joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4042bb
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
mov eax, dword [0x407018]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x20], ax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
mov eax, edi
mov dword [esp + 0x18], 0x10
call fcn.00402530
mov ecx, dword [edi + 0x10]
mov eax, edi
mov dword [esp + 0x10], ecx
call fcn.00402540
mov esi, edi
call fcn.00401380
test al, al
je 0x40151c
mov eax, edi
call fcn.00402530
mov edx, dword [esp + 0x10]
cmp edx, dword [edi + 0x10]
mov eax, edi
sete bl
call fcn.00402540
test bl, bl
je 0x40155b
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
call sub.WSOCK32.dll_accept
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, 0xffffffff
je 0x40153b
push 0x48
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x1c], eax
xor esi, esi
mov dword [esp + 0x40], esi
cmp eax, esi
je 0x401482
mov ebx, eax
call fcn.00401ab0
mov ebx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0x40], 0xffffffff
mov dword [esi + 0x14], ebx
mov eax, dword [esp + 0x20]
mov dword [esi + 0x18], eax
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1c], ecx
mov edx, dword [esp + 0x28]
lea ecx, [esi + 0x3c]
push ecx
push 0
push esi
push 0x4021c0
mov dword [esi + 0x20], edx
mov eax, dword [esp + 0x3c]
push 0
push 0
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4014db
mov eax, esi
call fcn.00401da0
push 0x3ea
mov esi, edi
call fcn.004011a0
jmp 0x40150d
mov eax, edi
call fcn.00402530
push esi
lea esi, [edi + 4]
call fcn.00402220
mov esi, dword [edi + 0x24]
mov ebx, dword [edi + 0x28]
mov eax, edi
call fcn.00402540
test esi, esi
je 0x401503
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
test ebx, ebx
je 0x40150d
push edi
call ebx
add esp, 4
mov esi, edi
call fcn.00401380
test al, al
jne 0x40141a
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0040377c
mov esp, ebp
pop ebp
ret
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2714
je 0x401554
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov esi, edi
call fcn.004011a0
mov eax, edi
call fcn.004012f0
mov eax, 1
jmp 0x40151e
Function at 0x401580
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x81c
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x818], eax
mov eax, dword [esp + 0x820]
push edi
push 0x7ff
xor edi, edi
lea ecx, [esp + 0x21]
push edi
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0x4000
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x28], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 4]
push edx
push edi
push edi
push edi
push 5
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
je 0x4015f7
xor al, al
pop edi
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.0040377c
add esp, 0x81c
ret 4
push ebx
push ebp
push esi
lea ebx, [ebx]
mov eax, dword [esp + 0x1c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esp + 0x1c]
push ecx
mov ebx, eax
mov eax, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x20]
push edx
push eax
call sub.MPR.dll_WNetEnumResourceA
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
jne 0x401696
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x40169e
lea ebp, [ebx + 0x14]
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov ecx, dword [ebp]
test ecx, ecx
je 0x40168a
cmp byte [ecx], 0x5c
jne 0x40168a
cmp byte [ecx + 1], 0x5c
jne 0x40168a
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401657
sub eax, esi
mov esi, eax
cmp esi, 2
jle 0x40167c
lea edx, [esi - 2]
push edx
add ecx, 2
lea eax, [esp + edi + 0x2c]
push ecx
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
lea edi, [edi + esi - 2]
mov esi, dword [esp + 0x20]
mov byte [esp + edi + 0x28], 0xd
inc edi
add ebp, 0x20
sub dword [esp + 0x14], 1
jne 0x401640
jmp 0x40169e
cmp esi, 0x103
jne 0x4016fc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, 0x103
jne 0x401600
mov ecx, dword [esp + 0x10]
push ecx
call sub.MPR.dll_WNetCloseEnum
mov esi, dword [esp + 0x24]
push 0x400
push 0
push esi
call sub.MSVCR90.dll_memset
push 0x400
lea edx, [esp + 0x38]
push edx
push esi
call sub.MSVCR90.dll_memcpy
add esp, 0x18
mov al, 1
mov ecx, dword [esp + 0x828]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.0040377c
add esp, 0x81c
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
push eax
call sub.MPR.dll_WNetCloseEnum
xor al, al
jmp 0x4016e1
Function at 0x401720
Capabilities:
Get hostname

Disassembly:
sub esp, 0x204
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
push 0x1ff
lea eax, [esp + 9]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x10], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x200
lea ecx, [esp + 8]
push ecx
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x40178b
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov esi, 0x40750c
call fcn.004011a0
xor al, al
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.0040377c
add esp, 0x204
ret
push 0x200
push 0
push esi
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x10]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4017a2
sub eax, edx
inc eax
cmp eax, 0x200
jle 0x4017b8
mov eax, 0x200
push eax
lea edx, [esp + 8]
push edx
push esi
call sub.MSVCR90.dll_memcpy
mov ecx, dword [esp + 0x210]
add esp, 0xc
pop esi
xor ecx, esp
mov al, 1
call fcn.0040377c
add esp, 0x204
ret
Function at 0x4018c0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x218
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x21c]
push ebp
push esi
push eax
mov dword [esp + 0xc], ecx
call sub.WSOCK32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
je 0x401a77
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x401a77
push ebx
push edi
push 0x100
lea eax, [esp + 0x128]
push 0
push eax
call sub.MSVCR90.dll_memset
push 0x100
lea ecx, [esp + 0x34]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0x18
xor ebx, ebx
xor esi, esi
jmp 0x401930
cmp esi, 0xf0
jge 0x4019d0
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
mov byte [esp + 0x22], al
mov eax, dword [ebx + edx]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x24]
push str._u._u._u._u
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea edi, [esi + 0xf]
add esp, 0x18
cmp esi, edi
mov ecx, esi
jge 0x4019be
jmp 0x401990
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
shl edx, 4
sub edx, eax
mov eax, ecx
sub eax, edx
mov dl, byte [esp + eax + 0x14]
mov byte [esp + ecx + 0x124], dl
inc ecx
cmp ecx, edi
jl 0x401990
mov eax, dword [ebp + 0xc]
add ebx, 4
cmp dword [ebx + eax], 0
mov esi, edi
jne 0x401930
xor eax, eax
xor esi, esi
lea ecx, [esp + 0x124]
mov bl, 0xd
lea ecx, [ecx]
cmp byte [ecx], 0
je 0x401a27
mov edx, dword [ecx]
mov dword [esp + eax + 0x24], edx
mov edx, dword [ecx + 4]
lea eax, [esp + eax + 0x24]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov dx, word [ecx + 0xc]
mov word [eax + 0xc], dx
mov dl, byte [ecx + 0xe]
mov byte [eax + 0xe], dl
lea eax, [esp + 0x24]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401a10
sub eax, edi
mov byte [esp + eax + 0x24], bl
inc esi
inc eax
add ecx, 0xf
cmp esi, 0xf
jl 0x4019e0
mov edi, dword [esp + 0x10]
push 0x100
push 0
push edi
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x30]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401a42
sub eax, edx
mov esi, eax
cmp esi, 0x100
jle 0x401a5a
mov esi, 0x100
test esi, esi
jle 0x401a6d
push esi
lea eax, [esp + 0x28]
push eax
push edi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
pop edi
mov al, 1
pop ebx
jmp 0x401a89
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov esi, 0x40750c
call fcn.004011a0
xor al, al
mov ecx, dword [esp + 0x21c]
pop esi
pop ebp
xor ecx, esp
call fcn.0040377c
add esp, 0x218
ret 4
Function at 0x401ab0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x40419e
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x1a0], eax
push esi
push edi
mov eax, dword [0x407018]
xor eax, esp
push eax
lea eax, [esp + 0x1b0]
mov dword fs:[0], eax
lea esi, [ebx + 4]
mov dword [esp + 0x14], ebx
call fcn.004024d0
xor esi, esi
lea edi, [ebx + 8]
mov dword [esp + 0x1b8], esi
call fcn.004022e0
lea edi, [ebx + 0x40]
xor ecx, ecx
mov eax, edi
mov byte [esp + 0x1b8], 1
call fcn.00402550
cmp dword [0x407500], esi
jne 0x401b5d
cmp dword [0x4074fc], esi
jne 0x401b5d
lea eax, [esp + 0x1c]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, esi
je 0x401b5d
mov ecx, eax
lea eax, [esp + 0x18]
call fcn.00402550
mov ecx, dword [eax]
push 0x405750
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ecx
call sub.MSVCR90.dll__CxxThrowException
push esi
push esi
push 1
push esi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
inc dword [0x407500]
mov dword [ebx], eax
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x14], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.0040377c
add esp, 0x1b0
ret
Function at 0x401c60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov edi, dword [0x407508]
mov eax, edi
mov ebx, ecx
call fcn.00401da0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov eax, 2
push 0x27dd
mov word [esp + 0x18], ax
call sub.WSOCK32.dll_htons
push ebx
mov word [esp + 0x1a], ax
call sub.WSOCK32.dll_inet_addr
push 0x10
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x24], eax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x401ce1
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.00401c40
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040377c
add esp, 0x20
ret
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x80
push 0xffff
mov edx, 1
mov eax, 0xa
push esi
mov word [esp + 0x24], dx
mov word [esp + 0x26], ax
call sub.WSOCK32.dll_setsockopt
lea edx, [edi + 0x3c]
push edx
push 0
push edi
push 0x4021c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x38], eax
test eax, eax
jne 0x401d4d
push 0x3ea
call fcn.00401c40
push esi
call sub.WSOCK32.dll_closesocket
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040377c
add esp, 0x20
ret
lea ebx, [edi + 4]
mov eax, ebx
call fcn.00402530
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edi + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], eax
mov eax, ebx
mov dword [edi + 0x14], esi
call fcn.00402540
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0040377c
add esp, 0x20
ret
Function at 0x402080
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x204
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x200], eax
push ebp
push esi
lea ebp, [ebx + 4]
push edi
mov eax, ebp
call fcn.00402530
mov esi, dword [ebx + 0x14]
mov eax, ebp
call fcn.00402540
cmp esi, 0xffffffff
je 0x402139
push 0x200
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0x200
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.WSOCK32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
je 0x40213e
test edi, edi
jle 0x402172
mov eax, ebp
call fcn.00402530
lea edx, [esp + 0xc]
push edx
lea esi, [ebx + 8]
call fcn.00402360
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x2c]
mov eax, ebp
call fcn.00402540
test esi, esi
je 0x402115
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
test edi, edi
je 0x40211f
push ebx
call edi
add esp, 4
mov eax, ebp
call fcn.00402530
mov esi, dword [ebx + 0x14]
mov eax, ebp
call fcn.00402540
cmp esi, 0xffffffff
jne 0x4020b4
mov eax, dword [ebx]
push eax
jmp 0x402197
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov edi, ebx
call fcn.00401c40
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x402159
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x402166
push ebx
call eax
add esp, 4
mov eax, ebx
call fcn.00401da0
mov ecx, dword [ebx]
push ecx
jmp 0x402197
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x402180
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x40218d
push ebx
call eax
add esp, 4
mov eax, ebx
call fcn.00401da0
mov edx, dword [ebx]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0040377c
add esp, 0x204
ret
Function at 0x40377c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407018]
jne 0x403786
repz ret
jmp fcn.00403bb5
Function at 0x5e9b68
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5e9b83
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124aeda8]
pop edx
test eax, eax
je 0x5e9c55
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5e9c44
test dword [ebp - 0x2a8], 1
jne 0x5e9c44
and dword [ebp - 0x2a8], 0x100
jne 0x5e9c44
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2ca9]
pop edx
pop esi
test eax, eax
je 0x5e9be7
jmp 0x5e9c44
cmp word [esi], 0x5a4d
jne 0x5e9c44
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5e9c44
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2e0d]
pop edx
test eax, eax
je 0x5e9c44
lea eax, [ebp - 0x28c]
push eax
call fcn.005e9ac4
test eax, eax
jne 0x5e9c3d
jmp 0x5e9c44
mov eax, esi
jmp 0x5e9c55
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5e9b83
pop esi
leave
ret 4

Function at 0x226d000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x226d00a
jmp 0x226f00f
jmp fcn.0203c058
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x4f30571a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x32692120
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401180
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x123
call fcn.00403030
add esp, 4
mov dword [0x4115f8], eax
xor ebx, ebx
xor eax, eax
mov ecx, dword [0x4115f8]
mov byte [ecx + eax], al
inc eax
cmp eax, 0x123
jl 0x40119b
mov eax, dword [esp + 0x20]
mov byte [esp + 0x20], bl
xor esi, esi
mov byte [eax], bl
mov byte [eax + 1], bl
mov edi, dword [esp + 0x20]
mov ebp, dword [0x4115f8]
mov eax, dword [esp + 0x18]
and edi, 0xff
xor edx, edx
lea ecx, [ebx + ebp]
mov dl, byte [edi + eax]
xor eax, eax
mov al, byte [ecx]
add esi, edx
add eax, esi
mov esi, 0x123
cdq
idiv esi
mov byte [esp + 0x10], dl
mov esi, dword [esp + 0x10]
and esi, 0xff
lea edx, [esi + ebp]
push edx
push ecx
call fcn.00401670
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x1c]
inc ebx
cmp ebx, 0x123
mov byte [esp + 0x20], dl
jl 0x4011bb
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40633d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4105e8
cmp edx, dword [eax]
je 0x40635f
add eax, 8
inc ecx
cmp eax, 0x410678
jl 0x406350
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4105e8]
jne 0x40648d
mov eax, dword [0x411610]
cmp eax, 1
je 0x406467
test eax, eax
jne 0x406390
cmp dword [0x410214], 1
je 0x406467
cmp edx, 0xfc
je 0x40648d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4063c7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406cb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404c60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40640a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404c60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40e3dc
push edi
call fcn.00407e00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406cb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406cc0
lea eax, [ebp - 0xa0]
push 0x40e3bc
push eax
call fcn.00406cc0
push dword [esi + 0x4105ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.00406cc0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407d6b
add esp, 0x2c
pop edi
jmp 0x40648d
lea eax, [ebp + 8]
lea esi, [esi + 0x4105ec]
push 0
push eax
push dword [esi]
call fcn.00404c60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40ae50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.005b5910
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1010], 0
mov dword [ebp - 0x1008], 0
push 0xffc
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x40aeb6
xor eax, eax
jmp 0x40b058
mov ecx, dword [ebp + 0xc]
shr ecx, 2
mov dword [ebp - 0x1014], ecx
cmp dword [ebp - 0x1014], 0x40000
jbe 0x40aed8
mov dword [ebp - 0x1014], 0x40000
mov edx, dword [ebp - 0x1014]
shr edx, 2
mov dword [ebp - 0x1014], edx
cmp dword [ebp - 0x1014], 0x400
ja 0x40af08
lea eax, [ebp - 0x1008]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1014], 0x400
jmp 0x40af41
push 0xa1a
push str..Archive.c
push 1
push 4
mov ecx, dword [ebp - 0x1014]
push ecx
call fcn.005b0ce0
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40af41
lea edx, [ebp - 0x1008]
mov dword [ebp - 8], edx
mov dword [ebp - 0x1014], 0x400
mov dword [ebp - 0x1010], 0
mov dword [ebp - 0x100c], 0
cmp dword [0x62a1f4], 0
je 0x40b009
cmp dword [ebp + 0x10], 0
je 0x40af91
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x1014]
shl ecx, 2
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
shr ecx, 2
mov dword [ebp - 4], ecx
jmp 0x40afad
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x1014]
push eax
push 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.005b55b0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
ja 0x40afb5
jmp 0x40b009
mov dword [ebp - 0x1010], 0
jmp 0x40afd0
mov edx, dword [ebp - 0x1010]
add edx, 1
mov dword [ebp - 0x1010], edx
mov eax, dword [ebp - 0x1010]
cmp eax, dword [ebp - 4]
jae 0x40aff5
mov ecx, dword [ebp - 0x1010]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x100c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x100c], eax
jmp 0x40afc1
mov ecx, dword [ebp - 0x100c]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x100c], ecx
jmp 0x40af55
cmp dword [ebp - 0x100c], 0
jne 0x40b02a
cmp dword [ebp - 0x1010], 0
je 0x40b02a
mov edx, dword [ebp - 0x100c]
add edx, 1
mov dword [ebp - 0x100c], edx
cmp dword [ebp - 8], 0
je 0x40b052
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x1008]
cmp eax, ecx
je 0x40b052
push 1
mov edx, dword [ebp - 8]
push edx
call fcn.005b16b0
add esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x100c]
mov esp, ebp
pop ebp
ret