joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4419c0]
imul eax, eax, 0x5a29d3f9
sub esp, 0x14
push edi
mov edi, ecx
mov dword [0x4419c0], eax
call fcn.004184d0
test al, al
jne 0x431d6c
mov ecx, dword [0x4403b4]
cmp ecx, 0x9965046e
jg 0x431bc1
mov dx, word [0x477cd4]
movsx eax, dx
shl eax, 8
cmp eax, 0xfbda85a3
jge 0x431bc1
mov cx, word [0x475890]
mov edx, dword [0x449958]
movsx eax, cx
add edx, eax
mov word [0x475890], dx
fld dword [0x48b878]
push esi
fsub dword [0x490b7c]
lea ecx, [ebp - 0x14]
fadd dword [0x48477c]
fstp dword [0x48477c]
call fcn.00431920
dec dword [0x446cf0]
mov eax, dword [0x44505c]
mov ecx, dword [0x446cf0]
mov edx, dword [0x44808c]
or eax, ecx
imul edx, eax
mov dword [0x44808c], edx
mov ecx, edi
fld dword [0x48b5c4]
fmul dword [0x490a20]
fmul dword [0x49028c]
fstp dword [0x49028c]
call fcn.0040beb0
mov ecx, edi
mov esi, eax
call fcn.004096a0
cmp esi, eax
je 0x431cde
jmp 0x431c40
fld dword [0x47ec94]
mov ecx, esi
fstp qword [0x465830]
call fcn.004099f0
push eax
call dword [0x492118]
test eax, eax
je 0x431cc2
mov eax, dword [0x44c7ac]
mov ecx, dword [0x4444c0]
shl eax, 0xa
xor eax, 0x41c3175c
xor ecx, 0x130ccc37
cmp eax, ecx
jl 0x431c85
xor dword [0x4402a8], 0x29ae7bd2
push esi
lea ecx, [ebp - 0x14]
call fcn.00421140
inc word [0x47b37e]
mov dx, word [0x47b37e]
movsx eax, dx
and eax, 0xa1c4202
or eax, 0x31208de8
cmp eax, 0x4710a91
jle 0x431cc2
fld dword [0x48033c]
fmul qword [0x45bb58]
fstp qword [0x45bb58]
mov ecx, edi
mov dword [0x44e530], 0xc9761a6e
add esi, 0x14
call fcn.004096a0
cmp esi, eax
jne 0x431c40
fld qword [0x46f6e8]
lea ecx, [ebp - 0x14]
fstp qword [0x45c0b8]
call fcn.00410c30
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00435600
cmp esi, eax
je 0x431d2b
xor dword [0x44dc68], 0x9fd04b47
push esi
mov ecx, edi
call fcn.0041e290
xor dword [0x442dbc], 0x94907f64
lea ecx, [ebp - 0x14]
add esi, 0x14
call fcn.00435600
cmp esi, eax
jne 0x431d00
mov ecx, dword [0x446978]
inc dword [0x446978]
cmp ecx, 0x8ff6a828
pop esi
jge 0x431d64
mov edx, dword [0x449390]
dec dword [0x449390]
cmp edx, 0x662ce202
jne 0x431d64
mov eax, dword [0x449770]
add eax, 0xe7c11f01
or dword [0x44eea4], eax
lea ecx, [ebp - 0x14]
call fcn.0040f9e0
fld dword [0x487880]
pop edi
fsub dword [0x47f520]
fadd qword [0x466ac0]
fld dword [0x482ee8]
fxch st(1)
fucompi st(1)
fstp st(0)
lahf
test ah, 0x44
jnp 0x431da3
movzx eax, word [0x47aa0a]
sub eax, 0x6fff33ca
mov word [0x47aa0a], ax
mov esp, ebp
pop ebp
ret

Function at 0x433ea0
Capabilities:
Encode data using xor

Disassembly:
fld dword [0x48ce28]
push esi
fsub dword [0x481990]
mov esi, ecx
fmul qword [0x469b10]
fstp qword [0x469b10]
call fcn.0042baa0
add dword [0x449328], 0x52497ba1
cmp dword [esi + 0x18], 0
jne 0x433efa
or dword [0x443428], 0x5d67c334
call fcn.0041cf70
mov dword [esi + 0x18], eax
mov eax, dword [0x445638]
xor eax, 0x2b1dfad
shl eax, 5
mov dword [0x44d3e8], eax
cmp dword [esi + 0x18], 0
je 0x433ed0
movzx ecx, word [0x47d1c0]
imul ecx, ecx, 0x432a9544
mov word [0x47d1c0], cx
pop esi
ret
Function at 0x435a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
fld dword [0x48a040]
mov edx, dword [ebp + 8]
fsub dword [0x4800d8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0xffff8a75
fstp dword [0x48a040]
mov word [0x47af94], ax
mov cl, byte [esi]
movzx eax, byte [edx]
push edi
movzx edi, cl
sub eax, edi
mov edi, 1
jne 0x435a97
push ebx
lea ebx, [ebx]
test cl, cl
je 0x435a96
mov cl, byte [esi + edi]
movzx eax, byte [edx + edi]
add esi, edi
add edx, edi
movzx ebx, cl
sub eax, ebx
je 0x435a80
pop ebx
dec dword [0x44b60c]
mov ecx, dword [0x4472ac]
mov edx, dword [0x44b60c]
imul ecx, edx
mov dword [0x4472ac], ecx
test eax, eax
jge 0x435ad5
mov eax, dword [0x447514]
imul eax, eax, 0x21308406
mov dword [0x447514], eax
or eax, 0xffffffff
xor dword [0x44e648], 0x13848183
jmp 0x435b13
jle 0x435b13
add word [0x478574], di
mov cx, word [0x478574]
movsx eax, cx
add eax, 0x572d603c
and dword [0x4433e8], eax
mov eax, edi
fld dword [0x48a328]
fmul qword [0x46aa50]
fadd dword [0x48da78]
fadd dword [0x491a34]
fstp dword [0x491a34]
add dword [0x440f3c], edi
mov ecx, dword [0x440f3c]
xor ecx, 0x1ad8e98e
and dword [0x440e3c], ecx
pop edi
pop esi
pop ebp
ret
Function at 0x5d1249df
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x5d1249ea
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x5d128eef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push esi
call fcn.5d12a40f
mov esi, dword [esp + 0x14]
or dword [esp + 8], 0xffffffff
push 5
push dword [esp + 0x1c]
push esi
call fcn.5d121b6b
add esp, 0xc
test eax, eax
mov dword [esp + 0xc], eax
je 0x5d128fcf
push ebx
push ebp
push edi
push 0xf0
push dword [esp + 0x28]
push esi
call fcn.5d121b6b
mov edi, dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, dword [sym.imp.kernel32.dll_LockResource]
add esp, 0xc
xor ebp, ebp
test eax, eax
je 0x5d128f4c
push eax
push esi
call edi
push eax
call ebx
mov ebp, eax
push dword [esp + 0x18]
and dword [esp + 0x14], 0
push esi
call edi
test eax, eax
je 0x5d128fb1
push eax
call ebx
mov edi, eax
test edi, edi
je 0x5d128fb1
push ebp
push edi
call fcn.5d12a40f
pop ecx
pop ecx
push dword [esp + 0x30]
mov ebx, eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push eax
mov dword [esp + 0x18], eax
call fcn.5d121b7e
test al, al
pop ecx
jne 0x5d128f9d
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x5d128fbb
push ebx
call dword [sym.imp.kernel32.dll_GlobalHandle]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
jmp 0x5d128fbb
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
pop edi
pop ebp
pop ebx
je 0x5d128fcf
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [esp + 8]
pop esi
add esp, 0xc
ret
Function at 0x5d128fd8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push esi
call fcn.5d12a40f
mov esi, dword [esp + 0x14]
or dword [esp + 8], 0xffffffff
push 5
push dword [esp + 0x1c]
push esi
call fcn.5d121b58
add esp, 0xc
test eax, eax
mov dword [esp + 0xc], eax
je 0x5d1290b8
push ebx
push ebp
push edi
push 0xf0
push dword [esp + 0x28]
push esi
call fcn.5d121b58
mov edi, dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, dword [sym.imp.kernel32.dll_LockResource]
add esp, 0xc
xor ebp, ebp
test eax, eax
je 0x5d129035
push eax
push esi
call edi
push eax
call ebx
mov ebp, eax
push dword [esp + 0x18]
and dword [esp + 0x14], 0
push esi
call edi
test eax, eax
je 0x5d12909a
push eax
call ebx
mov edi, eax
test edi, edi
je 0x5d12909a
push ebp
push edi
call fcn.5d12a40f
pop ecx
pop ecx
push dword [esp + 0x30]
mov ebx, eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push eax
mov dword [esp + 0x18], eax
call fcn.5d121b7e
test al, al
pop ecx
jne 0x5d129086
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x5d1290a4
push ebx
call dword [sym.imp.kernel32.dll_GlobalHandle]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
jmp 0x5d1290a4
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
pop edi
pop ebp
pop ebx
je 0x5d1290b8
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [esp + 8]
pop esi
add esp, 0xc
ret

Function at 0x5d1290c1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebp
push esi
call fcn.5d12a40f
mov esi, dword [esp + 0x18]
push 5
push dword [esp + 0x20]
xor ebp, ebp
push esi
mov dword [esp + 0x18], ebp
call fcn.5d121b6b
add esp, 0xc
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x5d129198
push ebx
push edi
push 0xf0
push dword [esp + 0x28]
push esi
call fcn.5d121b6b
mov edi, dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, dword [sym.imp.kernel32.dll_LockResource]
add esp, 0xc
cmp eax, ebp
je 0x5d12911d
push eax
push esi
call edi
push eax
call ebx
mov ebp, eax
push dword [esp + 0x18]
and dword [esp + 0x14], 0
push esi
call edi
test eax, eax
je 0x5d12917b
push eax
call ebx
mov edi, eax
test edi, edi
je 0x5d12917b
push ebp
push edi
call fcn.5d12a40f
pop ecx
pop ecx
push dword [esp + 0x30]
mov ebx, eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x5d129167
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x5d129185
push ebx
call dword [sym.imp.kernel32.dll_GlobalHandle]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
jmp 0x5d129185
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
pop edi
pop ebx
je 0x5d129198
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x5d1291a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebp
push esi
call fcn.5d12a40f
mov esi, dword [esp + 0x18]
push 5
push dword [esp + 0x20]
xor ebp, ebp
push esi
mov dword [esp + 0x18], ebp
call fcn.5d121b58
add esp, 0xc
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x5d129279
push ebx
push edi
push 0xf0
push dword [esp + 0x28]
push esi
call fcn.5d121b58
mov edi, dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, dword [sym.imp.kernel32.dll_LockResource]
add esp, 0xc
cmp eax, ebp
je 0x5d1291fe
push eax
push esi
call edi
push eax
call ebx
mov ebp, eax
push dword [esp + 0x18]
and dword [esp + 0x14], 0
push esi
call edi
test eax, eax
je 0x5d12925c
push eax
call ebx
mov edi, eax
test edi, edi
je 0x5d12925c
push ebp
push edi
call fcn.5d12a40f
pop ecx
pop ecx
push dword [esp + 0x30]
mov ebx, eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x5d129248
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x5d129266
push ebx
call dword [sym.imp.kernel32.dll_GlobalHandle]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
jmp 0x5d129266
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
pop edi
pop ebx
je 0x5d129279
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x5d1299d4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.5d1299c6
and byte [esi + 0xc], 0
mov eax, sym.ATL70.DLL_Ordinal_16
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call fcn.5d129e50
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x5d129a2e
cmp dword [ebp - 0x18], 5
jb 0x5d129a46
jmp 0x5d129a42
cmp dword [ebp - 0xc], 1
jne 0x5d129a46
cmp dword [ebp - 0x18], 4
ja 0x5d129a42
jne 0x5d129a46
cmp dword [ebp - 0x14], 0
jbe 0x5d129a46
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x5d12e234
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x5d12a40f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x5d12a41e
pop dword [ebp - 0x34]
mov eax, 0xb3175db6
add eax, 0xa9fb4668
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xc6af27db
sub dword [ebp - 0x44], 0x785ce290
mov dword [ebp - 0x40], 0xb37ec11c
add dword [ebp - 0x40], 0x7eb48b29
mov dword [ebp - 0x3c], 0x6c76ec56
add dword [ebp - 0x3c], 0xdfd557d8
mov dword [ebp - 0x38], 0xdd8a0f30
sub dword [ebp - 0x38], 0xdd8a0f30
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x161bad0b
add dword [ebp - 0x44], 0x5e56bc4b
mov dword [ebp - 0x40], 0x884f7c92
sub dword [ebp - 0x40], 0x46e31b1d
mov dword [ebp - 0x3c], 0x528ea8f7
add dword [ebp - 0x3c], 0x10e0c375
mov dword [ebp - 0x38], 0x1f3ec4b0
sub dword [ebp - 0x38], 0x1f3ec4b0
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37886
push 0
call eax
mov ecx, 0x6240eaa0
sub ecx, 0x6240a1ce
xor edi, edi
add edi, eax
mov ebx, 0x5d132e00
add ebx, dword [ebp - 0x34]
mov esi, 0xe784ee1f
sub esi, 0x3086f39f
mov edx, dword [ebx]
add dword [ebp - 0xc], 0xf905e9c9
xor edx, esi
sub dword [ebp - 0x28], 0x7024433c
mov dword [edi], edx
sub dword [ebp - 0x1c], edi
add edi, 4
add ebx, 4
loop 0x5d12a532
add eax, 0x1161b
mov ebx, eax
add eax, 0xb1520488
add eax, 0x4eadfb7d
mov ecx, 0x80527fbb
sub ecx, 0x23407fbb
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e0198dc
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e0198dc
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8

Function at 0x2e0198dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2e0198eb
pop dword [ebp - 0xc]
mov eax, 0xbb3b26e6
sub eax, 0x8d398dfb
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x3932980d
sub dword [ebp - 0x1c], 0xeae052c2
mov dword [ebp - 0x18], 0x2b300801
sub dword [ebp - 0x18], 0xf8fcbbbc
mov dword [ebp - 0x14], 0x58c3ce87
sub dword [ebp - 0x14], 0xc778a59
mov dword [ebp - 0x10], 0x7e7af4dc
sub dword [ebp - 0x10], 0x7e7af4dc
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xfd5f68c3
sub eax, 0xcf5c37fb
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xf3c28765
add dword [ebp - 0x1c], 0x80afe1f1
mov dword [ebp - 0x18], 0x9fed2e48
sub dword [ebp - 0x18], 0x5e80ccd3
mov dword [ebp - 0x14], 0x649704d4
sub dword [ebp - 0x14], 0x1279868
mov dword [ebp - 0x10], 0x6c4ddfad
sub dword [ebp - 0x10], 0x6c4ddfad
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x5063670f
sub eax, 0x22603653
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x43e49
push 0
call eax
mov ecx, 0x5332
xor esi, esi
add esi, eax
mov edx, 0x875ab60e
sub edx, 0x5955380e
add edx, dword [ebp - 0xc]
mov edi, 0x6a7c0305
add dword [ebp - 4], edx
mov ebx, dword [edx]
xor dword [ebp - 8], ebx
sub ebx, edi
mov dword [esi], ebx
add dword [ebp - 8], 0xda3bf2ed
add esi, 4
add edx, 0x3eacb736
sub edx, 0x3eacb732
loop 0x2e019a03
add eax, 0x13f9b
xor ebx, ebx
add ebx, eax
add eax, 0x40114346
add eax, 0xbfeebcbf
mov ecx, 0x558b3
sub ecx, 0xd20558b3
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x402c72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402c81
pop dword [ebp - 0x44]
mov eax, 0x3e4e99a2
add eax, 0xc1f192df
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x284aded2
sub dword [ebp - 0x54], 0xd9f89987
mov dword [ebp - 0x50], 0x9b15f7cd
sub dword [ebp - 0x50], 0x68e2ab88
mov dword [ebp - 0x4c], 0xbe9e2a91
sub dword [ebp - 0x4c], 0x7251e663
mov dword [ebp - 0x48], 0xc80149aa
sub dword [ebp - 0x48], 0xc80149aa
lea eax, [ebp - 0x54]
push eax
mov eax, 0xf3a31edd
sub eax, 0xf362add1
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x57cc01bf
add dword [ebp - 0x54], 0x1ca66797
mov dword [ebp - 0x50], 0x88cf8b88
sub dword [ebp - 0x50], 0x47632a13
mov dword [ebp - 0x4c], 0x6b6f1e8d
sub dword [ebp - 0x4c], 0x7ffb221
mov dword [ebp - 0x48], 0x9fc2d6a2
sub dword [ebp - 0x48], 0x9fc2d6a2
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xe29c9009
sub eax, 0xe25c1ef5
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36923
push 0
call eax
mov ecx, 0x467e
mov edx, eax
mov edi, 0x8afc6c77
sub edi, 0x8ab94677
add edi, dword [ebp - 0x44]
mov esi, 0x13390903
add esi, 0xead59d9c
mov ebx, dword [edi]
sub dword [ebp - 0x18], edx
xor ebx, esi
add dword [ebp - 0x20], 0xbeb809c7
mov dword [edx], ebx
xor dword [ebp - 4], 0x9b7920ee
add edx, 0xbf641b68
sub edx, 0xbf641b64
add edi, 0x44c7e25
add edi, 0xfbb381df
loop 0x402d9d
add eax, 0x10ccb
mov ebx, eax
add eax, 0xad440337
sub eax, 0xad440332
mov ecx, 0x7c78ea4e
add ecx, 0x83c715b2
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x403043
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417044]
sub esi, dword [0x40afb0]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x423eac], eax
jle 0x4031ad
push dword [0x41f054]
call fcn.004031f1
push ebx
push ebx
push dword [0x40afb0]
push dword [0x409018]
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [0x41f050], esi
mov dword [0x417040], ebx
mov ebp, 0x40b040
mov eax, dword [0x417048]
mov edi, 0x4000
sub eax, dword [0x41f054]
cmp eax, edi
jg 0x4030b8
mov edi, eax
mov esi, 0x413040
push edi
push esi
call fcn.00402c72
test eax, eax
je 0x40319f
add dword [0x41f054], edi
mov dword [0x40afd0], esi
mov dword [0x40afd4], edi
cmp dword [0x423eb0], ebx
je 0x40310f
cmp dword [0x423f40], ebx
jne 0x40310f
mov eax, dword [0x41f050]
push ebx
sub eax, dword [0x417044]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40afb0]
mov dword [0x417040], eax
call fcn.00402c72
pop ecx
mov ecx, 0x40afb8
mov dword [0x40afd8], ebp
mov dword [0x40afdc], 0x8000
call fcn.00402c72
test eax, eax
jl 0x4031a8
mov esi, dword [0x40afd8]
sub esi, ebp
je 0x403169
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x409018]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x4031a4
cmp esi, dword [esp + 0x10]
jne 0x4031a4
add dword [0x40afb0], esi
cmp dword [0x40afd4], ebx
jne 0x4030de
jmp 0x403175
cmp dword [0x40afd4], ebx
jne 0x4031a8
cmp edi, ebx
je 0x4031a8
mov eax, dword [0x417044]
mov ecx, eax
sub ecx, dword [0x40afb0]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4030a2
push ebx
push ebx
push eax
push dword [0x409018]
call dword [sym.imp.kernel32.dll_SetFilePointer]
jmp 0x4031ad
or eax, 0xffffffff
jmp 0x4031b7
push 0xfffffffffffffffe
jmp 0x4031aa
push 0xfffffffffffffffd
pop eax
jmp 0x4031b7
push 1
call fcn.00402c72
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4058b4
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405e88
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4058d8
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405a11
mov ebx, dword [sym.imp.kernel32.dll_GetShortPathNameA]
mov dword [0x422630], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422630
je 0x40591c
push 1
push 0
push esi
call fcn.0040583d
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
mov esi, 0x4220a8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
push esi
push ebp
push str._s_s_r_n
push 0x421ca8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423eb0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00402c72
push 4
push 0xc0000000
push esi
call fcn.0040583d
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405a11
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a0a
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x405a0a
cmp edi, dword [esp + 0x18]
jne 0x405a0a
push str._Rename__r_n
push esi
call fcn.004057b2
test eax, eax
jne 0x405a1e
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405b66
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421ca8
push eax
call fcn.004057fe
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
inc dword [0x423f30]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409350
push eax
call fcn.004057b2
test eax, eax
je 0x4059d5
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405a45
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405a3a
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x4059d7
Function at 0x40cf50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x454470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x45446c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x454470], edx
cmp eax, 0x26f
jl 0x40cf58
mov dword [0x444d70], 0x270
ret

Function at 0x40cf90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x454474]
mov ebx, dword [eax*4 + 0x454470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x454aa4]
mov dword [eax*4 + 0x454470], edx
cmp eax, 0xe2
jl 0x40cf98
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x454474]
mov ebx, dword [eax*4 + 0x454470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x4540e4]
mov dword [eax*4 + 0x454470], edx
cmp eax, 0x26e
jl 0x40cfe8
mov edx, dword [0x454470]
mov ecx, dword [0x454e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x454aa0]
mov dword [0x454e2c], eax
mov dword [0x444d70], 0
pop ebx
ret

Function at 0x40d070
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x444d70]
add dword [0x444d70], 1
mov eax, dword [0x453020]
cmp eax, dword [0x4444c0]
jne 0x40d093
cmp ebx, 0x271
jb 0x40d0b4
mov eax, dword [0x453020]
call fcn.0040cf50
not dword [0x453020]
mov eax, dword [0x453020]
mov dword [0x4444c0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40d0d0
call fcn.0040cf90
xor ebx, ebx
mov dword [0x444d70], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x454470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret