joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404936
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareAutoIt_v3AutoIt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404a54
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push 0x432194
push ebx
push str.SoftwareAutoIt_v3Aut2Exe
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0x43ce88
push esi
call fcn.00412e3b
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push ebx
push str.LastScriptDir
push dword [ebp - 4]
call esi
mov ebx, 0x43d090
push ebx
call fcn.00412e3b
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.LastExeDir
push dword [ebp - 4]
call esi
mov ebx, 0x43d298
push ebx
call fcn.00412e3b
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.LastIconDir
push dword [ebp - 4]
call esi
mov ebx, 0x43d4a0
push ebx
call fcn.00412e3b
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.LastIcon
push dword [ebp - 4]
call esi
push 4
pop ebx
push ebx
push 0x43d6a8
push ebx
push 0
push str.LastCompression
push dword [ebp - 4]
call esi
push ebx
push 0x43d6ac
push ebx
push 0
push str.UseUPX
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408420
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 8], ecx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x408450
xor al, al
jmp 0x4084a9
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.00411fc9
pop ecx
push ebx
lea ecx, [ebp - 4]
mov dword [ebp + 8], eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov esi, dword [ebp + 8]
je 0x40849f
mov ecx, dword [ebp - 8]
push ebx
push str.SCRIPT
push 0xa
push dword [ebp - 4]
add ecx, 0x1750
push esi
call fcn.0040a21b
mov bl, al
push esi
call fcn.00415940
pop ecx
mov al, bl
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4097e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 2
xor ebx, ebx
push ebx
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x409802
xor al, al
jmp 0x40989b
lea eax, [ebp - 4]
mov dword [0x43ce10], ebx
push eax
push 0x409750
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
test eax, eax
jne 0x40982c
cmp dword [ebp - 4], ebx
jne 0x40982c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4097fb
push 0xe
push 0x63
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x409823
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x409892
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, word [eax + 4]
mov dword [0x43ce14], ecx
test ecx, ecx
je 0x409872
lea edx, [eax + 0x12]
mov ax, word [edx]
lea edx, [edx + 0xe]
mov word [ebx*2 + 0x43ce20], ax
inc ebx
cmp ebx, ecx
jb 0x40985f
cmp ecx, 0x10
jae 0x409890
mov eax, dword [0x43ce10]
sub eax, ecx
inc eax
add eax, ecx
mov word [ecx*2 + 0x43ce20], ax
inc ecx
inc eax
cmp ecx, 0x10
jb 0x409881
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bdae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
lea eax, [ecx + 4]
mov dword [ebx], eax
mov esi, dword [ecx + edi]
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412701
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00412760
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [esi + edi], ax
add esp, 0x10
add dword [ebx], esi
test ecx, ecx
jle 0x40be09
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x40be00
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40d491
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test al, 0x10
je 0x40d4cd
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x40d50a
mov dword [esi], edi
mov eax, dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
test dword [ebp + 8], eax
je 0x40d4f3
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x40d4c5
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40d541
or eax, 0xffffffff
jmp 0x40d4c5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x40d518
cmp eax, 0xffffffff
je 0x40d518
push 1
mov edx, esi
mov ecx, eax
call fcn.0040d3cd
pop ecx
jmp 0x40d4c3
push edi
push 0x80
push 3
lea eax, [ebp - 0xc]
push eax
push 2
push 0x40000000
push 0x4368e8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x40d4c1
test eax, eax
je 0x40d4c1
mov ecx, dword [esi]
lea edx, [ebp + 0x10]
push 1
call fcn.0040d3cd
pop ecx
mov ecx, esi
call fcn.0040d3b8
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40d4c3

Function at 0x40d55f
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test al, 0x10
je 0x40d59a
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x40d5d5
mov dword [esi], edi
mov eax, dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
test al, 1
je 0x40d5bf
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x40d592
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40d60c
or eax, 0xffffffff
jmp 0x40d592
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x40d5e3
cmp eax, 0xffffffff
je 0x40d5e3
push 1
mov edx, esi
mov ecx, eax
call fcn.0040d3cd
pop ecx
jmp 0x40d590
push edi
push 0x80
push 3
lea eax, [ebp - 0xc]
push eax
push 1
push 0x80000000
push 0x4368e8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x40d58e
test eax, eax
je 0x40d58e
mov ecx, dword [esi]
lea edx, [ebp + 0x10]
push 1
call fcn.0040d3cd
pop ecx
mov ecx, esi
call fcn.0040d3b8
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40d590

Function at 0x40d68f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi + 0x30], ecx
jne 0x40d6b3
lea eax, [ebp - 4]
push eax
push ecx
push esi
push 0x40d80d
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d6b8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea edi, [ecx + 0x30]
cmp dword [edi], 0
je 0x40d70f
lea edx, [ecx + 0x34]
mov eax, dword [edx]
push ebx
mov dword [ebp - 4], edx
xchg dword [edx], eax
mov ebx, 0x1f6
cmp eax, ebx
je 0x40d70e
push esi
lea esi, [ecx + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x3e8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, edi
call fcn.0040d3b8
mov eax, dword [ebp - 4]
xchg dword [eax], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40d827
Capabilities:
Read file on windows

Disassembly:
push 0x14
mov eax, 0x428d1f
call fcn.00417859
mov edi, ecx
lea esi, [edi + 0x34]
mov eax, 0x1f5
mov dword [ebp - 0x18], esi
xchg dword [esi], eax
push 0xffff
call fcn.00412701
mov ebx, eax
mov eax, 0xffff
push eax
mov dword [edi + 0x10], eax
call fcn.00412701
pop ecx
pop ecx
push 0
mov dword [edi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 0xffff
push ebx
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d936
cmp dword [ebp - 0x10], 0
jbe 0x40d933
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 0x10]
add eax, ecx
cmp dword [edi + 0x10], eax
jae 0x40d8f2
mov eax, dword [edi + 0xc]
add eax, dword [ebp - 0x10]
mov esi, dword [edi + 8]
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
jns 0x40d8bd
fadd qword [0x4369d8]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fmul qword [0x4369b8]
call fcn.004280a6
push eax
mov dword [edi + 0x10], eax
call fcn.00412701
push dword [edi + 0xc]
mov dword [edi + 8], eax
push esi
push dword [edi + 8]
call fcn.00412760
push esi
call fcn.00412752
mov ecx, dword [ebp - 0x10]
add esp, 0x14
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
push ecx
push ebx
push eax
call fcn.00412760
mov eax, dword [ebp - 0x10]
add esp, 0xc
add dword [edi + 0xc], eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
lea eax, [ebp - 0x10]
push eax
push 0xffff
push ebx
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d87e
mov esi, dword [ebp - 0x18]
push ebx
call fcn.00412752
pop ecx
mov eax, 0x1f6
mov ecx, eax
xchg dword [esi], ecx
call fcn.00417836
ret
Function at 0x40e371
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
jne 0x40e391
and dword [esi + 8], 0
and dword [esi + 0xc], 0
call fcn.0040e350
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
xor edi, edi
cmp dword [ebp + 0xc], edi
jbe 0x40e3e2
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
jne 0x40e3cc
push 0
lea eax, [ebp + 8]
push eax
push 0x10000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e3e1
mov eax, dword [ebp + 8]
test eax, eax
je 0x40e3e1
and dword [esi + 0xc], 0
mov dword [esi + 8], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov al, byte [ecx + eax]
mov byte [edi + ebx], al
inc edi
inc dword [esi + 0xc]
cmp edi, dword [ebp + 0xc]
jb 0x40e39c
pop ebx
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop esi
pop ebp
ret 8

Function at 0x40e3f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.0040e422
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40e5da
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x428d90
call fcn.00417859
mov ecx, dword [ebp + 0xc]
call fcn.00401715
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 1
push ebx
push str.SoftwareAutoIt_v3AutoIt
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40e612
xor al, al
jmp 0x40e6a5
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push str.Include
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e69a
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412701
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040290b
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x1c]
push eax
push esi
push ebx
push ebx
push str.Include
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e685
mov eax, dword [ebp - 0x10]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x10], eax
push esi
mov word [esi + eax*2], cx
mov ecx, dword [ebp + 0xc]
call fcn.0040182f
mov bl, 1
mov eax, dword [ebp - 0x18]
dec dword [eax]
jne 0x40e69a
push eax
call fcn.00412752
push esi
call fcn.00412752
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.00417836
ret
Function at 0x40e9a2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x43a034]
xor eax, esp
mov dword [esp + 0x258], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40e9eb
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40e9e0
or eax, eax
jmp 0x40e9eb
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x25c]
pop esi
xor ecx, esp
call fcn.004126d0
mov esp, ebp
pop ebp
ret

Function at 0x40ebda
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x24
mov eax, 0x428e31
call fcn.00417859
push ecx
lea ecx, [ebp - 0x30]
call fcn.00403a7b
xor ebx, ebx
lea ecx, [ebp - 0x30]
push 0x432988
mov dword [ebp - 4], ebx
call fcn.00408e53
mov esi, dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40ec8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40ec29
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40ec2e
jmp 0x40ec8f
cmp eax, 3
jne 0x40ec91
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
inc dword [eax]
push 0x432988
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0040ed69
cmp eax, 0xffffffff
je 0x40ec81
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x20]
call fcn.0040191a
lea ecx, [ebp - 0x20]
call fcn.0040ebda
test al, al
je 0x40ec7f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea ecx, [ebp - 0x20]
call fcn.004015bf
jmp 0x40ec91
test al, 0x10
je 0x40ec91
mov bl, 1
lea ecx, [ebp - 0x30]
call fcn.004015bf
mov al, bl
call fcn.00417836
ret

Function at 0x410151
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41017c
xor eax, eax
jmp 0x41018f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x4106f1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
cmp dword [edi + 8], eax
jae 0x4107d9
sub eax, dword [edi + 8]
push ebx
mov ebx, 0x403
sub ebx, dword [edi + 0x43c]
mov dword [ebp - 4], ebx
push esi
cmp eax, ebx
jae 0x410721
mov ebx, eax
mov dword [ebp - 4], eax
cmp dword [edi + 0x14], 1
mov esi, ebx
mov dword [ebp - 8], esi
jne 0x410762
test ebx, ebx
je 0x4107d1
mov esi, dword [edi + 8]
mov edx, dword [edi + 0x440]
mov eax, dword [edi]
and edx, 0x1ffff
mov ecx, dword [edi + 0x434]
mov al, byte [esi + eax]
mov byte [edx + ecx], al
inc dword [edi + 0x440]
inc dword [edi + 8]
dec ebx
jne 0x410734
mov ebx, dword [ebp - 4]
jmp 0x4107d1
test ebx, ebx
je 0x4107d1
mov eax, dword [edi + 0x47c]
dec esi
test eax, eax
je 0x410778
cmp eax, 0x10000
jne 0x410797
push dword [edi + 0x1c]
push 0x10000
push 1
push dword [edi + 0x478]
call fcn.004131db
add esp, 0x10
and dword [edi + 0x47c], 0
mov ecx, dword [edi + 0x47c]
mov eax, dword [edi + 0x478]
mov dl, byte [ecx + eax]
lea eax, [ecx + 1]
mov ecx, dword [edi + 0x440]
and ecx, 0x1ffff
mov dword [edi + 0x47c], eax
mov eax, dword [edi + 0x434]
mov byte [ecx + eax], dl
inc dword [edi + 0x440]
inc dword [edi + 8]
test esi, esi
jne 0x410766
add dword [edi + 0x43c], ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4107de
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x18], 1
jne 0x410804
push dword [esi + 0x448]
mov eax, dword [esi + 0xc]
push dword [esi + 0x444]
add eax, dword [esi + 4]
push eax
call fcn.00412760
add esp, 0xc
jmp 0x41081d
push dword [esi + 0x20]
push dword [esi + 0x448]
push 1
push dword [esi + 0x444]
call fcn.0041374f
add esp, 0x10
mov eax, dword [esi + 0x448]
add dword [esi + 0xc], eax
and dword [esi + 0x448], 0
pop esi
ret

Function at 0x4108ba
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
push edi
push 0x20
pop edi
movzx eax, word [esi + 0x454]
mov cl, al
shl dword [esi + 0x450], cl
cmp ax, di
jae 0x410923
mov ecx, dword [esi + 0x448]
mov edx, dword [esi + 0x444]
mov al, byte [esi + 0x453]
mov byte [edx + ecx], al
inc dword [esi + 0x448]
mov edx, dword [esi + 0x448]
mov ecx, dword [esi + 0x444]
mov al, byte [esi + 0x452]
mov byte [edx + ecx], al
inc dword [esi + 0x448]
shl dword [esi + 0x450], 0x10
add word [esi + 0x454], 0x10
cmp word [esi + 0x454], di
jb 0x4108d5
mov word [esi + 0x454], di
mov ecx, esi
pop edi
pop esi
jmp fcn.004107de

Function at 0x410d43
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 8
push 0
lea eax, [esi + 0x44]
push eax
call fcn.004158b0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
pop esi
ret
Function at 0x4117ce
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x43a034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x98]
push esi
push edi
mov edi, dword [ebp + 8]
and dword [ebx + 0x10], 0
mov dword [ebx + 0xc], eax
call fcn.00410d43
push 0x43698d
call fcn.00412db0
pop ecx
lea ecx, [ebp - 0x98]
mov esi, eax
call fcn.00410d43
push esi
push 0x43698d
lea ecx, [ebp - 0x98]
call fcn.00410d74
lea ecx, [ebp - 0x98]
call fcn.00410e13
and dword [ebx + 8], 0
push 0x436990
push edi
call fcn.00412e54
mov dword [ebx + 4], eax
pop ecx
pop ecx
test eax, eax
jne 0x41184d
inc eax
jmp 0x4118ca
push 2
push 0
push eax
call fcn.00413860
add esp, 0xc
xor esi, esi
inc esi
push dword [ebx + 4]
push 8
push esi
push 0x43b6e0
call fcn.0041374f
push dword [ebx + 4]
push 8
push esi
push 0x43b6e8
call fcn.0041374f
push dword [ebx + 4]
push esi
push 4
push str.AU3_
call fcn.0041374f
push dword [ebx + 4]
push esi
push 4
push 0x43b314
call fcn.0041374f
add esp, 0x40
lea eax, [ebp - 0x98]
push 0x99f2
push 0x10
push eax
call fcn.0040249b
push dword [ebx + 4]
lea eax, [ebp - 0x98]
push 0x10
push esi
push eax
call fcn.0041374f
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004126d0
mov esp, ebp
pop ebp
ret 8

Function at 0x4118dd
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4118fc
push esi
mov esi, dword [eax + 0x208]
push eax
call fcn.004135be
mov eax, esi
pop ecx
test esi, esi
jne 0x4118e8
pop esi
push dword [edi + 4]
push 4
push 1
push str.AU3_
call fcn.0041374f
push dword [edi + 4]
push 4
push 1
push 0x43b314
call fcn.0041374f
push dword [edi + 4]
call fcn.00412f9f
add esp, 0x24
pop edi
ret
Function at 0x41192b
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x43a034]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x43221c
push ecx
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], edi
call fcn.00412e54
mov dword [ebp - 0xf0], eax
pop ecx
pop ecx
test eax, eax
jne 0x411978
push edi
call fcn.00412f9f
pop ecx
xor al, al
jmp 0x411a5f
push 0x10000
call fcn.00412701
pop ecx
push eax
lea ecx, [ebp - 0x100]
call fcn.0040290b
lea ecx, [ebp - 0xe4]
call fcn.00411620
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0xe4]
inc esi
mov dword [ebp - 0xec], esi
call fcn.00411765
push edi
call fcn.004174ff
pop ecx
test eax, eax
jne 0x411a37
mov esi, dword [ebp - 0x100]
push edi
push 0x10000
push 1
push esi
call fcn.004131db
add esp, 0x10
mov dword [ebp - 0xe8], eax
lea ecx, [ebp - 0xec]
push eax
push esi
call fcn.004100fb
mov eax, dword [ebp - 0xe8]
xor ebx, ebx
test eax, eax
je 0x411a15
mov edi, eax
push ecx
push ecx
lea ecx, [ebp - 0xe4]
call fcn.00411739
xor byte [esi + ebx], al
inc ebx
cmp ebx, edi
jb 0x4119f4
mov edi, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xe8]
push dword [ebp - 0xf0]
push eax
push 1
push esi
call fcn.0041374f
push edi
call fcn.004174ff
add esp, 0x14
test eax, eax
je 0x4119c2
mov esi, dword [ebp - 0xec]
push edi
call fcn.00412f9f
pop ecx
push dword [ebp - 0xf0]
call fcn.00412f9f
pop ecx
mov ecx, dword [ebp - 0xf8]
mov dword [ecx], esi
lea ecx, [ebp - 0x100]
call fcn.00402936
mov al, 1
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004126d0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x411a72
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov ebx, 0x10000
mov edi, ecx
push ebx
call fcn.00412701
pop ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.0040290b
push dword [ebp + 8]
call fcn.004174ff
pop ecx
jmp 0x411ac0
push ebx
push 1
push dword [ebp - 0xc]
call fcn.004131db
push dword [edi + 4]
push eax
push 1
push dword [ebp - 0xc]
call fcn.0041374f
push dword [ebp + 8]
call fcn.004174ff
add esp, 0x24
push dword [ebp + 8]
test eax, eax
je 0x411a9c
call fcn.00412f9f
pop ecx
lea ecx, [ebp - 0xc]
call fcn.00402936
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4