joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449be2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4d1028]
mov esi, ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
lea edi, [esi + 0x18]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edx + ecx]
push ebx
push eax
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, edi
push eax
call fcn.00408e70
mov ecx, esi
mov esi, dword [esi + 0x18]
lea eax, [esi + 1]
cmp eax, 1
ja 0x449c51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov ebx, 0x19
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ecx]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ebx
push ebx
push 7
push ecx
push dword [ebp - 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x449d79
xor eax, eax
push eax
push eax
push eax
push 6
push dword [edi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, dword [ebp + 0x18]
test eax, eax
je 0x449d8c
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x449cd7
test ecx, ecx
je 0x449cd7
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
lea edi, [edx + eax]
push ecx
push ebx
push edi
call fcn.00471f40
add esp, 0xc
mov eax, 0xffffff00
mov ecx, dword [edi + eax + 0x100]
test ecx, ecx
je 0x449cd2
sub ecx, ebx
mov dword [edi + eax + 0x100], ecx
add eax, 4
jne 0x449cbe
mov eax, dword [ebp - 0x14]
mov dword [0x4d65c0], eax
sub esp, 0xc
mov edi, dword [ebp - 0x20]
mov dword [esp + 8], 4
mov dword [esp + 4], 0x4d65c0
mov ecx, edi
call fcn.00449b84
test eax, eax
mov dword [0x4d65c0], 0
jne 0x449d6a
mov eax, dword [ebp + 0x10]
mov dword [0x4d6af0], eax
sub esp, 0xc
mov ecx, edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0x4d6af0
call fcn.00449b84
test eax, eax
mov dword [0x4d6af0], 0
jne 0x449d6a
mov eax, dword [ebp + 0x14]
mov dword [0x4d6af4], eax
sub esp, 0xc
mov ecx, edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0x4d6af4
call fcn.00449b84
test eax, eax
mov dword [0x4d6af4], 0
je 0x449d9e
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x449c3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov ebx, 0x1a
jmp 0x449c39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ebx, 0x1b
jmp 0x449c3b
mov esi, dword [ebp + 8]
lea eax, [edi + 0x20]
mov dword [ebp - 0x1c], eax
push 0x1c
call fcn.0046d61c
add esp, 4
mov ebx, eax
mov ecx, eax
push esi
push dword [edi + 0x24]
push dword [edi + 8]
push dword [edi]
call fcn.00452c20
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.004497de
mov ecx, dword [edi + 0x20]
push 0x400
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.00452d00
mov ebx, 4
test al, al
je 0x449c3b
mov ecx, edi
call fcn.004496b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x449c3b
Function at 0x44c270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
js 0x44c27f
pop ebp
jmp fcn.00453270
xor eax, eax
pop ebp
ret

Function at 0x44eec6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4d1028]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ecx]
mov esi, dword [edi + 4]
cmp byte [esi + 0xd], 0
je 0x44eef4
mov dword [ebp - 0x14], edi
mov esi, edi
jmp 0x44ef3e
mov edx, dword [eax]
xor ebx, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], ecx
mov edi, esi
mov esi, dword [esi + 0x10]
xor ecx, ecx
cmp esi, edx
setae cl
xor eax, eax
cmp edx, esi
setb al
cmp byte [ebp + 0xc], 0
cmovne eax, ecx
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov esi, dword [edi + ecx*8]
cmp byte [esi + 0xd], bl
je 0x44eefe
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
test al, al
mov dword [ebp - 0x14], edi
je 0x44ef68
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 0x20]
cmp edi, dword [esi]
je 0x44ef5e
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
mov esi, ebx
mov ebx, edx
call fcn.0043a6dc
lea ecx, [ebp - 0x14]
mov edx, ebx
mov al, 1
mov ebx, esi
mov ecx, dword [ecx]
jmp 0x44ef6c
lea esi, [ebp - 0x18]
push edx
push eax
push edi
push 1
jmp 0x44ef83
xor eax, eax
mov ecx, edi
mov ecx, dword [ecx + 0x10]
mov esi, dword [ebp + 0x10]
cmp ecx, dword [esi]
jae 0x44ef93
mov ecx, dword [ebp - 0x1c]
movzx eax, al
push edx
push esi
push edi
push eax
lea esi, [ebp - 0x18]
push esi
call fcn.0044ed8a
mov eax, dword [esi]
mov dword [ebx], eax
mov byte [ebx + 4], 1
jmp 0x44efa5
mov ecx, dword [ebp - 0x1c]
push edx
call fcn.0044efbc
mov eax, dword [ebp - 0x14]
mov dword [ebx], eax
mov byte [ebx + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x44fe4a
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x4d1028]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, 5
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
jne 0x44fee2
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
cmp dword [edi + 0x14], 7
jbe 0x44fe8e
mov edi, dword [edi]
mov ebx, dword [ebx]
push 0
push esi
push edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x44fecf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
lea ecx, [ebp - 0x14]
push 3
push edi
push edi
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
lea eax, [ebp - 0x14]
sbb edi, edi
or edi, dword [eax]
jmp 0x44fed2
xor edi, edi
dec edi
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45020c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x4d1028]
mov edi, 5
add ecx, 0xfffffffb
xor eax, ebp
cmp ecx, 1
mov dword [ebp - 0x10], eax
ja 0x450360
mov eax, dword [ebp + 0x14]
xor edi, edi
mov ecx, 7
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x54], 0x44
cmp dword [eax + 0x14], ecx
jbe 0x45027e
mov eax, dword [eax]
mov ebx, dword [ebp + 0x10]
push eax
call fcn.0047b29f
add esp, 4
mov edx, 7
mov ecx, dword [esi + 0x10]
cmp dword [esi + 0x14], edx
jbe 0x450299
mov esi, dword [esi]
test ecx, ecx
mov edx, dword [ebp + 0x1c]
cmove esi, ecx
mov ecx, 7
cmp dword [ebx + 0x14], ecx
mov ecx, dword [ebp + 0xc]
jbe 0x4502b0
mov ebx, dword [ebx]
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x54]
push edx
push ecx
push esi
push edi
push edi
push edi
push edi
push edi
mov dword [ebp - 0x58], eax
push eax
push ebx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x450350
mov eax, dword [ebp + 8]
mov ebx, 0x101c01
cmp eax, 6
mov eax, 0x1fffff
cmove ebx, eax
mov eax, dword [esi]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push ebx
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, dword [esi + 4]
test eax, eax
je 0x450349
mov eax, esi
mov esi, 0x100c43
mov ecx, 0x1fffff
add eax, 4
cmp dword [ebp + 8], 6
mov edi, eax
cmove esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push edi
push dword [ebp - 0x5c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
jmp 0x450350
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x450360
push eax
call fcn.0041ba90
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x450374
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov edi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x10], ebx
mov dword [ebx], ecx
xor ebx, ebx
push edi
mov edi, eax
push esi
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x4503e5
mov edi, dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
push ebx
push ebx
push dword [ebp - 0x10]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4520b8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov edx, dword [0x4d1028]
mov al, byte [ebp + 8]
mov esi, ecx
xor edx, ebp
test al, al
mov dword [ebp - 0x10], edx
je 0x452108
xor edi, edi
mov ebx, 0x499af6
mov ecx, esi
inc edi
push 0
push 0x456fe0
push edi
push str.NtMapViewOfSection
push ebx
call fcn.00451bae
mov ecx, esi
push edi
push 0x4571e0
push edi
push str.NtUnmapViewOfSection
push ebx
call fcn.00451bae
jmp 0x452112
cmp dword [esi + 8], 0
je 0x452214
mov eax, dword [esi]
mov edi, dword [eax]
push 1
push 0x2000
push 0x10000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x74], esi
mov esi, dword [esi + 8]
mov dword [ebp - 0x6c], eax
shl esi, 6
lea eax, [esi + 0x50]
mov dword [ebp - 0x70], eax
push eax
call fcn.00451a78
add esp, 4
mov ebx, eax
mov eax, 0xfffff000
add esi, 0x104f
mov ecx, ebx
and esi, eax
and ecx, eax
add ecx, dword [ebp - 0x6c]
push 0x40
push 0x1000
push esi
push ecx
mov dword [ebp - 0x6c], edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x45220d
mov edi, eax
mov eax, dword [ebp - 0x70]
and ebx, 0xfff
add edi, ebx
lea ebx, [ebp - 0x60]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 4], 0x10
push 0xa4
push eax
push 0x4d6f30
call fcn.00472a40
add esp, 0xc
mov esi, dword [ebp - 0x74]
mov ecx, esi
push ebx
push dword [ebp - 0x70]
push edi
call fcn.004523fc
mov ebx, eax
test eax, eax
jne 0x452216
lea eax, [ebp - 0x64]
push eax
push 0x10
lea eax, [ebp - 0x60]
push eax
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
mov ebx, 0x2a
je 0x452216
cmp dword [ebp - 0x64], 0x10
jne 0x452216
lea eax, [ebp - 0x68]
push eax
push 0x20
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [esi]
push 0xa4
push 0x4d6f30
push str.g_originals
call fcn.00449b84
mov ebx, eax
jmp 0x452216
mov ebx, 4
jmp 0x452216
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, ebx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x456660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4d1028]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp byte [esi + 0xd], 0
je 0x45668b
mov dword [ebp - 0x14], eax
mov edi, eax
jmp 0x4566d2
mov edx, dword [edx]
xor ebx, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov edi, esi
mov esi, dword [esi + 0x10]
xor ecx, ecx
cmp esi, edx
setae cl
xor eax, eax
cmp edx, esi
setb al
cmp byte [ebp + 0xc], 0
cmovne eax, ecx
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov esi, dword [edi + ecx*8]
cmp byte [esi + 0xd], bl
je 0x456695
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
test al, al
mov dword [ebp - 0x14], edi
je 0x4566fe
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp edi, dword [eax]
je 0x4566f2
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
mov esi, ebx
mov ebx, edx
call fcn.0043a6dc
lea ecx, [ebp - 0x14]
mov edx, ebx
mov al, 1
mov ebx, esi
mov ecx, dword [ecx]
jmp 0x456702
lea esi, [ebp - 0x18]
push dword [ebp + 0x14]
push edx
push edi
push 1
jmp 0x456718
xor eax, eax
mov ecx, edi
mov ecx, dword [ecx + 0x10]
cmp ecx, dword [edx]
jae 0x456728
mov ecx, dword [ebp - 0x1c]
lea esi, [ebp - 0x18]
movzx eax, al
push dword [ebp + 0x14]
push edx
push edi
push eax
push esi
call fcn.00456524
mov eax, dword [esi]
mov dword [ebx], eax
mov byte [ebx + 4], 1
jmp 0x456750
mov eax, dword [ebp + 0x14]
mov esi, eax
add eax, 0x10
push eax
push dword [ebp - 0x1c]
call fcn.004562fc
add esp, 8
push 0x18
push esi
call fcn.0046d651
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebx], eax
mov byte [ebx + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d691
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x45b3dc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor ebx, ebx
mov edi, edx
mov esi, ecx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push ebx
push edx
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.00408e70
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x45b41f
push edi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48b0d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048b0de
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x424651e5
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6c075115
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x406703
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43f77c], 0
jne 0x40673e
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406717
mov dword [ecx*4 + 0x43f778], eax
inc ecx
cmp ecx, 0x100
jl 0x406712
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40676b
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43f778]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40674c
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x405150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x405182
jl 0x405175
test ecx, ecx
jne 0x405182
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40525f
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4051b2
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x4051b4
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x405208
jg 0x4051c5
test esi, esi
je 0x405208
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x4051d9
jl 0x4051d3
cmp ecx, esi
jae 0x4051d9
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.00455290
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x40522c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x405248
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x405197
jl 0x405248
test ecx, ecx
jne 0x405197
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4052a3
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x4052a3
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00455290
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x40530c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4052c9
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x4052f7
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004599d2
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x40530c
cmp edi, eax
ja 0x4052d5
test edi, edi
je 0x40530c
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004599d2
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc