joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5da170
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.004a2410
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
push edi
mov dword [esi + 0x30], 0
lea edi, [esi + 0x40]
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebp, 0xc
jne 0x5da1df
mov eax, dword [esp + 0x28]
lea ebx, [ebp - 0xb]
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x5da312
mov ebx, dword [esp + 0x28]
lea edx, [esi + 0x60]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [esi + 0x48], 0
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x4c], 0
mov dword [esp + 0x14], edx
cmp ebp, 0x10
jb 0x5da27f
mov eax, ebp
lea ecx, [esi + 0x41]
shr eax, 4
mov esi, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2c], eax
lea edx, [ebx + 2]
mov eax, ecx
mov edi, 4
nop word [eax + eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub edi, 1
jne 0x5da230
push dword [esp + 0x14]
push esi
call fcn.005da5d0
mov ecx, dword [esp + 0x20]
add esp, 8
add ebx, 0x10
sub ebp, 0x10
sub dword [esp + 0x2c], 1
jne 0x5da220
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x40]
lea edx, [esi + 0x60]
test ebp, ebp
je 0x5da29e
mov ecx, edi
mov al, byte [ebx]
lea ebx, [ebx + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub ebp, 1
jne 0x5da285
push edx
push edi
call fcn.005da5d0
add esp, 8
mov edx, dword [esp + 0x1c]
xor ebx, ebx
shld ebx, edx, 3
xor byte [esi + 0x4b], bl
mov eax, ebx
shl edx, 3
xor byte [esi + 0x4f], dl
mov ecx, edx
shrd ecx, eax, 0x18
mov eax, ebx
xor byte [esi + 0x4c], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
xor byte [esi + 0x4d], cl
shrd eax, ebx, 8
xor byte [esi + 0x4e], al
lea eax, [esi + 0x60]
push eax
push edi
call fcn.005da5d0
movzx ebx, byte [esi + 0x4c]
add esp, 8
movzx eax, byte [esi + 0x4d]
mov ecx, dword [edi + 4]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4f]
shl ebx, 8
or ebx, eax
mov eax, dword [edi]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [edi], 0
lea eax, [esi + 0x20]
mov dword [edi + 4], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
inc ebx
add esp, 0xc
mov eax, ebx
mov byte [esi + 0xf], bl
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, ebx
pop edi
shr eax, 8
mov byte [esi + 0xe], al
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5daea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.004a2410
mov eax, dword [0x6f1114]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x3c]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
push edi
mov edi, dword [esp + 0x50]
mov al, byte [esi]
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov byte [esp + 0x13], al
lea eax, [esi + 0x10]
test byte [esp + 0x13], 0x40
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
jne 0x5daeff
push ecx
push eax
push esi
call ebx
mov edx, dword [esp + 0x20]
add esp, 0xc
movzx eax, byte [esp + 0x13]
mov ebx, 0xf
and eax, 7
xor ecx, ecx
sub ebx, eax
mov byte [esi], al
mov dword [esp + 0x28], ebx
cmp ebx, 0xf
jae 0x5daf33
nop dword [eax + eax]
movzx eax, byte [esi + ebx]
or ecx, eax
mov byte [esi + ebx], 0
inc ebx
shl ecx, 8
cmp ebx, 0xf
jb 0x5daf20
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, edi
je 0x5daf57
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004a1496
add esp, 0x30
ret
mov ebx, edi
shr ebx, 4
test ebx, ebx
je 0x5daf93
lea eax, [esi + 0x10]
push eax
push esi
push dword [esp + 0x20]
push ebx
push edx
push ebp
call dword [esp + 0x38]
shl ebx, 4
add esp, 0x18
add dword [esp + 0x14], ebx
add ebp, ebx
sub edi, ebx
je 0x5dafed
shr ebx, 4
push ebx
push esi
call fcn.005db830
mov ebx, dword [esp + 0x1c]
add esp, 8
jmp 0x5daf9d
mov ebx, dword [esp + 0x14]
mov eax, edi
test eax, eax
je 0x5dafed
push dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x28]
add esp, 0xc
test edi, edi
je 0x5dafd8
lea ecx, [esp + 0x2c]
mov eax, ecx
lea edx, [esi + 0x10]
sub ebp, eax
sub ebx, eax
nop
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [ebx + ecx - 1], al
xor byte [edx - 1], al
sub edi, 1
jne 0x5dafc0
mov ebp, dword [esp + 0x18]
lea ebx, [esi + 0x10]
mov edi, dword [esp + 0x1c]
push ebp
push ebx
push ebx
call edi
add esp, 0xc
jmp 0x5daff8
mov edi, dword [esp + 0x1c]
lea ebx, [esi + 0x10]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jae 0x5db017
mov eax, 0x10
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.004b95f0
add esp, 0xc
push ebp
lea eax, [esp + 0x30]
push eax
push esi
call edi
mov eax, dword [esp + 0x38]
add esp, 0xc
xor dword [ebx], eax
mov eax, dword [esp + 0x30]
xor dword [ebx + 4], eax
mov eax, dword [esp + 0x34]
xor dword [esi + 0x18], eax
mov eax, dword [esp + 0x38]
xor dword [esi + 0x1c], eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
pop edi
mov byte [esi], al
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a1496
add esp, 0x30
ret
Function at 0x5dd0e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.004a2410
mov ecx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ebp, [ecx + 0x40]
mov esi, dword [ecx + 0x14]
cmp edi, esi
jbe 0x5dd18a
mov edx, dword [ecx + 0x18]
cmp edi, edx
jb 0x5dd13d
mov eax, edi
sub eax, edx
add eax, 4
and eax, 0xfffffffc
add eax, edx
push 0x71
mov dword [ecx + 0x18], eax
push str.....cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp]
call fcn.0056a110
add esp, 0x10
test eax, eax
jne 0x5dd13a
pop edi
pop esi
pop ebp
add esp, 8
ret
mov dword [ebp], eax
mov eax, esi
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, edi
mov edi, dword [esp + 0x10]
sub eax, esi
mov dword [esp + 0xc], eax
push ebx
mov eax, dword [ebp]
add eax, edi
mov bl, byte [eax]
lea esi, [eax + 0x10]
push esi
shr bl, 7
push 1
neg bl
push eax
and bl, 0x87
call fcn.005dce20
xor byte [esi + 0xf], bl
add esp, 0xc
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x5dd153
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
pop ebx
mov dword [eax + 0x14], edi
shl edi, 4
add edi, dword [ebp]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x5e1ac0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x5e1ad4
mov dword [esp + 0x18], fcn.005e02a0
jmp fcn.005d8480
mov dword [esp + 0x18], fcn.005df540
jmp fcn.005d8180
Function at 0x5e9ea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.004a2410
push esi
mov esi, dword [esp + 0xc]
push esi
call fcn.004f71c0
add esp, 4
cmp eax, 0x72
jne 0x5ea05b
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov ebx, eax
push esi
push ebp
push dword [esp + 0x2c]
and eax, 1
shr ebx, 1
push dword [esp + 0x2c]
add eax, ebx
push eax
push dword [esp + 0x2c]
mov dword [esp + 0x24], eax
call fcn.00591d90
push eax
call fcn.005e9c40
add esp, 0x1c
test eax, eax
je 0x5ea054
push edi
push 0x104
push str.....cryptokdf_tls1_prf.c
push esi
call fcn.0056a0c0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x5e9f3b
push 0x105
push str.....cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.0057a880
add esp, 0x14
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
mov eax, dword [esp + 0x1c]
push esi
push edi
push dword [esp + 0x30]
add eax, ebx
push dword [esp + 0x30]
push dword [esp + 0x20]
push eax
call fcn.00571f00
push eax
call fcn.005e9c40
add esp, 0x1c
test eax, eax
jne 0x5e9f7e
push 0x10a
push str.....cryptokdf_tls1_prf.c
push esi
push edi
call fcn.0056a1b0
add esp, 0x10
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
xor ebx, ebx
test esi, esi
je 0x5ea035
cmp esi, 0x40
jb 0x5ea01a
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, edi
add ecx, esi
cmp ebp, eax
ja 0x5e9fa3
cmp ecx, edi
jae 0x5ea01a
mov edx, esi
lea eax, [ebp + 0x10]
mov esi, edi
lea ecx, [edi + 0x30]
and edx, 0xffffffc0
sub esi, ebp
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x10]
nop
movups xmm0, xmmword [eax - 0x10]
add ebx, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, edx
jb 0x5e9fc0
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x10], ebx
cmp ebx, esi
jae 0x5ea035
lea ecx, [ebx + ebp]
mov edx, esi
mov ebp, edi
sub ebp, dword [esp + 0x2c]
sub edx, ebx
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x5ea027
push 0x10f
push str.....cryptokdf_tls1_prf.c
push esi
push edi
call fcn.0056a1b0
add esp, 0x10
mov eax, 1
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call fcn.005e9c40
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
pop ecx
ret
Function at 0x5f5ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x5f5b53
mov edx, dword [esp + 0x10]
test edx, edx
je 0x5f5b53
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [ebx + 0x14]
cmp edx, edi
cmovb edi, edx
test edi, edi
je 0x5f5b20
push esi
mov esi, ebp
lea ecx, [ebx + 0x18]
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x5f5b10
pop esi
mov eax, dword [ebx + 0x14]
cmp edx, eax
jbe 0x5f5b51
sub edx, eax
cmp edx, 0x10
jbe 0x5f5b35
mov edx, 0x10
jmp 0x5f5b39
test edx, edx
je 0x5f5b51
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x38], al
inc ecx
cmp ecx, edx
jb 0x5f5b40
pop edi
pop ebx
pop ebp
ret
Function at 0x622730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.004a2410
mov eax, dword [0x6f1114]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x44]
mov dword [esp + 0x28], edi
mov dword [esp + 0x14], 0
movzx edx, byte [edi]
movzx eax, byte [edi + 1]
movzx ebx, byte [edi + 4]
shl eax, 0x10
movzx ecx, byte [edi + 6]
shl edx, 0x18
or edx, eax
shl ebx, 0x18
movzx eax, byte [edi + 2]
shl eax, 8
or edx, eax
shl ecx, 8
movzx eax, byte [edi + 3]
or edx, eax
movzx eax, byte [edi + 5]
shl eax, 0x10
or ebx, eax
mov dword [esp + 0x1c], edx
movzx eax, byte [edi + 7]
or ecx, eax
mov byte [esp + 0x2f], dl
mov eax, edx
or ebx, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, ebx
shr eax, 8
mov dword [esp + 0x20], ebx
mov byte [esp + 0x32], al
mov byte [esp + 0x33], bl
test ebp, ebp
je 0x6228c7
mov edi, dword [esp + 0x3c]
sub dword [esp + 0x10], edi
nop dword [eax]
dec ebp
test esi, esi
jne 0x622870
push dword [esp + 0x24]
lea eax, [esp + 0x20]
push eax
call fcn.00622160
mov edx, dword [esp + 0x24]
add esp, 8
mov ebx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, ebx
shr eax, 8
inc dword [esp + 0x14]
mov byte [esp + 0x2f], dl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], bl
mov al, byte [esp + esi + 0x2c]
inc esi
mov ecx, dword [esp + 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ecx + edi], al
inc edi
mov ecx, dword [esp + 0x14]
test ebp, ebp
jne 0x622810
test ecx, ecx
je 0x6228c7
mov ecx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [ecx], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 1], al
mov eax, edx
shr eax, 8
mov byte [ecx + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [ecx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 5], al
mov eax, ebx
shr eax, 8
mov byte [ecx + 3], dl
mov byte [ecx + 6], al
mov byte [ecx + 7], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a1496
add esp, 0x28
ret
Function at 0x624b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.004a2410
mov eax, dword [0x6f1114]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x44]
mov dword [esp + 0x28], edi
mov dword [esp + 0x14], 0
movzx edx, byte [edi]
movzx eax, byte [edi + 1]
movzx ebx, byte [edi + 4]
shl eax, 0x10
movzx ecx, byte [edi + 6]
shl edx, 0x18
or edx, eax
shl ebx, 0x18
movzx eax, byte [edi + 2]
shl eax, 8
or edx, eax
shl ecx, 8
movzx eax, byte [edi + 3]
or edx, eax
movzx eax, byte [edi + 5]
shl eax, 0x10
or ebx, eax
mov dword [esp + 0x1c], edx
movzx eax, byte [edi + 7]
or ecx, eax
mov byte [esp + 0x2f], dl
mov eax, edx
or ebx, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, ebx
shr eax, 8
mov dword [esp + 0x20], ebx
mov byte [esp + 0x32], al
mov byte [esp + 0x33], bl
test ebp, ebp
je 0x624cb7
mov edi, dword [esp + 0x3c]
sub dword [esp + 0x10], edi
nop dword [eax]
dec ebp
test esi, esi
jne 0x624c60
push dword [esp + 0x24]
lea eax, [esp + 0x20]
push eax
call fcn.00624510
mov edx, dword [esp + 0x24]
add esp, 8
mov ebx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, ebx
shr eax, 8
inc dword [esp + 0x14]
mov byte [esp + 0x2f], dl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], bl
mov al, byte [esp + esi + 0x2c]
inc esi
mov ecx, dword [esp + 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ecx + edi], al
inc edi
mov ecx, dword [esp + 0x14]
test ebp, ebp
jne 0x624c00
test ecx, ecx
je 0x624cb7
mov ecx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [ecx], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 1], al
mov eax, edx
shr eax, 8
mov byte [ecx + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [ecx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 5], al
mov eax, ebx
shr eax, 8
mov byte [ecx + 3], dl
mov byte [ecx + 6], al
mov byte [ecx + 7], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a1496
add esp, 0x28
ret
Function at 0x63bc90
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063bca0

Function at 0x63bf20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063bf30

Function at 0x401e50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [str.V_we], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.tascraft
push str.bamed
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401e98
xor eax, eax
jmp 0x401eb3
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4025f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0xb8], eax
push 0x4040a4
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401000
add esp, 4
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401e50
add esp, 8
test eax, eax
jne 0x402638
xor eax, eax
jmp 0x402696
push 0
push 0
push 0
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40268a
lea edx, [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0xb0]
push ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x402688
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x402638
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp - 0xa8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40286e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42b024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, edx
mov dword [ebp - 0x214], eax
push edi
mov edi, ecx
test esi, esi
je 0x40298d
xor eax, eax
cmp word [esi], ax
je 0x40298d
push 4
push 0x424c80
push esi
call fcn.0040dbda
add esp, 0xc
test eax, eax
jne 0x4028be
add esi, 8
push 2
push 0x424c8c
push esi
call fcn.0040dbda
add esp, 0xc
test eax, eax
jne 0x4028d5
add esi, 4
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004099b0
push 0x104
push esi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.0040dce2
lea eax, [ebp - 0x210]
push 0x2e
push eax
call fcn.0040931c
mov esi, eax
add esp, 0x24
test esi, esi
je 0x402946
xor eax, eax
mov word [esi], ax
inc esi
add esi, 1
je 0x402946
push str.HTML
push esi
call fcn.0040b75e
pop ecx
pop ecx
test eax, eax
je 0x402946
push 0x424ca0
push esi
call fcn.0040b75e
pop ecx
pop ecx
test eax, eax
je 0x402946
push esi
jmp 0x402948
push 0x17
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40298d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40298d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
test eax, eax
je 0x40298d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
test eax, eax
je 0x40298d
mov al, 1
jmp 0x40298f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407d91
leave
ret

Function at 0x402f6a
Capabilities:
Create thread

Disassembly:
push 0x30
mov eax, 0x41c322
call fcn.004086da
lea eax, [ebp + 0x18]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x30]
call fcn.00401717
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x20]
call fcn.00401717
push 0x20
mov byte [ebp - 4], 3
call fcn.004080cf
mov esi, eax
lea eax, [ebp - 0x30]
pop ecx
push eax
mov ecx, esi
call fcn.00401743
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x10]
push eax
call fcn.00401743
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
xor edi, edi
push edi
push esi
push 0x406727
push edi
push edi
call fcn.0040b9bb
add esp, 0x18
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x403042
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], edi
call fcn.00406542
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.00402ba3
mov byte [ebp - 4], 3
cmp dword [ebp - 0x38], edi
jne 0x40304c
lea ecx, [ebp - 0x30]
call fcn.00403f81
mov byte [ebp - 4], 6
call fcn.0040237d
lea edx, [ebp + 8]
push edx
mov ecx, dword [eax + 0x208]
call ecx
mov dword [ebp - 4], 7
call fcn.0040237d
lea edx, [ebp + 0x18]
push edx
mov ecx, dword [eax + 0x208]
call ecx
mov al, 1
call fcn.00408689
ret 0x20
push 6
mov dword [ebp - 0x38], edi
call fcn.004076b7
call fcn.0040ba4c
int3
Function at 0x403118
Capabilities:
Create thread

Disassembly:
push 0x20
mov eax, 0x41c3aa
call fcn.004086da
lea eax, [ebp + 8]
xor edi, edi
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.00401717
push 0x10
mov byte [ebp - 4], 1
call fcn.004080cf
mov esi, eax
lea eax, [ebp - 0x20]
pop ecx
push eax
mov ecx, esi
call fcn.00401743
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
push edi
push esi
push 0x406777
push edi
push edi
call fcn.0040b9bb
add esp, 0x18
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4031c8
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], edi
call fcn.004064ea
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00402ba3
mov byte [ebp - 4], 1
cmp dword [ebp - 0x28], edi
jne 0x4031d2
mov byte [ebp - 4], 4
call fcn.0040237d
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [eax + 0x208]
call ecx
mov dword [ebp - 4], 5
call fcn.0040237d
lea edx, [ebp + 8]
push edx
mov ecx, dword [eax + 0x208]
call ecx
mov al, 1
call fcn.00408689
ret 0x10
push 6
mov dword [ebp - 0x28], edi
call fcn.004076b7
call fcn.0040ba4c
int3

Function at 0x403c73
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x42b024]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
cmp dword [ebp + 0xc], ebx
jbe 0x403ce7
mov esi, eax
test ebx, ebx
je 0x403cb2
push 0x424e58
call edi
push 1
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00401ae3
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call edi
lea ecx, [esp + 0x14]
call fcn.004049e0
inc ebx
add esi, 0x10
cmp ebx, dword [ebp + 0xc]
jb 0x403ca7
mov esi, dword [esp + 0x10]
push 0x424e5c
call edi
call fcn.0040237d
push esi
mov ecx, dword [eax + 0x204]
call ecx
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00407d91
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406331
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x41ce31
call fcn.004086a7
mov ebx, ecx
push 8
call fcn.004080cf
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x406372
mov dword [esi + 4], ecx
add ecx, 4
push ecx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop ecx
xor eax, eax
mov dword [ebp + 8], esi
lea edi, [ebx + 4]
mov dword [ebp - 4], 1
push edi
push eax
push esi
push 0x4067c7
push eax
push eax
call fcn.0040b9bb
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x4063ab
and dword [ebp + 8], 0
lea ecx, [ebp + 8]
call fcn.004064d0
call fcn.00408675
ret 4
and dword [edi], 0
push 6
call fcn.004076b7
int3