joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8fabc1
Capabilities:
Execute anti-debugging instructions

Disassembly:
jnp 0x8fab8c
lea esp, [esp + 4]
sub esp, 0x11
jmp 0x8fab9d
lea esp, [esp + 4]
pop dword [esp + 1]
lea esp, [esp + 1]
jmp 0x8fabf2
clc
jmp 0x8fab75

Function at 0x8fac00
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jmp 0x8fab69
lea esp, [esp + 2]
jmp 0x8fac23
lea esp, [esp + 0xc]
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x8fab28
ja 0x8fac1b
sub esp, 0x14
clc
jmp 0x8fab1f
and al, 4
sub esp, 0x11
pop dword [esp + 1]
jmp 0x8fabee
lea edi, [eax + ecx - 0x40]
push esi
jmp 0x8fabc4
push edi
push ecx
mov esi, edx
jmp 0x8fabce
pushal
lea ecx, [edi*4]
mov si, word [esp]
mov dword [esp], eax
clc
jmp 0x8fac34
lea esp, [esp + 1]
mov esp, eax
pushfd
jmp 0x8faba7
sub esp, 0x1e
call 0x8fac00
je 0x8fab8e
and al, 2
lea esp, [esp + 0x20]
popal
jmp 0x8fac3b
sub esp, 0x14
clc
lea esp, [esp + 2]
and al, 0xfc
sub esp, 0x14
jl 0x8fab09
jge 0x8fab3e
jbe 0x8fabf7
sub esp, 0x1e
jmp 0x8fabfa
mov ecx, ecx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x8fbf4b
popfd
jmp fcn.008f9a59
pop ecx
pop edi
pop esi
jmp 0x8fb046
Function at 0x91f967
Capabilities:
Encrypt data using aes

Disassembly:
shl edx, 8
bt di, bx
mov bx, 0xb793
not bp
bswap ebx
jmp 0x91f982
btr edi, esp
jmp 0x91f94e
inc edi
mov ebx, dword [esp]
bswap edx
jmp 0x91f9ac
xor edx, esi
xchg bl, bh
inc esi
mov dword [ecx + 4], edx
jmp 0x91f96c
movzx edx, byte [eax + 8]
push bp
add esp, 0
mov bl, byte [esp + 1]
lea esp, [esp + 2]
jmp 0x91f9f9
shl edx, 8
lea ebp, [0x4e5c64cb]
jmp 0x91f9e0
xor edx, esi
movzx esi, byte [eax + 0xa]
mov ebx, esi
mov edi, 0xa7245a14
jmp 0x91fa06
movzx esi, byte [eax + 9]
mov ebx, esp
inc edi
btr bx, bx
jmp 0x91f9bf
bsr bx, bp
mov edi, dword [esp]
shl edx, 8
xor edx, esi
jmp 0x91fa18
lea edi, [ecx + 0xc1e6]
mov edi, dword [esp]
mov edi, 0x111b4a90
sub esp, 8
jmp 0x91fb16
movzx esi, byte [eax + 0xd]
pushfd
push ebp
jmp 0x91faa2
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
bswap ebp
jmp 0x91fa48
mov ebx, 0xa7e92760
lea edi, [ebx - 0xc7]
xor edx, esi
clc
jmp 0x91fa5e
lea esp, [esp + 1]
jmp 0x91fad5
shl edx, 8
not bh
mov bh, al
sub esp, 0x19
sub di, bp
jmp 0x91fa8c
lea edi, [edi + 0xe]
movzx esi, byte [edi]
pop edi
movzx eax, byte [eax + 0xf]
jmp 0x91faf2
xor edx, eax
jmp 0x91fadc
xor edx, esi
push edi
mov edi, eax
jmp 0x91fab1
push edi
jmp 0x91fafc
shl edx, 8
xor edx, esi
shl edx, 8
jmp 0x91fabe
mov edi, ecx
lea edi, [edi + 0xc]
mov dword [edi], edx
pop edi
jmp 0x91fc23
movzx esi, byte [eax + 0xb]
setnp bh
mov bp, 0xadef
shl edx, 8
jmp 0x91fa7c
mov edi, dword [edi*4 + 0x8f0a34]
bsf ebp, esp
push esp
xchg word [esp + 1], bx
jmp 0x91fb4f
shr edi, 8
mov bl, 0x6f
and edi, esi
rcr bx, cl
jmp 0x91fb29
lea esp, [esp + 4]
and edi, 0xff0000
push eax
jmp 0x91fb9b
and eax, 0xff000000
jmp 0x91fb85
xor eax, 0x1000000
mov edi, edx
mov ebp, 0xd4679bad
mov bx, cx
mov ebx, edx
jmp 0x91fb43
xor eax, edi
mov edi, ecx
jmp 0x91fba8
mov eax, ecx
add eax, 4
mov ebx, dword [eax]
pop eax
mov ebp, dword [esp]
jmp 0x91fb5c
mov edi, edx
mov bp, word [esp]
cmc
jmp 0x91fbe4
and eax, esi
mov eax, dword [eax*4 + 0x8f0a34]
lea esp, [esp + 0x4c]
jmp 0x91fb72
neg ebp
rcr ebp, 0x13
jmp 0x91fc09
shr edi, 0x18
movzx edi, byte [edi*4 + 0x8f0a34]
xor eax, edi
jmp 0x91fbce
and edi, esi
sub esp, 2
bswap ebp
lea esp, [esp + 2]
jmp 0x91fc66
mov edi, edx
and ebp, ecx
bswap ebp
jmp 0x91fbf3
mov eax, edx
shr eax, 0x10
mov esi, 0xff
jmp 0x91fbbf
and edi, ebp
clc
jmp 0x91fc93
lea ebp, [ebp + 0x8f0a34]
mov edi, dword [ebp]
pop ebp
mov ebp, 0xff00
clc
jmp 0x91fc2f
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0x91fc45
lea edi, [ecx + 0x10]
xor ebx, eax
stc
jmp 0x91fc9f
mov dword [esp + 0x14], edi
cmc
call fcn.0091fcae
mov ecx, 0x33c0a131
sar dword [ecx + 0x32c7a032], cl
invalid
xor eax, edi
xor eax, dword [ecx]
clc
xor di, 0xb61a
jmp 0x91fc72
push edx
pushal
mov al, 0xe9
mov dx, 0x3fdf
mov edx, 0x25947e76
jmp 0x91fc7a
Function at 0x91fe44
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 3]
mov dword [esp], ebx
jmp 0x91ff37
shr edi, 0x18
jmp 0x91feec
mov edx, dword [edx*4 + 0x8f0a34]
jmp 0x91fe84
mov di, 0x9fd7
mov edi, edx
and edx, esi
jmp 0x91fe9a
setnp dl
jmp 0x91ff15
stc
and edx, ebp
xor ecx, edx
bsf edx, edi
jmp 0x91febd
movzx edi, byte [edi*4 + 0x8f0a34]
sub esp, 4
push dword [esp + 3]
xor ecx, edi
jmp 0x91fed3
lea edi, [eax + 0x10]
sub esp, 0x1d
lea esp, [esp + 1]
jmp 0x91ff4c
lea esp, [esp + 8]
xor ecx, dword [ebx]
neg edi
dec edx
not dx
jmp 0x91feff
lea esp, [esp + 8]
and edi, 0xff000000
xor ecx, edi
bsr di, dx
jmp 0x91feb3
lea esp, [esp + 0x1c]
xor ecx, dword [eax]
bt edx, esi
xchg dl, dh
cmc
jmp 0x920074
mov ebp, eax
jmp 0x920000
mov esi, edi
mov dword [esi], ecx
pop esi
not dh
push ebp
jmp 0x91ff87
mov ebx, eax
add ebx, 0x14
mov dword [ebx], edx
pop ebx
call 0x91ffb5
push 0x33f829eb
clc
xor ecx, edx
invalid
invalid
xor edx, ecx
mov ecx, 0xf98cbecc
lea ecx, [edx + edi]
clc
push ebx
jmp 0x91ffa7
add ebp, 4
mov edx, dword [ebp]
pop ebp
cmc
jmp 0x91ffd2
clc
add ebx, 4
push esi
jmp 0x91ff9d

Function at 0x920110
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x920b2e
mov eax, dword [edx]
mov dword [edx - 4], edi
call fcn.0092019c
mov edi, dword [ecx - 4]
mov dword [ecx - 4], eax
lea eax, [esi + ebp]
jmp 0x9202b4
push word [esp + 8]
mov word [esp + 6], sp
lea esp, [esp + 1]
mov dword [edx - 8], edi
bsr edi, eax
jmp 0x9203eb
add esp, 3
push esi
lea esp, [esp + 1]
mov eax, dword [edx - 4]
sub esp, 0x1b
jmp 0x9205ee

Function at 0x9201da
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov di, 0xf92a
jmp 0x9200af
jmp 0x920217
push edi
jmp 0x9200cd
mov edi, edx
add edi, 0xfffffff8
mov eax, dword [edi]
pop edi
call fcn.0092010e
push ds
pushfd
xor dl, byte [ebp - 0x5c]
push eax
push 0xeb1879e9
add ecx, dword [edx + 0xaff980a]
in al, dx
sub eax, dword [edx - 3]
lea esp, [esp + 4]
jmp 0x92022d
pushal
jmp 0x920279
jl 0x8e6a26
lea eax, [esp + 0x49ad]
push di
lea esp, [esp + 2]
mov eax, dword [ebp - 8]
jmp 0x8e6a3c
lea ecx, [eax - 1]
adc dh, 0x6f
jmp 0x92028b
not edx
xchg edi, ecx
mov bl, 0x25
jmp 0x920248
lea esp, [esp + 0x20]
cmp eax, 1
jle 0x8e6ad2
sbb cl, 0xc4
jmp 0x92025e
push eax
mov eax, ebp
add eax, 0xfffffffc
jmp 0x92029a
mov dword [eax], ecx
pop eax
mov dl, 0x10
xchg dx, cx
mov edx, 0xdbd05228
jmp 0x9202d4
mov ecx, 0xff
jmp 0x8e6a9d
Function at 0x920343
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 0x11]
lea edx, [edx + 0x3c11]
jmp 0x9202be
pop edi
jmp 0x9207fe
mov ebx, dword [ebx*4 + 0x8f0a34]
setno dh
jmp 0x92038a
stc
push bx
push word [esp]
jmp 0x92035b
lea edi, [esi*4]
pushal
neg di
mov edi, eax
mov edi, edx
jmp 0x9202de
xor edi, dword [ebx*4 + 0x8f1634]
mov ebx, dword [esp]
jmp 0x920332
mov edi, dword [edi*4 + 0x8f0e34]
and ebx, ecx
lea esp, [esp + 0x24]
jmp 0x920305
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + 0x8f0a34]
call 0x920343
and byte [ecx], ah
retf
shr edi, 0x18
mov edi, dword [edi*4 + 0x8f0a34]
and edi, ecx
jmp 0x920323
add esi, 0x10
setns dh
lea edi, [edi - 0x4d5e]
mov edx, dword [esi]
jmp 0x9202f4
and edx, ecx
push edi
mov dword [esp], esi
call 0x9207cf
por mm6, qword [ecx + ecx*4 + 0x7e]
or al, 0x66
push edx
lea esp, [esp + 2]
jmp 0x920814
pop esi
mov ebx, esp
jmp 0x920820
jne 0x8e6a9d
je 0x8e6ad2
mov ebx, dword [esp]
call 0x920829
pop edi
lea esp, [esp + 8]
leave
ret

Function at 0x920471
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x38]
xor edi, dword [ebx*4 + 0x8f1634]
jmp 0x9204c1
lea ecx, [ecx*4]
lea ecx, [ecx + 0x8f0a34]
mov ebx, dword [ecx]
pop ecx
jmp 0x9204ab
movzx ebx, byte [esi + 6]
push ecx
mov ecx, ebx
jmp 0x92047e

Function at 0x920537
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x920514

Function at 0x9207c3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 0x11]
lea edx, [edx + 0x3c11]
jmp 0x9202be
pop edi
jmp 0x9207fe
mov ebx, dword [ebx*4 + 0x8f0a34]
setno dh
jmp 0x92038a
stc
push bx
push word [esp]
jmp 0x92035b
lea edi, [esi*4]
pushal
neg di
mov edi, eax
mov edi, edx
jmp 0x9202de
xor edi, dword [ebx*4 + 0x8f1634]
mov ebx, dword [esp]
jmp 0x920332
mov edi, dword [edi*4 + 0x8f0e34]
and ebx, ecx
lea esp, [esp + 0x24]
jmp 0x920305
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + 0x8f0a34]
call 0x920343
and byte [ecx], ah
retf
shr edi, 0x18
mov edi, dword [edi*4 + 0x8f0a34]
and edi, ecx
jmp 0x920323
add esi, 0x10
setns dh
lea edi, [edi - 0x4d5e]
mov edx, dword [esi]
jmp 0x9202f4
and edx, ecx
push edi
mov dword [esp], esi
call 0x9207cf
por mm6, qword [ecx + ecx*4 + 0x7e]
or al, 0x66
push edx
lea esp, [esp + 2]
jmp 0x920814
pop esi
mov ebx, esp
jmp 0x920820
jne 0x8e6a9d
je 0x8e6ad2
mov ebx, dword [esp]
call 0x920829
pop edi
lea esp, [esp + 8]
leave
ret
Function at 0x9207cf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 0x11]
lea edx, [edx + 0x3c11]
jmp 0x9202be
pop edi
jmp 0x9207fe
mov ebx, dword [ebx*4 + 0x8f0a34]
setno dh
jmp 0x92038a
stc
push bx
push word [esp]
jmp 0x92035b
lea edi, [esi*4]
pushal
neg di
mov edi, eax
mov edi, edx
jmp 0x9202de
xor edi, dword [ebx*4 + 0x8f1634]
mov ebx, dword [esp]
jmp 0x920332
mov edi, dword [edi*4 + 0x8f0e34]
and ebx, ecx
lea esp, [esp + 0x24]
jmp 0x920305
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + 0x8f0a34]
call 0x920343
and byte [ecx], ah
retf
shr edi, 0x18
mov edi, dword [edi*4 + 0x8f0a34]
and edi, ecx
jmp 0x920323
add esi, 0x10
setns dh
lea edi, [edi - 0x4d5e]
mov edx, dword [esi]
jmp 0x9202f4
and edx, ecx
push edi
mov dword [esp], esi
call 0x9207cf
por mm6, qword [ecx + ecx*4 + 0x7e]
or al, 0x66
push edx
lea esp, [esp + 2]
jmp 0x920814
pop esi
mov ebx, esp
jmp 0x920820
jne 0x8e6a9d
je 0x8e6ad2
mov ebx, dword [esp]
call 0x920829
pop edi
lea esp, [esp + 8]
leave
ret

Function at 0xa6eab0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
sbb dx, 0x4e7c
push dword [esp + 0xf]
mov al, 0x70
jmp 0xa6eb01
lea edx, [ecx + 0x8eb6908]
dec dl
add esp, 0x2b
mov edx, 0x50621c
mov eax, dword [esp]
xchg byte [esp + 1], ah
jmp 0xa6eae1

Function at 0xa6ee7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 7]
cmc
lea ebp, [ebx*4]
rdtsc
std
jmp 0xa6ee23
xchg dword [esp + 0x17], eax
or bp, cx
lea ebp, [ecx*4]
xchg ah, dl
mov edx, 0xf5c16b14
mov bp, ax
jmp 0xa6edf3
shl dl, 6
mov ax, 0x2662
xchg word [esp + 1], bp
lea eax, [ebx*4]
pop word [esp + 0x1a]
push word [esp + 0x1c]
jmp 0xa6ee5d
not dx
mov dh, 0x7c
rcl ebp, cl
xchg dword [esp + 0x14], eax
mov ax, cx
pop ax
jmp 0xa6ee09
setp ah
sub esp, 1
xchg dword [esp + 0x1b], eax
mov al, byte [esp + 0xe]
rdtsc
add ah, dh
jmp 0xa6ee98
mov bp, word [esp + 6]
jmp 0xa6ee4b
bts eax, ebp
xchg dx, ax
sub esp, 0xb
neg dl
xchg byte [esp + 0x20], ah
mov dh, ch
jmp 0xa6eec3
bswap edx
mov eax, dword [esp + 0x18]
mov dx, 0x48ec
shl ah, 5
xchg dx, ax
mov byte [esp + 0x11], bl
jmp 0xa6ee82
rdtsc
mov dx, word [esp + 1]
mov byte [esp], ah
mov byte [esp], bh
jmp 0xa6ef17
sub esp, 0x19
lea esp, [esp + 0x45]
push ax
lea edx, [esi - 0xfb1e]
xchg bp, dx
xor bp, dx
jmp 0xa6eead
mov dx, 0x219e
mov ebp, 0xbfca07f4
inc edx
call fcn.00a6eefd
Function at 0xa6f6be
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
cmc
rdtsc
xchg byte [esp + 3], al
mov dx, 0xe642
jmp 0xa6f707
xchg dword [esp + 0xc], eax
lea eax, [ebp*4]
mov al, 0xed
jmp 0xa6f6a8
xchg word [esp + 0x1e], bp
lea ebp, [esi + 0x4ac9]
xchg dword [esp + 0x1c], eax
neg ah
rcr ah, 6
sub edx, edx
jmp 0xa6f6f1

Function at 0xa6fb0b
Capabilities:
Parse pe header

Disassembly:
jmp 0xa6fbcf
pop word [esp]
call fcn.00a6fb7a

Function at 0xa6fb7a
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call int.00a6f028
mov eax, dword [eax + 0xc]
jmp 0xa6fba4
lea esp, [esp + 2]
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
mov eax, dword fs:[0x30]
jmp 0xa6fb64
push eax
jmp 0xa6f023
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xa6fb8e
Function at 0x402b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x409040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
movzx eax, bx
mov dword [ebp - 0x34], eax
mov esi, ecx
cmp di, bx
jne 0x402b3d
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004048c9
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x402b77
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x402b77
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004048c9
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x402c47
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x402ba4
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402bd7
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
movzx ecx, bx
cmp ax, di
cmove ecx, edi
pop edi
pop esi
mov ax, cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004048c9
mov esp, ebp
pop ebp
ret 4
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x402c16
sub eax, 1
je 0x402c16
sub eax, 2
jne 0x402c47
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x402baf
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x402c34
push dword [esi + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x402c47
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], ecx
movzx eax, ax
mov byte [esi + 0x3e], 1
cmovne edi, eax
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004048c9
mov esp, ebp
pop ebp
ret 4
Function at 0x403890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x409040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x403954
cmp byte [esi + 0x3e], 0
je 0x403954
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x403942
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x403909
sub eax, 1
je 0x40390d
sub eax, 2
jne 0x403942
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004048c9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40392b
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403942
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004048c9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004048c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004048c9
mov esp, ebp
pop ebp
ret

Function at 0x405195
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4051d4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4051d4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4051d4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4051d4
cmp dword [ecx + 0x74], 0xe
jbe 0x4051d4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x411054], 1
mov dword [0x411050], 1
mov dword [0x41104c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x41100c], eax
mov eax, dword [0x411060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x411074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x41105c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x40c01c], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x401c6e
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x134
call dbg.__main
lea eax, [ebp - 0x110]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
test eax, eax
js 0x401d6f
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x110]
add eax, edx
mov dword [eax], 0x6572435c
mov dword [eax + 4], 0x76697461
mov dword [eax + 8], 0x6f535c65
mov dword [eax + 0xc], 0x61777466
mov dword [eax + 0x10], 0x6f4c6572
mov dword [eax + 0x13], 0x6b636f
mov dword [esp + 8], 0
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401d3e
cmp dword [ebp - 0xc], 0x50
je 0x401d3e
cmp dword [ebp - 0xc], 0xb7
jne 0x401d51
lea eax, [ebp - 0x110]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call eax
sub esp, 4
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0x40d0a3
call sym._printf
mov dword [esp + 4], str.CTLO3H65X2.kga
mov dword [esp], str.23A3693F
call sym._GenKga
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x402610
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea edi, [ebx + 0x80]
mov dword [esp + 4], edi
bswap ecx
mov eax, ecx
bswap edx
shr eax, 4
xor eax, edx
and eax, 0xf0f0f0f
xor edx, eax
shl eax, 4
xor eax, ecx
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, si
xor edx, esi
shl esi, 0x10
mov ecx, edx
xor esi, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
shl ecx, 2
xor ecx, edx
mov edx, ecx
shr edx, 8
xor edx, esi
and edx, 0xff00ff
mov eax, edx
xor esi, edx
shl eax, 8
mov edx, esi
xor eax, ecx
rol eax, 1
xor edx, eax
and edx, 0xaaaaaaaa
xor esi, edx
xor eax, edx
rol esi, 1
lea esi, [esi]
mov edx, dword [ebx]
mov edi, eax
add ebx, 0x10
ror edi, 4
xor edi, dword [ebx - 0xc]
xor edx, eax
mov ebp, edi
mov ecx, edx
and ebp, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x40d340]
xor ecx, dword [ebp*4 + 0x40d440]
mov ebp, edx
shr ebp, 8
and ebp, 0x3f
xor ecx, dword [ebp*4 + 0x40d540]
mov ebp, edx
shr edx, 0x18
shr ebp, 0x10
and edx, 0x3f
and ebp, 0x3f
xor ecx, dword [ebp*4 + 0x40d740]
xor ecx, dword [edx*4 + 0x40d940]
mov edx, edi
shr edx, 8
and edx, 0x3f
xor ecx, dword [edx*4 + 0x40d640]
mov edx, edi
shr edi, 0x18
shr edx, 0x10
and edi, 0x3f
and edx, 0x3f
xor ecx, dword [edx*4 + 0x40d840]
xor ecx, dword [edi*4 + 0x40da40]
mov edi, dword [ebx - 8]
xor esi, ecx
mov ecx, esi
xor edi, esi
ror ecx, 4
xor ecx, dword [ebx - 4]
mov edx, edi
mov ebp, edi
shr edx, 8
and ebp, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x40d540]
xor edx, dword [ebp*4 + 0x40d340]
xor eax, edx
mov edx, edi
shr edi, 0x18
shr edx, 0x10
and edi, 0x3f
and edx, 0x3f
xor eax, dword [edx*4 + 0x40d740]
mov edx, ecx
xor eax, dword [edi*4 + 0x40d940]
and edx, 0x3f
mov edi, dword [esp + 4]
xor eax, dword [edx*4 + 0x40d440]
mov edx, ecx
shr edx, 8
and edx, 0x3f
xor eax, dword [edx*4 + 0x40d640]
mov edx, ecx
shr ecx, 0x18
shr edx, 0x10
and ecx, 0x3f
and edx, 0x3f
xor eax, dword [edx*4 + 0x40d840]
xor eax, dword [ecx*4 + 0x40da40]
cmp ebx, edi
jne 0x402698
ror eax, 1
mov edx, eax
xor edx, esi
and edx, 0xaaaaaaaa
xor eax, edx
xor edx, esi
ror edx, 1
mov ecx, edx
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor ecx, edx
mov edx, ecx
shr edx, 2
xor edx, eax
and edx, 0x33333333
xor eax, edx
shl edx, 2
xor edx, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, edx
movzx ecx, cx
xor edx, ecx
shl ecx, 0x10
xor ecx, eax
mov eax, edx
mov ebx, ecx
shr ebx, 4
xor ebx, edx
and ebx, 0xf0f0f0f
xor eax, ebx
shl ebx, 4
mov edx, ebx
mov esi, eax
xor edx, ecx
shr esi, 0x10
movzx ebx, dl
movzx edi, dh
mov ecx, edx
shl ebx, 8
shr ecx, 0x10
or ebx, edi
movzx ecx, cl
movzx edi, ah
shr edx, 0x18
shl ebx, 8
mov ebp, edx
mov edx, esi
or ebx, ecx
movzx ecx, al
movzx esi, dl
shr eax, 0x18
shl ecx, 8
shl ebx, 8
or ecx, edi
or ebx, ebp
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
mov dword [eax + 4], ecx
add esp, 0xc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
test al, 7
jne 0x402958
cmp dword [esp + 0x34], 1
je 0x4028fc
mov ecx, edi
lea edi, [edi + eax]
mov edx, ebp
mov dword [esp + 0x14], edi
mov ebp, ecx
test eax, eax
je 0x4028f2
lea esi, [esi]
nop
mov eax, dword [esp + 0x30]
mov esi, dword [ebp]
mov dword [esp + 0x3c], edx
mov edi, dword [ebp + 4]
mov dword [esp + 8], ebx
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym._mbedtls_des_crypt_ecb
test eax, eax
jne 0x4028f4
mov edx, dword [esp + 0x3c]
lea esi, [esi]
lea esi, [esi]
movzx ecx, byte [edx + eax]
xor byte [ebx + eax], cl
add eax, 1
cmp eax, 8
jne 0x4028d0
mov eax, dword [esp + 0x14]
add ebp, 8
mov dword [edx], esi
add ebx, 8
mov dword [edx + 4], edi
cmp ebp, eax
jne 0x4028a0
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [ebx + eax]
test eax, eax
je 0x4028f2
mov eax, esi
mov esi, ebp
mov ebp, eax
lea esi, [esi]
xor ecx, ecx
lea esi, [esi]
movzx eax, byte [edi + ecx]
xor al, byte [esi + ecx]
mov byte [ebx + ecx], al
add ecx, 1
cmp ecx, 8
jne 0x402918
mov eax, dword [esp + 0x30]
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._mbedtls_des_crypt_ecb
test eax, eax
jne 0x4028f4
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
add ebx, 8
add edi, 8
mov dword [esi], eax
mov dword [esi + 4], edx
cmp ebx, ebp
jne 0x402910
jmp 0x4028f2
mov eax, 0xffffffce
jmp 0x4028f4