joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1a3c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408a50]
call fcn.004061c0
xor eax, eax
push ebp
push 0x4b1bdd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4fd83c], 0
jne 0x4b1a97
mov ecx, dword [0x4fe4c4]
mov dl, 1
mov eax, dword [0x409100]
call fcn.0040ecb8
call fcn.00404ea8
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004039a8
mov eax, ebx
call fcn.00405f08
mov dword [ebp - 0x24], eax
mov esi, 0x4b1bec
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407560
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405f18
test eax, eax
jle 0x4b1b80
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4b1b6c
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004057a0
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4b1b12
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004057b8
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4b1b28
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004057b8
mov eax, dword [ebp - 0x54]
call fcn.004059c0
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004057a0
mov eax, dword [ebp - 0x58]
call fcn.004059c0
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4b1b6e
xor eax, eax
test al, al
je 0x4b1b79
mov ebx, 0x15
jmp 0x4b1b85
mov ebx, 0x10
jmp 0x4b1b85
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4fd83c]
call fcn.004b1860
mov eax, dword [ebp - 4]
call fcn.004b1860
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407578
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1be4
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405554
lea eax, [ebp - 0xc]
mov edx, dword [0x408a50]
call fcn.00406290
ret

Function at 0x4d2d64
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4d2d89
cmp dword [esp + 4], 5
jb 0x4d2d89
mov al, 1
jmp 0x4d2d8b
xor eax, eax
add esp, 0x94
ret
Function at 0x4eabc0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x4fe1c0]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x4eabf8
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4eac10
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4eac09
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.004039a8
xor edx, edx
mov eax, 0x4fe3c0
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4eac77
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4eac2e
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4eaeb8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4eaed1
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4eaeca
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4eaee3
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4eaedc
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004eaab0
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4eaefd
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.004eabc0
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4eaf85
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4eafa3
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004eab40
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4eafcd
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4eafe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4eaffd
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4eaff6
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4eb011
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004ea9b0
test bl, bl
jne 0x4eb0eb
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x503de4
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4eb049
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4eb05e
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004eaeb8
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4eb091
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4eb03e
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4eb0b5
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4eb0c7
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4eb0dc
jmp 0x4eb1ac
cmp bl, 1
jne 0x4eb1ac
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x503e3e
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4eb10b
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4eb120
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004eaeb8
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4eb153
sub ebx, 6
inc dword [ebp - 8]
jne 0x4eb100
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4eb17b
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4eb18d
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4eb1a2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004eaa30
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4f8c78
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f8d69
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x4f8d80
call fcn.004055c8
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo
movzx esi, word [ebp - 0xe]
lea edx, [ebp - 4]
movzx eax, si
call fcn.0040a628
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.004f8da8
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 8]
call fcn.0040a40c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0040a40c
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405848
lea ecx, [ebp - 0x3c]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004f8f28
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.004055c8
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004eb3bc
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 4]
call fcn.004055c8
push edi
mov ecx, 0xa
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00405a28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8d70
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.00405554
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405554
ret

Function at 0x4f9268
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
mov ebx, 0x4f9284
push 0
push 1
push ebx
call sub.wininet.dll_InternetCheckConnectionA
test eax, eax
je 0x4f9280
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x417d34
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00417db3
jae 0x417d40
xor ecx, ecx
call fcn.00417db3
jae 0x417d6a
xor eax, eax
call fcn.00417db3
jae 0x417d7b
mov al, 0x10
call fcn.00417db3
adc al, al
jae 0x417d5c
jne 0x417da8
stosb byte es:[edi], al
jmp 0x417d41
call fcn.00417dbf
dec ecx
loop 0x417d87
mov eax, ebp
call fcn.00417dbd
jmp 0x417da9
lodsb al, byte [esi]
shr eax, 1
je 0x417dcf
adc ecx, 2
mov ebp, eax
jmp 0x417da9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00417dbd
cmp eax, 0x7d00
jae 0x417da7
cmp eax, 0x500
jae 0x417da8
cmp eax, 0x7f
ja 0x417da9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x417d41
pop ebp
ret 8

Function at 0x43b659
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
sub ebx, 1
call fcn.0043b68b
inc esi
xor dword [edx], ecx
dec esi
inc edx
mov ebx, ebx
sub ebx, esi
inc ebx
cmp edx, edi
jne fcn.0043b659
mov ebx, 0x58001bea
or esi, esi
and esi, ebx
ret
Function at 0x4023e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
push 0
push 3
push 0
push 0
mov edi, ecx
mov eax, dword [edi + 0x16]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402423
mov ecx, dword [edi + 0x16]
push ecx
push str.Failed_to_open__s._Press_Escape_to_exit._n
call fcn.00404558
add esp, 8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea edx, [ebp - 0xc]
push edx
push esi
mov byte [ebp - 1], 1
mov byte [edi + 0x15], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xe000
je 0x4024d5
cmp eax, 0x1a000
je 0x402467
push str.Unsupported_file_size__n
call fcn.00404558
add esp, 4
pop ebx
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x1a000
call fcn.00404c56
add esp, 4
push 0
push 0
push 0
push esi
mov dword [edi + 0x11a], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [edi + 0x11a]
push 0
lea eax, [ebp - 8]
push eax
push 0x1a000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4024b6
cmp dword [ebp - 8], 0x1a000
je 0x4024c7
push str.Failed_to_read_card_information__n
call fcn.00404558
add esp, 4
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop ebx
mov byte [edi + 0x15], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xe000
call fcn.00404c56
add esp, 4
push 0
push 0
push 0
push esi
mov dword [edi + 0x11a], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 0x11a]
push 0
lea edx, [ebp - 8]
push edx
push 0xe000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x402524
cmp dword [ebp - 8], 0xe000
je 0x402535
push str.Failed_to_read_card_information__n
call fcn.00404558
add esp, 4
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop ebx
mov byte [edi + 0x15], 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4027a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x414058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10c], eax
mov ebx, edx
mov byte [ebp - 0x106], 1
cmp si, word [ebp + 0xc]
je 0x40284e
call fcn.004049b5
test eax, eax
jne 0x40284e
movzx edi, si
lea ecx, [edi + 0x80]
push ecx
push edi
push str._rProcessing__04x.._04x_...
mov byte [ebp - 0x105], 0x80
call fcn.00404558
mov edx, dword [ebp - 0x10c]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
add esp, 0xc
lea edx, [ebp - 0x105]
push edx
lea edx, [ebp - 0x104]
push edx
push esi
call eax
test al, al
je 0x402881
push 0
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx edx, byte [ebp - 0x105]
push 0
lea ecx, [ebp - 0x110]
push ecx
push edx
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, 0xffffff80
cmp si, word [ebp + 0xc]
jne 0x4027d0
push 0x412778
call fcn.00404558
mov bl, byte [ebp - 0x106]
add esp, 4
call fcn.004049b5
mov ecx, dword [ebp - 4]
neg eax
sbb al, al
pop edi
not al
and al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00404528
mov esp, ebp
pop ebp
ret 8
movzx ecx, si
push ecx
push str._nFailed_to_process__04x_n
call fcn.00404558
add esp, 8
xor bl, bl
jmp 0x402861
Function at 0x4028a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x414058]
xor eax, ebp
mov dword [ebp - 4], eax
mov dx, word [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], ecx
mov byte [ebp - 0x13d], 1
cmp dx, word [ebp + 0x14]
je 0x402a5f
lea esp, [esp]
call fcn.004049b5
test eax, eax
jne 0x402a5f
movzx esi, word [ebp + 0x10]
movzx edi, byte [ebp + 0xc]
movzx eax, bl
add eax, esi
push eax
push esi
push edi
push str._rProcessing___02x_:_04x.._04x_...
call fcn.00404558
mov al, byte [ebp + 0x10]
mov cl, byte [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov byte [ebp - 0x2a], al
add esp, 0x10
mov byte [ebp - 0x2e], cl
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ecx]
lea eax, [ebp - 0x144]
push eax
shr edx, 8
lea eax, [ebp - 0x13c]
push eax
mov byte [ebp - 0x2b], dl
mov dword [ebp - 0x3c], 0x30019080
mov dword [ebp - 0x38], 0x7b4f5f1f
mov byte [ebp - 0x34], 0xa6
mov dword [ebp - 0x32], 0xa6ca00c7
mov word [ebp - 0x2d], 0xd67b
mov dword [ebp - 0x29], 0x7b4f9790
mov dword [ebp - 0x25], 0x3d79f90
mov dword [ebp - 0x21], 0xca3a5c00
mov dword [ebp - 0x1d], 0x54ccec26
mov word [ebp - 0x19], 0xe9
mov dword [ebp - 0xc], 0x30016680
mov byte [ebp - 8], 0
mov dword [ebp - 0x14], 0x36380
mov byte [ebp - 0x10], bl
mov byte [ebp - 0x33], bl
mov dword [ebp - 0x144], 0x100
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push 0x25
lea eax, [ebp - 0x3c]
push eax
call edx
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x144], 0x100
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push 5
lea eax, [ebp - 0xc]
push eax
call edx
cmp al, 1
jne 0x402a8f
mov eax, dword [ebp - 0x148]
mov ecx, dword [eax]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x144], 0x100
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push 5
lea eax, [ebp - 0x14]
push eax
call edx
cmp al, 1
jne 0x402aaa
push 0
push 0
shl edi, 9
add edi, esi
mov esi, dword [ebp - 0x14c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x144]
push 0
lea eax, [ebp - 0x150]
push eax
add ecx, 0xfffffffe
push ecx
lea edx, [ebp - 0x13c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ax, word [ebp + 0x10]
movzx ecx, bl
add ax, cx
mov word [ebp + 0x10], ax
cmp ax, word [ebp + 0x14]
jne 0x4028e0
push 0x412778
call fcn.00404558
add esp, 4
call fcn.004049b5
mov ecx, dword [ebp - 4]
neg eax
sbb al, al
not al
and al, byte [ebp - 0x13d]
pop edi
xor ecx, ebp
pop esi
call fcn.00404528
mov esp, ebp
pop ebp
ret 0x10
movzx edx, word [ebp + 0x10]
push edx
push str._nFailed_to_process__04x_n
call fcn.00404558
add esp, 8
mov byte [ebp - 0x13d], 0
jmp 0x402a6c
movzx eax, word [ebp + 0x10]
push eax
jmp 0x402a94
Function at 0x402b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x414058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, ebx
shr ecx, 8
mov byte [ebp - 0xa], cl
mov ecx, dword [eax]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
mov word [ebp - 0xc], 0xb000
mov byte [ebp - 8], 0x10
mov dword [ebp - 0x50], 0x40
mov byte [ebp - 9], bl
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push 5
lea eax, [ebp - 0xc]
push eax
call edx
test al, al
jne 0x402b7a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404528
mov esp, ebp
pop ebp
ret 4
push 0
movzx eax, bx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x50]
sub ecx, 2
mov dword [ebp - 0x50], ecx
mov eax, 0
je 0x402baf
lea esp, [esp]
mov dl, byte [ebp + eax - 0x4c]
not dl
mov byte [ebp + eax - 0x4c], dl
inc eax
cmp eax, ecx
jb 0x402ba0
push 0
lea eax, [ebp - 0x54]
push eax
push ecx
lea ecx, [ebp - 0x4c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.00404528
mov esp, ebp
pop ebp
ret 4

Function at 0x403fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [eax + 4]
mov ecx, dword [eax]
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dl, byte [ebp - 0xa]
push edi
mov byte [ebp - 1], 0
mov esi, 0x10
mov al, cl
movzx ecx, byte [ebp - 0xb]
add al, byte [ecx + 0x412548]
movzx ecx, byte [ebp - 1]
add ecx, dword [ebp + 8]
movzx edi, byte [ebp - 9]
mov bl, byte [ebp - 8]
mov byte [ecx], al
xor dl, byte [edi + 0x412548]
movzx edi, byte [ebp - 7]
mov byte [ecx + 1], dl
xor bl, byte [edi + 0x412548]
movzx edi, byte [ebp - 5]
add byte [ebp - 1], 4
mov byte [ecx + 2], bl
mov byte [ebp - 8], bl
mov bl, byte [ebp - 6]
add bl, byte [edi + 0x412548]
dec esi
mov byte [ecx + 3], bl
movzx ecx, byte [ebp - 8]
mov byte [ebp - 2], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 0xb], dl
mov dl, byte [ebp - 9]
mov byte [ebp - 9], cl
movzx ecx, byte [ebp - 7]
mov byte [ebp - 8], cl
movzx ecx, byte [ebp - 5]
mov byte [ebp - 6], cl
movzx ecx, byte [ebp - 2]
mov byte [ebp - 7], bl
mov byte [ebp - 5], cl
jne 0x403ff2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x414058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x5c], edx
shr edi, 3
lea edx, [edi*8]
sub ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x50]
push ecx
mov dword [ebp - 0xc], 0x991927fe
mov dword [ebp - 8], 0x11096919
lea esi, [ebp - 0xc]
call fcn.00403fd0
add esp, 4
test edi, edi
je 0x4040f7
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
xor eax, dword [esi]
xor ecx, dword [esi + 4]
lea edx, [ebp - 0x50]
push edx
lea esi, [ebp - 0x58]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
call fcn.00403ee0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
add dword [ebp - 0x5c], 8
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov esi, ebx
add esp, 4
add ebx, 8
dec edi
jne 0x4040be
cmp dword [ebp - 0x60], 0
jbe 0x40414c
mov edx, dword [esi]
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x50]
push ecx
lea esi, [ebp - 0x58]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
call fcn.00403ee0
mov ecx, dword [ebp - 0x60]
add esp, 4
xor esi, esi
test ecx, ecx
je 0x40413e
mov edi, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
sub edi, edx
jmp 0x404130
lea eax, [ebp + esi - 0x58]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc esi
cmp esi, ecx
jb 0x404130
push ecx
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.0040ba80
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404528
mov esp, ebp
pop ebp
ret