Ordinal_350
test eax, eax
je 0x48a411
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x2c]
jmp 0x4eac90
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48a425
push 0
push 0
push eax
push 0
call sub.Storm.dll_Ordinal_356
mov edx, dword [esp + 0x10]
push edx
call fcn.00489b30
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
jne 0x48a448
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00489510
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8a4
ret

Function at 0x48b4e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.0047ff4c
nop
nop
nop
nop
nop
nop
Function at 0x48c0a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
test edi, edi
jne 0x48c0c2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
mov al, byte [edi]
mov esi, edi
test al, al
je 0x48c160
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov al, byte [esi]
test al, al
je 0x48c0ec
cmp al, 0x5c
je 0x48c0ec
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x48c0e0
mov eax, esi
sub eax, edi
add eax, 2
cmp eax, 0x105
jb 0x48c0ff
mov eax, 0x105
push eax
lea eax, [esp + 0x14]
push edi
push eax
call sub.Storm.dll_Ordinal_501
cmp eax, 0x104
jae 0x48c0b5
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x48c12a
cmp byte [esi], 0
je 0x48c160
jmp 0x48c154
call ebx
cmp eax, 0xb7
je 0x48c13c
cmp eax, 5
jne 0x48c0b5
lea edx, [esp + 0x10]
push edx
call ebp
cmp eax, 0xffffffff
je 0x48c0b5
test al, 0x10
je 0x48c0b5
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x48c0da
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret

Function at 0x48cc60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [ecx]
mov edx, esi
dec esi
test edx, edx
je 0x48cc9a
mov edx, dword [esp + 8]
xor ecx, ecx
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4ab0f0]
xor ecx, eax
mov eax, ecx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x48cc78
pop esi
ret
Function at 0x4e1e41
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
cmp ebp, 7
jbe 0x4e1f20
lea ebx, [ebp - 8]
shr ebx, 3
add ebx, 1
add ebx, ebx
add ebx, ebx
add ebx, ebx
add ebx, ecx
mov eax, 0xffffffff
mov dword [esp], ebx
movzx esi, byte [ecx + 3]
mov edx, eax
shr edx, 0x18
xor esi, edx
movzx edx, byte [ecx + 4]
movzx edi, byte [ecx + 5]
mov edx, dword [edx*4 + 0x4f2800]
xor edx, dword [edi*4 + 0x4f2c00]
movzx edi, byte [ecx + 6]
xor edx, dword [edi*4 + 0x4f3000]
movzx edi, byte [ecx + 7]
xor edx, dword [edi*4 + 0x4f3400]
movzx edi, byte [ecx]
xor edi, eax
mov ebx, edi
movzx edi, bl
xor edx, dword [edi*4 + 0x4f1800]
movzx edi, ah
movzx ebp, byte [ecx + 1]
xor edi, ebp
xor edx, dword [edi*4 + 0x4f1c00]
shr eax, 0x10
xor al, byte [ecx + 2]
movzx eax, al
xor edx, dword [eax*4 + 0x4f2000]
mov eax, dword [esi*4 + 0x4f2400]
xor eax, edx
add ecx, 8
mov esi, dword [esp]
cmp ecx, esi
jne 0x4e1e72
mov ebx, esi
mov ebp, dword [esp + 0x1c]
and ebp, 7
test ebp, ebp
je 0x4e1f16
add ebp, ebx
add ebx, 1
movzx edx, byte [ebx - 1]
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x4f3400]
cmp ebx, ebp
jne 0x4e1efc
not eax
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, ecx
mov eax, 0xffffffff
jmp 0x4e1ef6
Function at 0x4ebe6e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
cmp word [0x4ae430], 4
je 0x4ebea3
xor eax, eax
mov esi, dword [0x4d4a94]
cmp dword [0x4f5020], esi
je 0x4ebfe4
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
call fcn.004e9b18
mov ebx, eax
mov dword [esp + 0x3c], 5
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x27b
mov dword [esp + 0x48], 0x1db
mov eax, dword [0x5354a8]
mov dword [esp + 8], eax
mov eax, dword [0x5354ac]
mov dword [esp + 4], eax
lea ecx, [esp + 0x3c]
mov dword [esp], ecx
call dword [0x536414]
sub esp, 0xc
movzx eax, byte [esp + 0xa0]
mov byte [esp + 0x4c], al
mov dword [esp + 0x4d], 0x69575b20
mov dword [esp + 0x51], 0x63736564
mov dword [esp + 0x55], 0x6e656572
mov dword [esp + 0x59], 0x74615020
mov dword [esp + 0x5d], 0x76206863
mov dword [esp + 0x61], 0x5d372e31
mov dword [esp + 0x65], 0x74746820
mov dword [esp + 0x69], 0x2f2f3a70
mov dword [esp + 0x6d], 0x63726177
mov dword [esp + 0x71], 0x74666172
mov dword [esp + 0x75], 0x6e6f2e32
mov dword [esp + 0x79], 0x656e696c
mov word [esp + 0x7d], 0x20
mov byte [esp + 0x7f], al
mov dword [esp + 4], 0
mov dword [esp], ebx
mov edx, dword [0x536258]
mov dword [esp + 0x2c], edx
call edx
sub esp, 8
mov edi, eax
mov dword [esp + 4], 0xffffff
mov dword [esp], ebx
mov ebp, dword [0x536260]
call ebp
sub esp, 8
mov esi, eax
mov dword [esp + 0x10], 0x128
lea ecx, [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0xffffffff
lea eax, [esp + 0x4d]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [0x536408]
sub esp, 0x14
mov dword [esp + 4], edi
mov dword [esp], ebx
mov edx, dword [esp + 0x2c]
call edx
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], ebx
call ebp
sub esp, 8
jmp 0x4ebe82
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
call dword [sym.imp.Storm.dll_Ordinal_350]
sub esp, 0x14
test eax, eax
setne al
movzx eax, al
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
Function at 0x4ebee9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
cmp word [0x4ae430], 4
je 0x4ebea3
xor eax, eax
mov esi, dword [0x4d4a94]
cmp dword [0x4f5020], esi
je 0x4ebfe4
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
call fcn.004e9b18
mov ebx, eax
mov dword [esp + 0x3c], 5
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x27b
mov dword [esp + 0x48], 0x1db
mov eax, dword [0x5354a8]
mov dword [esp + 8], eax
mov eax, dword [0x5354ac]
mov dword [esp + 4], eax
lea ecx, [esp + 0x3c]
mov dword [esp], ecx
call dword [0x536414]
sub esp, 0xc
movzx eax, byte [esp + 0xa0]
mov byte [esp + 0x4c], al
mov dword [esp + 0x4d], 0x69575b20
mov dword [esp + 0x51], 0x63736564
mov dword [esp + 0x55], 0x6e656572
mov dword [esp + 0x59], 0x74615020
mov dword [esp + 0x5d], 0x76206863
mov dword [esp + 0x61], 0x5d372e31
mov dword [esp + 0x65], 0x74746820
mov dword [esp + 0x69], 0x2f2f3a70
mov dword [esp + 0x6d], 0x63726177
mov dword [esp + 0x71], 0x74666172
mov dword [esp + 0x75], 0x6e6f2e32
mov dword [esp + 0x79], 0x656e696c
mov word [esp + 0x7d], 0x20
mov byte [esp + 0x7f], al
mov dword [esp + 4], 0
mov dword [esp], ebx
mov edx, dword [0x536258]
mov dword [esp + 0x2c], edx
call edx
sub esp, 8
mov edi, eax
mov dword [esp + 4], 0xffffff
mov dword [esp], ebx
mov ebp, dword [0x536260]
call ebp
sub esp, 8
mov esi, eax
mov dword [esp + 0x10], 0x128
lea ecx, [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0xffffffff
lea eax, [esp + 0x4d]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [0x536408]
sub esp, 0x14
mov dword [esp + 4], edi
mov dword [esp], ebx
mov edx, dword [esp + 0x2c]
call edx
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], ebx
call ebp
sub esp, 8
jmp 0x4ebe82
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
call dword [sym.imp.Storm.dll_Ordinal_350]
sub esp, 0x14
test eax, eax
setne al
movzx eax, al
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret 0x14

Function at 0x4ed320
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4ed345
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4ed350
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4ed345
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4ed398
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4ed38e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4ed39a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x4ed380
xor eax, eax
pop ebx
pop esi
ret
Function at 0x10001044
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x10014efc
sub byte [esi - 0x1a3], 0xd8
pop esi
jmp 0x1000107d
jmp 0x100010a4
xor eax, eax
jmp 0x10001414
call fcn.100010ab
test eax, eax
jne 0x10001422
ret
push ebp
push eax
mov eax, 0x10015143
add dword [eax - 0x3c], 0x25b5642c
xor byte [eax - 0x365], 0xf5
pop eax
push ebx
mov ebx, eax
call fcn.1000121c
sub esp, 4
push esi
pop dword [0x10014db5]
mov dword [esp], 0x35485406
add dword [esp], 0x343216f8
push eax
call fcn.1000125f
push 0x40
push 0x71bbe571
push ecx
inc ecx
not ecx
mov ecx, 0x71bbd571
xor dword [esp + 4], ecx
pop ecx
mov ecx, 0xe640
pushal
sbb dword [0x10014dec], 0xc7771e73
call fcn.1000121c
mov edx, eax
or dword [0x10014dbf], ecx
sub esp, 4
mov dword [esp], 0xf8db8669
push edi
mov edi, 0x10014ff3
add word [edi + 0xc1], 0xf648
sub word [edi - 0xfa], 0xfce1
pop edi
add dword [esp], 0x343216f8
push edx
xor word [0x10014fff], 0x6a06
jmp loc.10021998

Function at 0x1000121c
Capabilities:
Access peb ldr_data

Disassembly:
push esi
jmp 0x1000123c
xor eax, eax
mov eax, dword fs:[eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
pop esi
ret

Function at 0x1000125f
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push edx
push ecx
mov ecx, 0x10014e79
xor dword [ecx - 0x121], 0x1638db40
pop ecx
push esi
push edi
mov ebx, dword [ebp + 8]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
push dword [ebx + 0x7c]
push 0x9c830a79
pop dword [0x10014f30]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
add dword [esp], ebx
push edi
mov edi, 0x10015138
xor dword [edi - 0x326], 0x411f6b3b
mov byte [edi - 0x258], 0x58
pop edi
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
jmp 0x100012f4
jmp 0x1000132b
jmp 0x10001351
add edx, ecx
mov dword [ebp - 4], edx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x10001358
mov dword [0x10014d6c], edi
cmp eax, dword [ebp + 0xc]
je 0x10001380
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x100012b7
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
push edi
mov edi, 0x10014d8f
and byte [edi + 0xfc], 0xef
mov word [edi + 0x185], 0x3fc
pop edi
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
pop ecx
cmp eax, ebx
jbe 0x100013fb
cmp eax, ecx
jae 0x100013fb
push edi
mov edi, 0x10014e35
sbb word [edi + 0xbf], 0x63e8
and word [edi + 0x31f], 0x6a01
pop edi
push dword [ebp - 4]
push dword [ebp + 8]
sub esp, 4
mov dword [esp], 0xeb8ed3f6
add dword [esp], 0x343216f8
push dword [ebp + 8]
call fcn.1000125f
call eax
sub dword [0x10014ed7], edi
pop edi
pop esi
push ecx
mov ecx, 0x10015162
sub dword [ecx - 0x2bf], 0x15bc800
pop ecx
pop edx
pop ebx
leave
ret 8
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x405301
pop dword [ebp - 0x30]
mov eax, 0x908e122a
add eax, 0x6fb240d7
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x27b54fca
sub dword [ebp - 0x40], 0xd9630a7f
mov dword [ebp - 0x3c], 0xee3b7ddf
sub dword [ebp - 0x3c], 0xbc08319a
mov dword [ebp - 0x38], 0x50b5e569
add dword [ebp - 0x38], 0xfb965ec5
mov dword [ebp - 0x34], 0x6d635d34
sub dword [ebp - 0x34], 0x6d635d34
lea eax, [ebp - 0x40]
push eax
mov eax, 0xda50d25c
add eax, 0x25effdf8
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x93a83155
add dword [ebp - 0x40], 0xe0ca3801
mov dword [ebp - 0x3c], 0x6a5c6a3a
add dword [ebp - 0x3c], 0xd70ff73b
mov dword [ebp - 0x38], 0xba2e31e
sub dword [ebp - 0x38], 0xa83376b2
mov dword [ebp - 0x34], 0xed965d53
add dword [ebp - 0x34], 0x1269a2ad
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38c22
push 0
call eax
mov ecx, 0x1cfe0497
add ecx, 0xe302404a
xor esi, esi
add esi, eax
mov edi, 0x2530dbcb
add edi, 0xdb10d435
add edi, dword [ebp - 0x30]
mov edx, 0xd10f8e2c
sub edx, 0x3596dd8c
sub dword [ebp - 0x24], 0x6479478d
mov ebx, dword [edi]
mov dword [ebp - 0x2c], 0xeaadbd4e
xor ebx, edx
add dword [ebp - 0xc], 0x6f4c4fe2
mov dword [esi], ebx
sub dword [ebp - 8], ebx
add esi, 4
add edi, 0x79f44e40
add edi, 0x860bb1c4
loop 0x405420
add eax, 0xda3a14da
add eax, 0x25c6f17d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc76121fb
sub ecx, 0xc72121fb
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40a010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cecad
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x51808c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x29], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x40a070
mov eax, dword [eax]
push 0x4f8640
push eax
call fcn.004aa06e
mov edi, eax
add esp, 8
test edi, edi
jne 0x40a0db
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40a0b8
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40a0ae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a1ee
push edx
push ecx
call fcn.004a4ef3
add esp, 8
mov bl, byte [ebp - 0x29]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4a5b
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push edi
call fcn.004aa54f
add esp, 0xc
push edi
call fcn.004a9f54
mov ecx, eax
add esp, 4
test ecx, ecx
js 0x40a084
mov edx, dword [ebp - 0x18]
cmp ecx, edx
ja 0x40a112
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x40a159
mov esi, dword [ebp - 0x14]
mov ebx, ecx
mov eax, esi
sub ebx, edx
sub eax, edx
cmp ebx, eax
ja 0x40a143
cmp esi, 0x10
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ebx
push 0
lea esi, [edx + eax]
push esi
call fcn.004a68e0
add esp, 0xc
mov byte [esi + ebx], 0
jmp 0x40a156
push 0
push ebx
mov byte [ebp - 0x34], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x34]
push ebx
call fcn.0040ab90
mov ebx, dword [ebp - 0x30]
push 0
push 0
push edi
call fcn.004aa54f
add esp, 0xc
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push edi
push dword [ebp - 0x18]
push 1
push eax
call fcn.004aaae4
push edi
call fcn.004aa1f1
add esp, 0x14
cmp dword [ebp - 0x18], 0
je 0x40a084
push ebx
push 0x518fc4
mov edx, 0x518bbc
lea ecx, [ebp - 0x28]
call fcn.00416840
mov edx, dword [ebp - 0x14]
add esp, 8
test al, al
je 0x40a087
cmp dword [ebx + 0x10], 0
setne bl
cmp edx, 0x10
jb 0x40a0bb
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40a1df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a1ee
push edx
push ecx
call fcn.004a4ef3
add esp, 8
jmp 0x40a0bb
call fcn.004aae73
int3