joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, ecx
and esi, 3
je 0x4088eb
cmp esi, 2
jne 0x4088fb
shr ecx, 1
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp 0x40898d
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
jmp 0x40898d
test ecx, ecx
je 0x40898d
mov edi, ecx
and edi, 7
je 0x40892b
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
mov byte [eax + esi], bl
inc esi
cmp edi, esi
jne 0x408910
add edx, esi
mov edi, ecx
sub edi, esi
add esi, eax
cmp ecx, 8
jae 0x408934
jmp 0x40898d
mov edi, ecx
mov esi, eax
cmp ecx, 8
jb 0x40898d
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
movzx ebx, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], bl
movzx ebx, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], bl
movzx ebx, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], bl
movzx ebx, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], bl
movzx ebx, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], bl
movzx ebx, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], bl
movzx ebx, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], bl
add ecx, 8
cmp edi, ecx
jne 0x408940
pop esi
pop edi
pop ebx
ret

Function at 0x4090a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
call fcn.004091b0
push eax
mov edi, esp
sub esp, 0x100
mov esi, esp
jmp 0x4090b7
call fcn.00430970
jmp 0x4090be
test al, 1
jne 0x4090c4
jmp 0x409140
call fcn.0042be80
test al, 1
jne 0x4090cf
jmp 0x40913b
sub esp, 4
mov dword [esp], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x4090e1
mov dword [edi], eax
xor eax, eax
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x100
call fcn.004089a0
add esp, 0xc
jmp 0x409105
lea eax, str.eleet_or_leetspeak__is_a_system_of_modified_spellings_used_primarily_on_the_internet._it_often_uses_character_replacements_in_ways_that_play_on_the_similarity_of_their_glyphs_via_reflection_or_other_resemblance
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409160
add esp, 8
jmp 0x40911f
call fcn.0040a560
jmp 0x409126
test al, 1
jne 0x40912c
jmp 0x409133
call fcn.00411790
jmp 0x409133
jmp 0x409135
jmp 0x409137
jmp 0x409139
jmp 0x40913b
call fcn.00432b50
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40933a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40924d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409271
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409240
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409240
lea esi, [ebx + 1]
push esi
call fcn.0042f750
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409348
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x4092b8
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x40934a
movzx edx, word [edi]
test dx, dx
je 0x40934a
cmp dx, 0x7f
jbe 0x4092a0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x409300
cmp esi, 0x7ff
ja 0x409300
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x4092a7
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x4092a7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x4092a7
push 1
call fcn.0042f750
add esp, 4
mov ebp, eax
jmp 0x40934a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409367
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409362
test eax, eax
jne 0x409360
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004053c0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40a340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
lea edx, [edi - 1]
mov eax, edi
inc edx
cmp byte [eax], 0
lea eax, [eax + 1]
jne 0x40a350
mov eax, edx
xor eax, edi
mov ecx, edi
not ecx
and ecx, edx
add ecx, ecx
mov edx, ecx
sub edx, eax
lea esi, [edx + edx*2]
shr esi, 2
mov dword [esp], edx
movzx edx, byte [edx + edi - 1]
cmp edx, 0x3d
je 0x40a381
cmp edx, 0x2e
jne 0x40a382
dec esi
mov edx, dword [esp]
movzx edx, byte [edx + edi - 2]
cmp edx, 0x3d
je 0x40a394
cmp edx, 0x2e
jne 0x40a395
dec esi
mov dword [esp + 8], esi
mov esi, 0
cmp ecx, eax
mov edi, dword [esp]
jne 0x40a42d
mov ebx, dword [esp + 8]
cmp esi, ebx
mov eax, 0
jne 0x40a425
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x48]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, ebx
add eax, 0xffffffe0
je 0x40a421
xor edi, edi
cmp ebx, 0x21
je 0x40a40b
mov ecx, eax
and ecx, 0xfffffffe
xor edi, edi
nop
nop
mov edx, edi
and edx, 0x1e
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [esi + edi + 0x20]
mov byte [esi + edi], dl
lea edx, [edi + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [esi + edi + 0x21]
mov byte [esi + edi + 1], dl
add edi, 2
cmp ecx, edi
jne 0x40a3e0
test bl, 1
je 0x40a421
mov ecx, edi
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0x10]
xor cl, byte [esi + edi + 0x20]
mov byte [esi + edi], cl
mov byte [esi + eax], 0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
mov ebp, 2
jmp 0x40a45a
mov edx, edi
lea eax, [ebp + 4]
add ebp, 2
mov esi, dword [esp + 4]
mov ecx, esi
cmp ebp, edx
mov ebp, eax
mov edi, edx
jae 0x40a3a9
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x44]
movzx eax, byte [esi + ebp - 2]
push eax
call fcn.004114d0
add esp, 4
mov ebx, eax
movzx eax, byte [esi + ebp - 1]
push eax
call fcn.004114d0
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
mov edx, dword [esp + 0xc]
lea ecx, [edx + 1]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x48]
mov byte [ecx + edx], al
cmp ebp, edi
jae 0x40a440
mov edi, edx
movzx eax, byte [esi + ebp]
push eax
call fcn.004114d0
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x40a442
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
mov esi, edi
lea ecx, [edi + 2]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x48]
mov byte [ecx + edi + 1], al
lea eax, [ebp + 1]
cmp eax, edx
jae 0x40a442
mov eax, dword [esp + 0x44]
movzx eax, byte [eax + ebp + 1]
push eax
call fcn.004114d0
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x40a442
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x48]
mov byte [ecx + edi + 2], al
add edi, 3
mov dword [esp + 4], edi
jmp 0x40a442
Function at 0x433eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov ebx, dword [esp + 0x70]
mov ebp, dword [esp + 0x5c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x433ed0
cmp edi, 0xfffffff5
jge 0x433ee7
mov eax, 0xffffffff
jmp 0x433eea
lea eax, [edi + 0xa]
push eax
call fcn.0042f750
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebp]
test cx, cx
je 0x433f32
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebp]
add ebp, 2
test cx, cx
jne 0x433f20
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 0x18], ax
add edi, 0xa
mov word [esp + 0x1a], di
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov ecx, dword [0x442978]
mov edi, 0xffffffff
test ecx, ecx
je 0x434074
mov eax, dword [0x44297c]
add eax, 8
nop
nop
nop
nop
nop
nop
nop
cmp dword [eax - 8], 0xb1cf12ba
je 0x433fb4
add eax, 0xc
dec ecx
jne 0x433fa0
jmp 0x434074
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], 0x900000c2
mov dword [esp + 0xc], 0xd2ff0000
mov dword [esp + 8], 0xba00
mov dword [esp + 4], 0xb8
mov eax, dword [eax]
mov dword [esp + 5], eax
mov eax, dword [0x442980]
mov dword [esp + 0xa], eax
mov word [esp + 0x11], 0x2c
mov dword [esp], 0
mov dword [esp + 0x24], 0x10
lea eax, [esp + 0x24]
mov ebp, esp
push 0x40
push 0x3000
push eax
push 0
push ebp
push 0xffffffffffffffff
call dword [0x442984]
mov edi, dword [esp]
lea eax, [esp + 4]
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea ecx, [esp + 0x40]
lea eax, [esp + 0x28]
push 0
push 0
push ebx
push dword [esp + 0x78]
push dword [esp + 0x78]
push 0x80
push 0
push ecx
push eax
push dword [esp + 0x88]
push dword [esp + 0x88]
call dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push 0x8000
push eax
push ebp
push 0xffffffffffffffff
call dword [0x442988]
push esi
call fcn.004088a0
add esp, 4
mov eax, edi
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40585e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x426730], 0x44
push eax
xor eax, eax
push 0x426730
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40589d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405927
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405d2e
mov edi, eax
cmp edi, 0xffffffff
je 0x405968
test byte [esp + 0x10], 1
push esi
je 0x40594a
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x405950
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405959
xor eax, eax
inc eax
jmp 0x40596a
test byte [esp + 0x10], 4
jne 0x405968
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x4064e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40650c
xor eax, eax
test eax, eax
je 0x40651f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40651f
xor ecx, ecx
jmp 0x406522
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406609
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x406640
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40661a
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406615
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406671
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406653
pop edi
not eax
pop esi
ret 0xc

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.004014da

Function at 0x4014da
Capabilities:
Delete file
Encode data using base64 via winapi
Get common file path

Disassembly:
push ecx
push edx
enter 0x220, 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x4011f7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a11c]
jne 0x401201
repz ret
jmp fcn.00402742
Function at 0x403183
Capabilities:
Contain obfuscated stackstrings

Disassembly:
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx

Function at 0x4032ec
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
push edx
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00402e05
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x403404
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00402e05
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x4033d1
call fcn.00402e94
pop ebp
out dx, al
out 0xc2, eax
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx

Function at 0x403420
Capabilities:
Inspect section memory permissions

Disassembly:
je 0x403683
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x403439
cmp dword [eax + 0xc], ebx
je 0x4034dc
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00402e94
cmp edi, dword [esi - 0x6b]
movsd dword es:[edi], dword [esi]
cmp dword [ebp + 0xc], ebx
jne 0x403468
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x403683
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x40347c
mov dword [ebp + 0x10], edi
jmp 0x403481
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.00402e94
inc edi
cmp edi, dword [eax + 0x10458b43]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x4034ca
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x4034a5
and eax, 0xffff
push eax
jmp 0x4034a9
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00402e59
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x403683
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x40348a
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x40342b
call fcn.00402e94
cwde
js 0x4034a8
mov ebp, 0xa0878b
add byte [eax], al
cmp eax, ebx
je 0x403548
add eax, esi
cmp dword [eax], ebx
je 0x403548
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x403543
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
cli
add byte [eax], dh
add byte [eax], al
jne 0x40352d
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x403535
cmp edx, ebx
jne 0x403683
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x403504
add eax, dword [eax + 4]
jmp 0x4034f1
mov dword [ebp + 0xc], ebx
jmp 0x403553
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40356b
invalid
xchg ebp, eax
Function at 0x4036ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edx
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00402ea4
pop ecx
push eax

Function at 0x40373a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402e59
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
add al, 0
add byte [eax], al

Function at 0x403760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 0
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00402ea4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402e59
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00402ea4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402e59
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00402e94
sub al, ah
mov ch, 0x80
movsd dword es:[edi], dword [esi]
int3
Function at 0x401030
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x40
push ebp
push esi
xor ebp, ebp
lea eax, [esp + 0x10]
push 0x38
push str.1.2.11
push eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
call fcn.00406940
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401084
mov eax, dword [esp + 0x50]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00401b50
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebp
add esp, 0x40
ret
push 0x2000
call fcn.0040a0df
add esp, 4
mov dword [esp + 8], eax
test eax, eax
jne 0x4010b8
mov eax, dword [esp + 0x50]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.004019f0
add esp, 0xc
jmp 0x4011d0
push 0x2000
call fcn.0040a0df
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4010ea
mov ecx, dword [esp + 0x50]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.004019f0
add esp, 0xc
jmp 0x4011d0
push ebx
mov ebx, dword [esp + 0x5c]
push edi
mov edi, dword [esp + 0x58]
mov edi, dword [edi + 8]
mov eax, 0x2000
mov esi, edi
cmp edi, eax
cmova esi, eax
mov eax, dword [esp + 0x54]
push dword [eax]
push esi
push 1
push dword [esp + 0x1c]
call fcn.0040a423
add esp, 0x10
cmp eax, esi
jne 0x4011cb
mov eax, dword [esp + 0x54]
push dword [eax]
call fcn.0040a211
add esp, 4
test eax, eax
jne 0x4011cb
mov eax, dword [esp + 0x10]
sub edi, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
nop dword [eax + eax]
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0x2000
push 0
push eax
mov dword [esp + 0x2c], ebp
call fcn.00404fb0
mov edi, eax
add esp, 8
cmp edi, 0xfffffffc
jl 0x401180
cmp edi, 0xfffffffe
jle 0x4011b5
cmp edi, 2
je 0x401225
mov eax, dword [esp + 0x5c]
mov esi, 0x2000
sub esi, dword [esp + 0x28]
test eax, eax
je 0x4011f4
push eax
push esi
push 1
push ebp
call fcn.0040b060
add esp, 0x10
cmp eax, esi
jne 0x4011b2
push dword [esp + 0x5c]
call fcn.0040a211
add esp, 4
test eax, eax
je 0x401205
or edi, 0xffffffff
mov eax, dword [esp + 0x58]
push edi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00401b50
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebx
lea eax, [esp + 0x10]
push eax
call fcn.00406780
push dword [esp + 0xc]
call fcn.0040a0c4
push ebp
call fcn.0040a0c4
add esp, 0xc
mov eax, esi
pop esi
pop ebp
add esp, 0x40
ret
test ebx, ebx
je 0x401205
push esi
push ebp
push ebx
call fcn.00408730
add esp, 0xc
add ebx, esi
cmp dword [esp + 0x28], 0
je 0x401150
cmp edi, 1
je 0x40122c
cmp dword [esp + 0x14], 0
jbe 0x4011b5
mov edi, dword [esp + 0x14]
jmp 0x4010f7
mov edi, 0xfffffffd
jmp 0x4011b5
xor esi, esi
jmp 0x4011ce
Function at 0x401250
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebx]
test ecx, ecx
jne 0x40128f
lea eax, [ebx + 0x68]
push 0x42121c
push eax
call fcn.00402a60
mov ecx, eax
add esp, 8
mov dword [ebx], ecx
test ecx, ecx
jne 0x40128f
mov eax, dword [esp + 0x10]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00401b50
add esp, 8
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebx + 4]
push ebp
mov ebp, dword [esp + 0x14]
push 0
add eax, dword [ebp + 4]
push eax
push ecx
call fcn.0040a81a
add esp, 0xc
test eax, eax
jns 0x4012c6
lea eax, [ebp + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.004019f0
add esp, 0xc
xor eax, eax
pop ebp
pop ebx
pop ecx
ret
push esi
push edi
push dword [ebp + 0xc]
call fcn.0040a0df
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
jne 0x4012f8
push dword [ebp + 0xc]
lea ecx, [ebp + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.004019f0
add esp, 0x10
jmp 0x401365
cmp byte [ebp + 0x10], 1
jne 0x40131c
push esi
push 0
push ebp
push ebx
call fcn.00401030
add esp, 0x10
test eax, eax
je 0x401365
push esi
call fcn.0040a0c4
add esp, 4
xor esi, esi
jmp 0x401365
mov eax, esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
test esi, esi
je 0x401361
mov ecx, 0x2000
nop
push dword [ebx]
cmp esi, 0x2000
mov edi, esi
push 1
cmova edi, ecx
push edi
push eax
call fcn.0040a423
add esp, 0x10
cmp eax, 1
jb 0x401382
mov eax, dword [esp + 0x10]
mov ecx, 0x2000
add eax, edi
mov dword [esp + 0x10], eax
sub esi, edi
jne 0x401330
mov esi, dword [esp + 0x18]
mov eax, dword [ebx]
test eax, eax
je 0x40137a
push eax
call fcn.0040a161
add esp, 4
mov dword [ebx], 0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea eax, [ebp + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.004019f0
mov esi, dword [esp + 0x24]
add esp, 0xc
push esi
call fcn.0040a0c4
add esp, 4
xor esi, esi
jmp 0x401365