joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439565
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004394e1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4396d4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4396d4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x439689
jg 0x4395c1
test eax, eax
je 0x43967f
push 1
push 0x1000
call fcn.0042b7f0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4395e4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x439676
push 0x8000
push ebx
call fcn.00428406
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x43960d
jg 0x439608
cmp ecx, 0x1000
jb 0x43960d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0043812b
add esp, 0x10
cmp eax, 0xffffffff
je 0x439652
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x439608
jl 0x439639
test ecx, ecx
jne 0x4395fa
push dword [ebp - 0xc]
push ebx
call fcn.00428406
push esi
call fcn.0042a40b
add esp, 0xc
xor ebx, ebx
jmp 0x4396e2
cmp byte [edi + 0x24], 0
je 0x439669
cmp dword [edi + 0x20], 5
jne 0x439669
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x439674
mov ebx, dword [edi + 0x18]
jmp 0x439676
xor ebx, ebx
push esi
call fcn.0042a40b
pop ecx
jmp 0x4396e2
test ecx, ecx
jg 0x43964b
jl 0x439689
test eax, eax
jae 0x43964b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00437668
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4396a9
cmp byte [edi + 0x1c], 0
je 0x43964b
jmp 0x4396da
push ebx
call fcn.0042ca89
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x43964b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4396e2
cmp byte [edi + 0x1c], 0
je 0x4396df
mov ebx, dword [edi + 0x18]
jmp 0x4396e2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00437668
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43a900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43a92d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43a92d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401810
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], edi
mov eax, ecx
push ecx
cdq
sub eax, edx
push 4
mov ebp, eax
push ebx
mov ecx, edi
mov byte [esp + 0x1f], 1
sar ebp, 1
call fcn.004017d0
mov ax, word [ebx + 4]
lea esi, [ebx + 4]
cmp ax, 1
je 0x40185b
cmp ax, 2
jne 0x4019cc
cmp ax, 1
jne 0x401861
mov byte [edi + 0x44], 0
jmp 0x401865
mov byte [edi + 0x44], 1
add esi, 2
xor eax, eax
xor ecx, ecx
add ebp, 0xfffffffb
mov ax, word [esi]
mov cx, word [esi + 2]
shl eax, 0x10
or eax, ecx
add esi, 4
test ebp, ebp
jle 0x401893
push eax
mov ecx, edi
call fcn.00401790
xor word [esi], ax
add esi, 2
dec ebp
jne 0x401882
mov edx, dword [esp + 0x20]
mov ecx, edi
push edx
push 4
push ebx
call fcn.004017d0
add ebx, 0xb
xor eax, eax
mov al, byte [ebx]
inc ebx
cmp eax, 0x40
mov dword [edi + 0x40], eax
jg 0x4019cc
cmp eax, 2
jl 0x4019cc
and eax, 0x80000001
jns 0x4018cb
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
je 0x4019cc
cmp byte [esp + 0x13], 1
jne case.0x4018f8.3
movzx cx, byte [ebx + 1]
inc ebx
and ecx, 0xffff
add ebx, 2
movzx ax, byte [ebx]
inc ebx
cmp ecx, 5
ja case.default.0x4018f8
jmp dword [ecx*4 + 0x4019e0]
cmp ax, 0x1e
ja 0x401923
test ax, ax
jbe case.default.0x4018f8
and eax, 0xffff
lea ecx, [edi + 0x20]
mov esi, eax
mov dl, byte [ebx]
inc ebx
mov byte [ecx - 1], dl
mov byte [ecx], 0
inc ecx
dec esi
jne 0x401914
jmp case.default.0x4018f8
mov byte [esp + 0x13], 0
jmp case.default.0x4018f8
cmp ax, 0x1e
ja 0x401923
test ax, ax
jbe case.default.0x4018f8
and eax, 0xffff
mov ecx, edi
mov esi, eax
mov al, byte [ebx]
inc ebx
mov byte [ecx], al
mov byte [ecx + 1], 0
inc ecx
dec esi
jne 0x40193e
jmp case.default.0x4018f8
mov dword [esp + 0x20], 0
lea esi, [edi + 0x46]
mov eax, dword [esp + 0x20]
xor edi, edi
shl eax, 5
mov dword [esp + 0x1c], eax
jmp 0x40196b
mov eax, dword [esp + 0x1c]
add eax, edi
and eax, 0xffff
mov cl, byte [eax + ebx]
lea ebp, [eax + ebx]
shr cl, 4
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00402130
mov ecx, dword [esp + 0x14]
mov byte [esi - 1], al
mov dl, byte [ebp]
and dl, 0xf
push edx
call fcn.00402130
mov byte [esi], al
inc edi
add esi, 2
cmp edi, 0x20
jl 0x401967
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 0x40
mov dword [esp + 0x20], eax
jl 0x401958
mov edi, dword [esp + 0x14]
add ebx, 0x800
jmp case.default.0x4018f8
and eax, 0xffff
add ebx, eax
jmp case.default.0x4018f8
mov byte [esp + 0x13], 0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x401a00
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
push 4
mov edi, ecx
push ebx
call fcn.004017d0
xor ecx, ecx
xor eax, eax
mov cx, word [ebx + 6]
mov ax, word [ebx + 8]
shl ecx, 0x10
or ecx, eax
mov eax, ebp
cdq
sub eax, edx
lea esi, [ebx + 0xa]
sar eax, 1
sub eax, 5
test eax, eax
jle 0x401a52
mov ebp, eax
push ecx
mov ecx, edi
call fcn.00401790
mov ecx, eax
xor word [esi], cx
add esi, 2
dec ebp
jne 0x401a3b
mov ebp, dword [esp + 0x18]
push ebp
push 4
push ebx
mov ecx, edi
call fcn.004017d0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8

Function at 0x405b59
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4099e0
cmp edx, dword [eax]
je 0x405b7b
add eax, 8
inc ecx
cmp eax, 0x409a70
jl 0x405b6c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4099e0]
jne 0x405ca9
mov eax, dword [0x409d10]
cmp eax, 1
je 0x405c83
test eax, eax
jne 0x405bac
cmp dword [0x409614], 1
je 0x405c83
cmp edx, 0xfc
je 0x405ca9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405be3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405d40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405ec0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405c26
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405ec0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4084cc
push edi
call fcn.00407a40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405d40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405d50
lea eax, [ebp - 0xa0]
push 0x4084ac
push eax
call fcn.00405d50
push dword [esi + 0x4099e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405d50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004079b5
add esp, 0x2c
pop edi
jmp 0x405ca9
lea eax, [ebp + 8]
lea esi, [esi + 0x4099e4]
push 0
push eax
push dword [esi]
call fcn.00405ec0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x407ef7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c0158]
jne 0x407f01
repz ret
jmp fcn.0040f20c

Function at 0x40f3f8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a496
and dword [ebp - 4], 0
cmp dword [0x4c7dfc], 0
mov ebx, eax
jne 0x40f4a9
push 0x401c9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f55a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c90
push edi
call esi
test eax, eax
je 0x40f55a
push eax
call fcn.0040a424
mov dword [esp], 0x401c80
push edi
mov dword [0x4c7dfc], eax
call esi
push eax
call fcn.0040a424
mov dword [esp], 0x401c6c
push edi
mov dword [0x4c7e00], eax
call esi
push eax
call fcn.0040a424
mov dword [esp], 0x401c50
push edi
mov dword [0x4c7e04], eax
call esi
push eax
call fcn.0040a424
pop ecx
mov dword [0x4c7e0c], eax
test eax, eax
je 0x40f4a9
push 0x401c38
push edi
call esi
push eax
call fcn.0040a424
pop ecx
mov dword [0x4c7e08], eax
mov eax, dword [0x4c7e08]
cmp eax, ebx
je 0x40f501
cmp dword [0x4c7e0c], ebx
je 0x40f501
push eax
call fcn.0040a49f
push dword [0x4c7e0c]
mov esi, eax
call fcn.0040a49f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f501
test edi, edi
je 0x40f501
call esi
test eax, eax
je 0x40f4f8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f4f8
test byte [ebp - 0xc], 1
jne 0x40f501
or dword [ebp + 0x10], 0x200000
jmp 0x40f53a
mov eax, dword [0x4c7e00]
cmp eax, ebx
je 0x40f53a
push eax
call fcn.0040a49f
pop ecx
test eax, eax
je 0x40f53a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f53a
mov eax, dword [0x4c7e04]
cmp eax, ebx
je 0x40f53a
push eax
call fcn.0040a49f
pop ecx
test eax, eax
je 0x40f53a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c7dfc]
call fcn.0040a49f
pop ecx
test eax, eax
je 0x40f55a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f55c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41c3a7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c049

Function at 0x41c3b2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c1d8

Function at 0x41c7ac
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040b950
mov eax, dword [0x435100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041a30f
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41c7ee
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41c94a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00427050
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4b5860]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041d97c
mov ecx, dword [esi*4 + 0x4b5860]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41c943
cmp eax, dword [edi + ecx + 0x24]
jne 0x41c943
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c943
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041d97c
add esp, 0x14
test edx, edx
jl 0x41c943
jg 0x41c8b9
test eax, eax
jb 0x41c943
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41c943
jl 0x41c8d3
cmp dword [ebp - 0x1008], eax
ja 0x41c943
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41c8f1
test ebx, ebx
je 0x41c92a
cmp ecx, edi
jae 0x41c92a
mov al, byte [ecx]
cmp al, 0xd
jne 0x41c90b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41c917
cmp byte [ecx + 1], 0xa
jne 0x41c917
inc ecx
jmp 0x41c917
movzx eax, al
movsx eax, byte [eax + 0x4353d0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41c8f1
cmp edx, ebx
jne 0x41c8f1
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41c948
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040aa09
leave
ret
Function at 0x41ce1a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4b5860]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41ce5a
cmp byte [ebx], 0xa
jne 0x41ce5a
or byte [eax + edi + 0x28], 4
jmp 0x41ce5f
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41cf5d
mov al, byte [edx]
cmp al, 0x1a
je 0x41cf3f
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41ce8e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41ceb3
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41cebd
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41ce70
jmp 0x41cf5d
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41cf3a
cmp dword [ebp - 0xc], 0
je 0x41cf3a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4b5860]
test byte [eax + edi + 0x28], 0x48
je 0x41cf14
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41ceff
mov byte [esi], dl
jmp 0x41cf10
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4b5860]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41cf5d
cmp byte [ebp - 1], 0xa
jne 0x41cf23
cmp esi, ebx
jne 0x41cf23
mov byte [esi], 0xa
jmp 0x41cf5c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041d99a
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41cf5d
mov byte [esi], 0xd
jmp 0x41cf5c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4b5860]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41cf59
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41cf5d
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41cf66
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4b5860]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41cfa9
cmp word [esi], dx
jne 0x41cfa9
or byte [edi + eax + 0x28], 4
jmp 0x41cfae
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41d101
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41d0e1
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41cff0
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41d026
cmp eax, edx
jae 0x41d032
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41cfc8
jmp 0x41d101
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d0dd
cmp dword [ebp - 0x14], 0
je 0x41d0dd
mov eax, dword [ebx*4 + 0x4b5860]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41d0b5
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41d07e
mov word [esi], cx
jmp 0x41d0b1
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4b5860]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4b5860]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4b5860]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41d101
pop ebx
cmp word [ebp - 4], bx
jne 0x41d0c6
cmp esi, dword [ebp + 0xc]
jne 0x41d0c6
mov word [esi], bx
jmp 0x41d0fe
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041d99a
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41d101
push 0xd
jmp 0x41d0fa
mov ecx, dword [ebx*4 + 0x4b5860]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41d0f8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41d101
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4

Function at 0x418e89
Capabilities:
Encode data using xor

Disassembly:
call 0x8b97d354
jne 0x418e98
cmp esi, dword [0x4d1944]
je 0xdb58f35
cdq
add byte [ebp + ecx - 0x75], dh
adc eax, 0x4d1924
mov edx, dword [0x4d1924]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x418eb7
push ecx
call 0xdb58f48
mov edx, dword [0x4d1924]
mov eax, dword [edx + esi*4]
and dword [eax], 0
dec dword [0xd4d1930]
mov edx, dword [0x4d1924]
cmp esi, dword [0x4d1934]
jne 0x418ee7
cmp esi, 3
jl 0x418ee1
mov eax, dword [edx + esi*4]
or esp, 0xffffffcc
int3
mov dword [0x4d1934], esi
mov ecx, dword [0x4d1928]
pop esi
cmp ecx, 3
jbe 0x418efc
mov eax, dword [edx + ecx*4 - 4]
int3
xor eax, 0x490d04dc
mov dword [0x4d1928], ecx
push 4
push dword [edx + ecx*4]
call 0xc129fde9
mov eax, dword [0x4d1924]
pop ecx
pop ecx
mov ecx, dword [0x4d1928]
and dword [eax + ecx*4], 0
mov ecx, dword [0x4d1928]
dec ebp
add byte [ebx - 0x3089fc07], al
mov edx, dword [0x4d1924]
jmp 0x418ef3
Function at 0x46969a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fe27
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00420e3c
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x4696f5
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x4696ec
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x472022
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4d2630], ecx
inc esi
mov edx, esi
mov eax, dword [edx*4 + 0x4d262c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x4d2630], eax
dec ebp
add byte [edx - 0x7f], al
cli
jo 0x472052
xchg dword [eax], eax
jl 0x47202e
mov dword [0x4d06e0], esi
mov dword [0x4d2ff0], esi
pop esi
ret

Function at 0x472062
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x472085
push 0
call fcn.0042e504
pop ecx
mov ecx, eax
call fcn.00472022
mov dword [0x4d06e0], 0x870270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x870634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x47209a
mov eax, dword [esi]
mov dword [ebp - 4], 0x87018c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x4720d4
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret
Function at 0x47c0f6
Capabilities:
Encode data using xor

Disassembly:
and al, 0x8b
int1
push edi
mov edi, dword [esi]
test edi, edi
je 0x47c0e1
mov ecx, edi
call 0xff48bf8b
push 0x7e8310e0
push edi
call 0x3bbfe0f
mov ecx, dword [ecx + 0x6a]
or al, 0x56
push 0xc
push esi
call 0x3bbfe0f
mov ecx, dword [ecx + 0x5f]
mov eax, esi
mov eax, dword [eax]
add al, 0x8b
inc ebp
or byte [ebx - 0xe74a9ad], cl
push edi
xor edi, edi
mov ebx, edi
mov ecx, dword [esi + 9]
call fcn.00407d0c
push esi
add al, 0x8b
add cl, byte [ebp + 0x58030452]
add al, 0xf9
dec dword [ebp + 0x4d8bf344]
or byte [ebx - 0x18], dl
test eax, 0x5756ec4d
mov ecx, dword [ebx + 0x84d89df]
cmp dword [esi + 8], edi
jbe 0x47c153
push ecx
push edi
push dword [eax]
add al, 0x98
push dword [eax + 8]
xor al, 0xf9
inc dword [edi + ecx]
push eax
call 0x4420e62
cmp bh, al
inc eax
add bh, cl
dec dword [ebp + 0x430084d]
cwde
add edi, dword [eax + 4]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x47c12a
pop edi
mov ebx, dword [ebx + 0x5d]
add byte [ebx + ecx*4], al
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi], edi
clc
jmp dword [esi + 0x36]
Function at 0x435370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00434fb3
push eax
push esi
push dword [ebp + 8]
call fcn.00434f68
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00434fb3
push eax
push esi
push dword [ebp + 8]
call fcn.00434f68
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00434fa3
enter 0xffffffffffff963b, 0xffffffffffffff8f
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00434fa3
into
jmp 0x85d08be5