joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53a070
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x53a095
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
dec esi
jne 0x53a086
pop edi
movzx eax, dl
pop esi
ret

Function at 0x53a310
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.005ca540
mov eax, dword [0x6c6f60]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov esi, eax
test esi, esi
je 0x53a397
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
test eax, eax
je 0x53a397
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.004e4cf0
add esp, 0x10
lea ecx, [esp + 4]
test eax, eax
push 0
push ecx
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005c950e
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0xff
push eax
call fcn.004e4cf0
add esp, 0x10
mov byte [esp + 0x107], 0
call fcn.0053a1d0
test eax, eax
jle 0x53a41b
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x53a42f
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005c950e
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.005c950e
add esp, 0x108
ret
Function at 0x580ee0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x580fcc
push edi
mov edi, dword [esp + 0x14]
inc edi
lea ebx, [ebx]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x580f5e
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax + 2], cl
movzx ecx, byte [edx + 0x652520]
mov byte [eax + 3], cl
jmp 0x580faf
shl edx, 0x10
cmp esi, 2
jne 0x580f6e
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x580f9b
lea ecx, [esi + 0x3c]
jmp 0x580fa8
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + 0x652520]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x580f00
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x5b03e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov eax, dword [ebp + 4]
cmp eax, dword [ecx + 4]
jge 0x5b03f7
mov edi, ecx
jmp 0x5b03fb
mov edi, ebp
mov ebp, ecx
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jg 0x5b040b
mov eax, ebx
jmp 0x5b0415
push eax
push ebx
call fcn.00537dd0
add esp, 8
test eax, eax
jne 0x5b041d
pop edi
pop ebp
pop ebx
ret
push esi
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x5b043b
mov eax, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ebp + 4]
jl 0x5b0425
cmp esi, dword [edi + 4]
jge 0x5b0450
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [edi + 4]
jl 0x5b0440
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
pop esi
test ecx, ecx
jle 0x5b0474
mov edx, dword [ebx]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x5b0471
dec ecx
test ecx, ecx
jg 0x5b0463
mov dword [ebx + 4], ecx
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x5cc8eb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x601e15
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00601ad8

Function at 0x601e20
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00601c59

Function at 0x606087
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00605d47

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x455e61
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x455e70
pop dword [ebp - 0x1c]
mov eax, 0xb0832e77
add eax, 0x4fc22ff9
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x61c99908
add dword [ebp - 0x2c], 0xec88ac43
mov dword [ebp - 0x28], 0x654f554b
sub dword [ebp - 0x28], 0x331c0906
mov dword [ebp - 0x24], 0x54cfde63
add dword [ebp - 0x24], 0xf77c65cb
mov dword [ebp - 0x20], 0x82fda928
sub dword [ebp - 0x20], 0x82fda928
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xf2fc1a58
sub eax, 0xf2b669f4
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xe52dbfe9
add dword [ebp - 0x2c], 0x8f44a96d
mov dword [ebp - 0x28], 0x24730803
sub dword [ebp - 0x28], 0xe306a68e
mov dword [ebp - 0x24], 0x464d4b52
sub dword [ebp - 0x24], 0xe2dddee6
mov dword [ebp - 0x20], 0x975ecbbc
sub dword [ebp - 0x20], 0x975ecbbc
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x9d5583be
sub eax, 0x9d0fd33e
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x4eeae
push 0
call eax
mov ecx, 0x205d78d7
add ecx, 0xdfa2d5a0
mov esi, eax
mov edx, 0xd4790715
sub edx, 0xd431a715
add edx, dword [ebp - 0x1c]
mov edi, 0xe0864c3
sub edi, 0xe6a0b54c
xor dword [ebp - 0x10], edx
mov ebx, dword [edx]
xor dword [ebp - 0x14], edx
add ebx, edi
xor dword [ebp - 8], eax
mov dword [esi], ebx
xor dword [ebp - 0x18], edx
add esi, 4
add edx, 4
loop 0x455f92
add eax, 0x12caf
xor ebx, ebx
add ebx, eax
add eax, 0xee5ef512
sub eax, 0xee5ef50d
mov ecx, 0x636c521c
sub ecx, 0x632c521c
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40e791
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x41279f
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401533
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401dc7
sub eax, fcn.00401592
push eax
push fcn.00401592
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107a
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401461
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.004014b3
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
lea ebx, [ebp - 2]
or eax, 0x402054
call fcn.00401592
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401533
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
enter 0x11c, 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x4044ab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004040c0
push eax
push esi
push dword [ebp + 8]
call fcn.00404075
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004040c0
push eax
push esi
push dword [ebp + 8]
call fcn.00404075
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004040b0
push es
out dx, al
sbb dword [edi], ecx
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004040b0
das
jno 0x404615
pop ebp
lea eax, [ebp - 0x84]
push eax
call fcn.004040c0
push eax
push esi
push dword [ebp + 8]
call fcn.00404075
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x4048a9
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00404021
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x404620
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00404021
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
or al, 0x66
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x4045ed
call fcn.004040b0
outsb dx, byte [esi]
xor eax, 0x7e8be330
cmp al, 3
dec byte [ecx - 0x8743]
dec dword [ebx + 0x8087]
add byte [ebx], bh
ret
Function at 0x4046f8
Capabilities:
Inspect section memory permissions

Disassembly:
call fcn.004040b0
dec ebp
sbb cl, dh
adc eax, 0xa0878b
add byte [eax], al
cmp eax, ebx
je 0x404764
add eax, esi
cmp dword [eax], ebx
je 0x404764
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40475f
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x404749
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x404751
cmp edx, ebx
jne 0x40489f
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x404720
add eax, dword [eax + 4]
jmp 0x40470d
mov dword [ebp + 0xc], ebx
jmp 0x40476f
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x404787
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4047a5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x404803
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4047ea
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4047f3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4047fd
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4047df
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x404769
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x42c0f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x42c115
xor eax, eax
jmp 0x42c16c
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x42c12a
xor eax, eax
jmp 0x42c16c
push ebp
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
call fcn.0042bb60
mov esp, ebp
pop ebp
ret

Function at 0x42c1e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x3000
mov dword [ebp - 4], 0x40
mov dword [ebp - 8], 0
push str.VirtualAlloc
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42e0fc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [0x42e0fc]
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x10001268
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x10001260
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10006084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x1000122a
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x100017e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x10006094]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x100019c8
mov dword [esp], esi
call dword [0x10006094]
mov cl, byte [ebp + 8]
and eax, 0xff
sar eax, cl
test al, 1
je 0x10001a28
mov edi, dword [0x10006084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edi
je 0x100019b8
test byte [0x10002030], 8
jne 0x10001940
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10002040], 8
jne 0x100018f8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
mov dword [esp], edi
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001879
cmp dword [ebp + 8], 3
jbe 0x100018b8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0x10]
add eax, edi
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 8]
inc esi
mov dword [esp + 8], str._s:_s:_s
mov edx, dword [ecx*4 + 0x100040e4]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
mov dword [esp], eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001879
mov ecx, dword [0x10006094]
test ecx, ecx
je 0x10001a08
mov dword [esp], 0x10002040
call dword [0x10006094]
test al, 8
je 0x1000184f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str._04x:
call dbg.sprintf
add edi, eax
jmp 0x1000184f
mov ebx, dword [0x10006094]
test ebx, ebx
je 0x100019e8
mov dword [esp], 0x10002030
call dword [0x10006094]
test al, 8
je 0x1000183a
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ebx, 0x10624dd3
mov ecx, eax
mov dword [esp + 4], str._3u._03u:
mul ebx
mov eax, edx
mov edx, ecx
shr eax, 6
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
sub edx, eax
mov eax, ecx
mov dword [esp + 0xc], edx
mul ebx
shr edx, 6
lea ebx, [ebp - 0xd4]
mov dword [esp + 8], edx
mov dword [esp], ebx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x10001842
add esp, 0xe0
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x100017fd
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x1000194e
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001906
or eax, 0xffffffff
jmp 0x100018aa
Function at 0x4020a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x639a10]
push ebx
mov ebx, 4
movzx eax, byte [ecx]
mov byte [0x639960], al
movzx eax, byte [ecx + 1]
mov byte [0x639961], al
movzx eax, byte [ecx + 2]
mov byte [0x639962], al
movzx eax, byte [ecx + 3]
mov byte [0x639963], al
movzx eax, byte [ecx + 4]
mov byte [0x639964], al
movzx eax, byte [ecx + 5]
mov byte [0x639965], al
movzx eax, byte [ecx + 6]
mov byte [0x639966], al
movzx eax, byte [ecx + 7]
mov byte [0x639967], al
movzx eax, byte [ecx + 8]
mov byte [0x639968], al
movzx eax, byte [ecx + 9]
mov byte [0x639969], al
movzx eax, byte [ecx + 0xa]
mov byte [0x63996a], al
movzx eax, byte [ecx + 0xb]
mov byte [0x63996b], al
movzx eax, byte [ecx + 0xc]
mov byte [0x63996c], al
movzx eax, byte [ecx + 0xd]
mov byte [0x63996d], al
movzx eax, byte [ecx + 0xe]
mov byte [0x63996e], al
movzx eax, byte [ecx + 0xf]
mov byte [0x63996f], al
mov eax, 0x63996e
mov cl, byte [eax - 1]
mov ch, byte [eax]
mov dh, byte [eax + 1]
mov dl, byte [eax - 2]
mov byte [ebp - 2], cl
mov byte [ebp - 1], ch
mov byte [ebp - 3], dh
test bl, 3
jne 0x40219d
movzx ecx, cl
movzx edx, dl
mov cl, byte [ecx + 0x5f6a90]
mov dh, byte [edx + 0x5f6a90]
mov byte [ebp - 4], cl
movzx ecx, byte [ebp - 1]
mov dl, byte [ebp - 4]
mov cl, byte [ecx + 0x5f6a90]
mov byte [ebp - 2], cl
movzx ecx, byte [ebp - 3]
mov cl, byte [ecx + 0x5f6a90]
mov byte [ebp - 1], cl
mov ecx, ebx
shr ecx, 2
xor dl, byte [ecx + 0x5f6890]
mov ch, byte [ebp - 1]
mov cl, byte [eax - 0xe]
inc ebx
xor cl, dl
mov byte [eax + 2], cl
mov cl, byte [eax - 0xd]
xor cl, byte [ebp - 2]
mov byte [eax + 3], cl
mov cl, byte [eax - 0xc]
xor cl, ch
mov byte [eax + 4], cl
mov cl, byte [eax - 0xb]
xor cl, dh
mov byte [eax + 5], cl
lea ecx, [ebx*4 + 2]
add eax, 4
cmp ecx, 0xb2
jb 0x402144
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402500
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x63995c]
mov ebx, 4
push edi
mov edi, 0x639a00
mov ecx, esi
sub edi, esi
lea ecx, [ecx]
mov edx, 4
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
dec edx
jne 0x402525
dec ebx
jne 0x402520
mov byte [ebp - 1], 9
mov dword [ebp - 8], 0x6399f0
lea esp, [esp]
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
jmp 0x4025a0
mov ecx, edi
mov edx, 4
jmp 0x4025b0
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5f6990]
mov byte [ecx - 4], al
dec edx
jne 0x4025b0
inc edi
dec ebx
jne 0x4025a0
mov edx, dword [ebp - 8]
mov eax, esi
mov ebx, 4
mov edi, 4
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
dec edi
jne 0x4025d5
dec ebx
jne 0x4025d0
call fcn.004021e0
mov dl, byte [ebp - 1]
sub dword [ebp - 8], 0x10
dec dl
mov byte [ebp - 1], dl
test dl, dl
jne 0x402540
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
jmp 0x402660
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5f6990]
mov byte [ecx - 4], al
dec edx
jne 0x402660
inc edi
dec ebx
jne 0x402651
mov edx, 0x639960
lea edi, [ebx + 4]
sub edx, esi
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
dec ecx
jne 0x402685
dec edi
jne 0x402680
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret