joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410eb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x418
mov eax, dword [esp + 0x41c]
push ebx
push ebp
push esi
push edi
push 0x431dcc
push eax
xor ebp, ebp
mov byte [esp + 0x1b], 0
call dword [0x472ec4]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x410f00
push 1
push 0x30006
push 0xa8000004
call dword [0x472f68]
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push ebp
push ebx
call esi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x34]
push ebx
rep stosd dword es:[edi], eax
push 0xc
lea ecx, [esp + 0x3c]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov al, byte [esp + 0x44]
add esp, 0x1c
cmp al, 0x3a
jne 0x411062
inc ebp
push 0
push ebp
push ebx
call esi
xor edx, edx
mov ecx, 0x100
mov dword [esp + 0x20], edx
xor eax, eax
mov dword [esp + 0x24], edx
lea edi, [esp + 0x34]
mov dword [esp + 0x28], edx
push ebx
rep stosd dword es:[edi], eax
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x34], edx
push 0xc
push eax
mov dword [esp + 0x40], edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
add esp, 0x1c
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
xor ecx, ecx
mov al, byte [esp + ecx + 0x14]
cmp al, 0x40
jbe 0x410fac
cmp al, 0x61
jae 0x410fac
sub al, 0x37
jmp 0x410fba
cmp al, 0x2f
jbe 0x410fb8
cmp al, 0x3a
jae 0x410fb8
sub al, 0x30
jmp 0x410fba
sub al, 0x57
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0xc
jb 0x410f9c
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x15]
mov al, byte [esp + 0x2f]
and esi, 0xff
shl esi, 4
and ecx, 0xff
add esi, ecx
cmp al, 0x34
jne 0x411025
mov edx, dword [esp + 0x430]
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push 4
lea eax, [esp + 0x34]
push edx
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x411059
mov ecx, dword [esp + 0x434]
push 4
push str.0000
push ecx
call edi
add esp, 0xc
test eax, eax
je 0x411068
mov byte [esp + 0x13], 1
jmp 0x410f0d
cmp al, 0x30
jne 0x411055
cmp byte [esp + 0x13], 1
jne 0x411059
mov edx, dword [esp + 0x434]
push 4
lea eax, [esp + 0x2e]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x411076
lea ebp, [ebp + esi*2 + 0xa]
jmp 0x410f0d
cmp al, 0x31
je 0x411084
lea ebp, [ebp + esi*2 + 0xa]
jmp 0x410f0d
inc ebp
jmp 0x410f0d
pop edi
lea eax, [ebp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
pop edi
lea eax, [ebp - 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
Function at 0x421480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb4
mov eax, dword [str.3611015_FD]
mov ecx, dword [0x432148]
mov dx, word [0x43214c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], ecx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6e], eax
mov dword [esp + 0x72], ecx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x82], eax
mov dword [esp + 0x86], ecx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
mov dword [esp + 0x96], eax
mov dword [esp + 0x9a], ecx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xaa], eax
mov dword [esp + 0xae], ecx
xor eax, eax
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
mov dword [esp + 0x18], ecx
mov word [esp + 0x30], dx
mov word [esp + 0x3a], dx
mov word [esp + 0x44], dx
mov word [esp + 0x4e], dx
mov word [esp + 0x58], dx
mov word [esp + 0x62], dx
mov word [esp + 0x6c], dx
mov word [esp + 0x76], dx
mov word [esp + 0x80], dx
mov word [esp + 0x8a], dx
mov word [esp + 0x94], dx
mov word [esp + 0x9e], dx
mov word [esp + 0xa8], dx
mov word [esp + 0xb2], dx
mov dword [esp + 8], eax
mov dword [esp + 0x1c], ecx
lea edx, [esp]
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], ecx
push 0x11
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], ecx
call fcn.0040ecb0
add esp, 8
cmp eax, 1
jne 0x421701
push 5
push 0x30006
push 0x12130108
call dword [0x472f68]
add esp, 0xc
mov byte [0x472a2c], 0xcd
call fcn.00426dd0
test eax, eax
jge 0x4215f1
or eax, 0xffffffff
add esp, 0xb4
ret
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.0040edd0
add esp, 8
cmp eax, 1
jne 0x421701
mov ecx, dword [0x472a30]
xor eax, eax
lea ecx, [ecx + ecx*4]
lea ecx, [esp + ecx*2 + 0x28]
mov dl, byte [esp + eax + 0x14]
cmp dl, byte [ecx + eax]
jne 0x421656
inc eax
cmp eax, 0xa
jl 0x421618
push 5
push 0x30006
push 0x12130109
call dword [0x472f68]
add esp, 0xc
mov byte [0x472a2c], 0xcd
call fcn.0042ab10
test eax, eax
jge 0x421674
or eax, 0xffffffff
add esp, 0xb4
ret
push 1
push 0x30006
push 0x12130106
call dword [0x472f68]
add esp, 0xc
xor eax, eax
add esp, 0xb4
ret
call fcn.0040dad0
test eax, eax
jge 0x42169b
push 1
push 0x12180103
push 0x121300a6
call dword [0x472f68]
add esp, 0xc
xor eax, eax
add esp, 0xb4
ret
lea eax, [esp]
push 0x11
push eax
call fcn.004195a0
add esp, 8
cmp eax, 1
jne 0x421701
push 0xc
call fcn.00419620
add esp, 4
cmp eax, 1
jne 0x421701
call fcn.004199c0
cmp eax, 1
jne 0x421701
push eax
call fcn.00419c40
add esp, 4
cmp eax, 1
jne 0x421701
push eax
push 0x30006
push 0x1213010a
call dword [0x472f68]
push 1
push 0x30006
push 0x12130127
call dword [0x472f68]
add esp, 0x18
mov eax, 1
add esp, 0xb4
ret
Function at 0x426860
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x28
mov ecx, 0xa
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
xor ebp, ebp
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x40]
test eax, eax
jle 0x4268df
mov edx, dword [esp + 0x3c]
mov ebx, dword [0x472a24]
lea ecx, [esp + 0x10]
mov edi, eax
mov eax, dword [edx]
cmp eax, 0xcd
jne 0x42689b
test ebx, ebx
je 0x4268d9
cmp eax, 0xce
je 0x4268a7
cmp eax, 0x18
jne 0x4268b2
mov esi, dword [esp + 0x44]
cmp esi, 2
je 0x4268d9
jmp 0x4268b6
mov esi, dword [esp + 0x44]
cmp eax, 0xce
je 0x4268c2
cmp eax, 0x1c
jne 0x4268c7
cmp esi, 9
je 0x4268d9
cmp eax, 0xcf
jne 0x4268d3
cmp esi, 4
je 0x4268d9
mov dword [ecx], eax
inc ebp
add ecx, 4
add edx, 4
dec edi
jne 0x42688e
mov esi, dword [esp + 0x44]
cmp esi, 3
jne 0x4268ef
push 0x12170041
jmp 0x42690e
cmp esi, 4
jne 0x4268fb
push 0xa0021
jmp 0x42690e
cmp esi, 9
jne 0x426907
push 0x12170042
jmp 0x42690e
lea eax, [esi + 0x12170001]
push eax
call dword [0x472da8]
movsx eax, ax
add esp, 4
test eax, eax
jne 0x426979
xor ebx, ebx
test ebp, ebp
jle 0x426965
lea esi, [esp + 0x10]
mov edi, ebp
mov ebx, ebp
mov eax, dword [esi]
cmp eax, 0xce
jne 0x42694c
mov ecx, dword [0x472a30]
cmp ecx, 7
je 0x426945
cmp ecx, 8
jne 0x42694c
push 0xffcc00de
jmp 0x426952
add eax, 0xffcc0000
push eax
call dword [0x472dcc]
add esp, 4
add esi, 4
dec edi
jne 0x42692c
mov esi, dword [esp + 0x44]
test esi, esi
jne 0x42697d
push 0x1213000b
call dword [0x472dcc]
add esp, 4
jmp 0x42697d
mov ebx, dword [esp + 0x44]
movsx eax, word [0x4351cc]
cdq
mov cx, word [0x4351ce]
and edx, 7
add eax, edx
push 0x4351cc
sar eax, 3
shl eax, 3
push eax
push ecx
mov word [0x4351cc], ax
call dword [0x472e18]
add esp, 0xc
cmp ax, 0xffff
mov word [0x4351ce], ax
jne 0x4269c4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret
test esi, esi
jne 0x4269dc
movsx edx, ax
cmp edx, ebx
jne 0x4269dc
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0x28
ret
movsx eax, ax
pop edi
pop esi
mov eax, dword [esp + eax*4 + 8]
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x426ec0
Capabilities:
Check for software breakpoints

Disassembly:
call fcn.00426dd0
test eax, eax
mov dword [0x472d68], eax
jge 0x426ed2
or eax, 0xffffffff
ret
call fcn.00426f70
test eax, eax
mov dword [0x472d68], eax
jne 0x426f6d
mov al, byte [0x472a2c]
cmp al, 0xcc
je 0x426ef9
cmp al, 0xcd
je 0x426ef9
cmp al, 0xce
je 0x426ef9
cmp al, 0x18
jne 0x426f14
push 3
push 0x1218014f
push 0x1213019a
call dword [0x472f68]
add esp, 0xc
cmp ax, 2
je 0x426f5d
push 3
push 0x1218014f
push 0x1218014d
call dword [0x472f68]
add esp, 0xc
cmp ax, 2
jne 0x426f68
call fcn.00427090
test eax, eax
mov dword [0x472d68], eax
jl 0x426f6d
push 3
push 0x1218014f
push 0x1218014e
call dword [0x472f68]
add esp, 0xc
cmp ax, 2
jne 0x426f68
jmp 0x426ed2
call fcn.0042be10
mov dword [0x472d68], eax
ret
mov eax, dword [0x472d68]
ret
Function at 0x42d030
Capabilities:
Check for software breakpoints

Disassembly:
push ecx
push ebx
push esi
push edi
xor edi, edi
call fcn.0042e040
test eax, eax
jne 0x42d067
push 4
push 0x770401
push 0x770501
call dword [0x472f68]
add esp, 0xc
cmp ax, 1
je 0x42d163
call fcn.0042e040
test eax, eax
je 0x42d03f
mov bl, byte [0x472a2c]
cmp bl, 0xcd
jne 0x42d083
mov esi, 5
mov byte [esp + 0xd], 0xfd
mov byte [esp + 0xe], 0xed
jmp case.default.0x42d0bb
mov esi, 6
mov byte [esp + 0xd], 0xfc
mov byte [esp + 0xe], 0xec
mov byte [esp + 0xf], 0xdc
push edi
push esi
push 0x302
push 0x202
call fcn.0042def0
add esp, 0x10
cmp eax, 0xffffffff
je 0x42d163
cmp eax, 5
mov edi, eax
ja case.default.0x42d0bb
jmp dword [eax*4 + 0x42d168]
call fcn.0042d7e0
jmp case.default.0x42d0bb
call fcn.0042de50
jmp case.default.0x42d0bb
mov al, byte [esp + 0xd]
push 0
push 0
mov byte [0x472a2c], al
call fcn.00427110
add esp, 8
mov byte [0x472a2c], bl
jmp case.default.0x42d0bb
mov cl, byte [esp + 0xe]
push 0
push 2
mov byte [0x472a2c], cl
call fcn.00427110
add esp, 8
mov byte [0x472a2c], bl
jmp case.default.0x42d0bb
cmp byte [0x472a2c], 0xcc
jne 0x42d11b
call fcn.0042d180
jmp 0x42d120
call fcn.0042d420
test eax, eax
jge case.default.0x42d0bb
push 1
push 0x12180103
push 0x12180105
call dword [0x472f68]
add esp, 0xc
jmp case.default.0x42d0bb
mov dl, byte [esp + 0xf]
push 0
push 3
mov byte [0x472a2c], dl
call fcn.00427110
add esp, 8
mov byte [0x472a2c], bl
jmp case.default.0x42d0bb
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42d8c0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x314
push esi
push edi
mov ecx, 0x19
xor eax, eax
mov edi, 0x435240
push 2
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x4352c0
push 0x432370
push 0x435240
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [0x43235c]
mov ecx, dword [0x432360]
mov edx, dword [0x432364]
mov dword [esp + 0x28], eax
mov eax, dword [0x432368]
mov dword [esp + 0x2c], ecx
mov cl, byte [0x43236c]
mov dword [esp + 0x34], eax
mov al, byte [0x472a2c]
add esp, 0xc
cmp al, 0xcc
mov dword [esp + 0x24], edx
mov byte [esp + 0x2c], cl
jne 0x42d959
mov edx, dword [0x432348]
mov eax, dword [0x43234c]
mov ecx, dword [0x432350]
mov dword [esp + 8], edx
mov edx, dword [0x432354]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
jmp 0x42d97f
mov eax, dword [0x432334]
mov ecx, dword [0x432338]
mov edx, dword [0x43233c]
mov dword [esp + 8], eax
mov eax, dword [0x432340]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xa]
lea edx, [esp + 0xa]
and ecx, 0xff
inc ecx
push ecx
push edx
call dword [0x472df0]
mov byte [esp + 0x20], al
lea eax, [esp + 0x10]
push 0x11
push eax
call dword [0x472e28]
lea ecx, [esp + 0x12c]
push 0x100
lea edx, [esp + 0x30]
push ecx
push edx
push 0x11
call dword [0x473ad4]
movsx edx, ax
mov eax, dword [esp + 0x144]
add esp, 0x20
cmp al, 0x10
jne 0x42d9ec
mov eax, dword [esp + 0x125]
and eax, 0xff
jl 0x42da10
lea ecx, [eax + 1]
lea esi, [esp + 0x125]
jmp 0x42d9fd
and eax, 0xff
jl 0x42da10
lea ecx, [eax + 1]
lea esi, [esp + 0x124]
mov eax, ecx
mov edi, 0x472b60
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test edx, edx
jg 0x42da22
call fcn.0042df40
pop edi
pop esi
add esp, 0x314
ret
mov al, byte [0x472b62]
test al, al
jne 0x42da49
push 6
push 0x20321
push 0x50009
call dword [0x472f68]
add esp, 0xc
pop edi
pop esi
add esp, 0x314
ret
xor ecx, ecx
push ebp
mov cl, al
mov ebp, ecx
test ebp, ebp
jle 0x42da74
lea eax, [esp + 0x220]
mov ecx, 0x472b64
mov esi, ebp
mov dl, byte [ecx - 1]
add ecx, 2
mov byte [eax], dl
mov dl, byte [ecx - 2]
inc eax
mov byte [eax], dl
inc eax
dec esi
jne 0x42da62
call dword [0x472f2c]
test ebp, ebp
jle 0x42dab7
lea edi, [esp + 0x221]
xor eax, eax
xor ecx, ecx
mov al, byte [edi - 1]
mov cl, byte [edi]
mov esi, eax
shl esi, 8
add esi, ecx
je 0x42dab1
push 0x42df60
call dword [0x472f6c]
push 0xff000000
push esi
call dword [0x473a00]
add esp, 0xc
add edi, 2
dec ebp
jne 0x42da85
call dword [0x473af0]
pop ebp
pop edi
pop esi
add esp, 0x314
ret
Function at 0x42dc50
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x314
push esi
push edi
mov ecx, 0x19
xor eax, eax
mov edi, 0x435240
push 2
push 0x43239c
push 0x435240
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [0x432388]
mov ecx, dword [0x43238c]
mov edx, dword [0x432390]
mov dword [esp + 0x28], eax
mov eax, dword [0x432394]
mov dword [esp + 0x2c], ecx
mov cl, byte [0x432398]
mov dword [esp + 0x34], eax
mov al, byte [0x472a2c]
add esp, 0xc
cmp al, 0xcc
mov dword [esp + 0x24], edx
mov byte [esp + 0x2c], cl
jne 0x42dcdd
mov edx, dword [0x432348]
mov eax, dword [0x43234c]
mov ecx, dword [0x432350]
mov dword [esp + 8], edx
mov edx, dword [0x432354]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
jmp 0x42dd03
mov eax, dword [0x432334]
mov ecx, dword [0x432338]
mov edx, dword [0x43233c]
mov dword [esp + 8], eax
mov eax, dword [0x432340]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xa]
lea edx, [esp + 0xa]
and ecx, 0xff
inc ecx
push ecx
push edx
call dword [0x472df0]
mov byte [esp + 0x20], al
lea eax, [esp + 0x10]
push 0x11
push eax
call dword [0x472e28]
lea ecx, [esp + 0x12c]
push 0x100
lea edx, [esp + 0x30]
push ecx
push edx
push 0x11
call dword [0x473ad4]
movsx edx, ax
mov eax, dword [esp + 0x144]
add esp, 0x20
cmp al, 0x10
jne 0x42dd70
mov eax, dword [esp + 0x125]
and eax, 0xff
jl 0x42dd94
lea ecx, [eax + 1]
lea esi, [esp + 0x125]
jmp 0x42dd81
and eax, 0xff
jl 0x42dd94
lea ecx, [eax + 1]
lea esi, [esp + 0x124]
mov eax, ecx
mov edi, 0x472b60
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test edx, edx
jg 0x42dda6
call fcn.0042df40
pop edi
pop esi
add esp, 0x314
ret
mov al, byte [0x472b62]
test al, al
jne 0x42ddcd
push 6
push 0x20321
push 0x50009
call dword [0x472f68]
add esp, 0xc
pop edi
pop esi
add esp, 0x314
ret
xor ecx, ecx
push ebp
mov cl, al
mov ebp, ecx
test ebp, ebp
jle 0x42ddf8
lea eax, [esp + 0x220]
mov ecx, 0x472b64
mov esi, ebp
mov dl, byte [ecx - 1]
add ecx, 2
mov byte [eax], dl
mov dl, byte [ecx - 2]
inc eax
mov byte [eax], dl
inc eax
dec esi
jne 0x42dde6
call dword [0x472f2c]
test ebp, ebp
jle 0x42de3b
lea edi, [esp + 0x221]
xor eax, eax
xor ecx, ecx
mov al, byte [edi - 1]
mov cl, byte [edi]
mov esi, eax
shl esi, 8
add esi, ecx
je 0x42de35
push 0x42df60
call dword [0x472f6c]
push 0xff000000
push esi
call dword [0x473a00]
add esp, 0xc
add edi, 2
dec ebp
jne 0x42de09
call dword [0x473af0]
pop ebp
pop edi
pop esi
add esp, 0x314
ret
Function at 0x42e040
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
sub esp, 0x174
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x20], 0x55
mov byte [esp + 0x21], 0xaa
mov byte [esp + 0x22], 0xd
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 1
mov byte [esp + 0x25], 8
mov byte [esp + 0x26], 0xfb
mov byte [esp + 0x27], pe_nt_image_headers32
mov byte [esp + 0x28], 2
mov byte [esp + 0x29], 1
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x80]
push 0x11
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x64]
push 0x4323b4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
xor ecx, ecx
mov cl, byte [0x472a2c]
add ecx, 0x30
push ecx
call fcn.00426a80
mov cl, byte [esp + 0x40]
add esp, 0x10
mov eax, 2
mov dl, byte [esp + eax + 0x20]
xor cl, dl
inc eax
cmp eax, 0x10
mov byte [esp + 0x30], cl
jl 0x42e0f8
push 4
push 2
lea edx, [esp + 0x28]
push ebx
push edx
push 0x11
push 1
lea eax, [esp + 0x98]
push 0xff
push eax
push 0xff
call dword [0x473ac0]
add esp, 0x24
xor ecx, ecx
test ax, ax
mov al, byte [0x472a2c]
setle cl
dec ecx
and ecx, 7
cmp al, 0xcc
mov esi, ecx
jne 0x42e171
mov edx, dword [0x432348]
mov eax, dword [0x43234c]
mov ecx, dword [0x432350]
mov dword [esp + 0xc], edx
mov edx, dword [0x432354]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jmp 0x42e197
mov eax, dword [0x432334]
mov ecx, dword [0x432338]
mov edx, dword [0x43233c]
mov dword [esp + 0xc], eax
mov eax, dword [0x432340]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0xe]
lea edx, [esp + 0xe]
and ecx, 0xff
inc ecx
push ecx
push edx
call dword [0x472df0]
mov byte [esp + 0x24], al
lea eax, [esp + 0x14]
push 0x11
push eax
call dword [0x472e28]
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x174
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
jmp 0x50a204
Function at 0x4047db
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
add edx, 0xffffff0a
push edi
mov edi, dword [esp + 0x14]
lea ecx, [esi - 0x367]
xor esi, 0x29e
lea eax, [edx + 0x722]
cmp esi, eax
jge 0x404956
mov eax, dword [esp + 0x1c]
xor eax, 0x78c
cmp edx, eax
je 0x40494a
push ebx
push ebp
xor ebp, ebp
mov eax, dword [edi + 0xb4]
push 0x37
mov ecx, dword [eax + ebp]
add ebp, 4
mov eax, dword [edi + 0x90]
imul eax, dword [edi + 0x70]
mov dword [edi + 0x70], eax
mov ebx, dword [edi + 0x80]
mov eax, dword [edi + 0x108]
sub eax, dword [0x5291d8]
xor eax, 0xfffdbbad
imul ebx, ecx
mov ecx, dword [0x4ae154]
add dword [ecx + 0x7c], eax
mov edx, ebx
mov eax, dword [edi + 0x70]
dec eax
shr edx, 8
add dword [edi + 0x44], eax
mov eax, dword [edi + 0x124]
sub eax, 0x1388de
imul eax, dword [edi + 0x120]
mov dword [edi + 0x120], eax
mov eax, dword [0x4ae154]
mov ecx, dword [eax + 0xb8]
mov eax, dword [edi + 0x84]
mov byte [ecx + eax], dl
inc dword [edi + 0x84]
mov ecx, dword [edi + 0xdc]
xor ecx, dword [edi + 0x10c]
pop eax
sub eax, ecx
add dword [0x529180], eax
mov eax, dword [0x529124]
dec eax
add eax, dword [edi + 0x48]
imul eax, dword [edi + 0xdc]
push 0x1d
mov dword [edi + 0xdc], eax
mov eax, dword [0x4ae154]
mov ecx, dword [eax + 0xb8]
mov eax, dword [edi + 0x84]
mov byte [ecx + eax], bl
inc dword [edi + 0x84]
mov ecx, dword [0x4ae154]
mov eax, dword [ecx + 0x114]
xor eax, 0x1d
sub dword [ecx + 0x118], eax
pop eax
sub eax, dword [edi + 0x114]
sub eax, dword [edi + 0x20]
add dword [edi + 0xc4], eax
mov eax, dword [edi + 0x70]
sub eax, dword [0x5291d8]
add eax, 0xb2d11
add dword [edi + 0xe0], eax
mov ecx, dword [0x4ae154]
mov eax, dword [ecx + 0x120]
sub eax, dword [ecx + 0xc]
xor eax, 0xfff048fb
imul eax, dword [0x529168]
mov dword [0x529168], eax
cmp ebp, 0x66438
jl 0x40481e
pop ebp
pop ebx
jmp 0x40495c
xor ecx, 0x39a7
or dword [0x5291d0], ecx
mov ecx, dword [0x4ae154]
mov eax, dword [ecx + 0x110]
xor eax, 0x32385801
mov dword [edi + 0x80], eax
lea eax, [esi - 0x980]
pop edi
pop esi
ret
Function at 0x413d19
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
add eax, 0xffffbfca
push esi
push edi
mov edi, dword [ebp + 0x14]
mov edx, ecx
xor eax, 0x3ab3
xor ecx, 0x58d
xor edx, 0x3b2c
lea esi, [edi + 0x209]
cmp ecx, eax
je 0x413db0
lea ecx, [esi + 0x301]
lea eax, [edi - 0x79]
cmp eax, ecx
jge 0x413d65
mov eax, dword [ebp + 8]
mov dword [eax + 0xb4], 0x519ca0
jmp 0x413db0
mov ecx, dword [0x52917c]
mov eax, dword [ebp + 0x10]
and ecx, esi
or ecx, edi
add eax, 0x71
cmp eax, ecx
jbe 0x413db0
mov eax, dword [0x4ae154]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x28]
sub eax, edx
sub eax, 0x35f3
cmp dword [ecx + 0xf8], eax
je 0x413db0
sub edx, dword [ecx + 0xd8]
mov ecx, dword [ecx + 0x6c]
and ecx, 0x40b1
push edx
add ecx, 0x3a86
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor esi, 0xb3e
pop edi
mov eax, esi
pop esi
pop ebp
ret