joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ff94b
Capabilities:
Encode data using xor

Disassembly:
jl 0x4ff90c
popal
adc al, 0xb5
dec esi
and bh, byte [esi - 0x3158122d]
out 0xde, al
sbb eax, 0x2729fe38
inc edx
pop eax
invalid
pop ecx
sbb eax, 0x5e3b6b74
mov al, 0xed
mov bl, bl
xchg ecx, eax
fld xword [ebp + 0x50]
sbb eax, 0xb703d501
wait
mov bh, 0x80
mov ebx, 0x237a3acd
inc ecx
xor dword [edi + eax*2], ebp
bsr eax, dword [ecx]
sub edx, dword [edx + 0x77]
iretd
aad 0x3e
jae 0x4ff8da
cld
jae 0x4ff89e
pop eax
and eax, 0x44241b56
fsubr qword [eax]
scasb al, byte es:[edi]
je 0x4ff98d
jns 0x4ff99e
push edx
mov edi, 0xe3634e1f
xchg byte [esi + 0x24], dl
xchg byte [esp + eax*4 - 9], bl
cmc
call 0xec95075c
adc eax, 0xf0e62471
out 0xf0, al
pop esi
push ebp
push 0x912d246f
mov ebx, 0x37ef108d
mov bh, 0xe2
movsb byte es:[edi], byte [esi]
xchg ebp, eax
test byte [ebx + esi*8 + 0x4c], bh
test byte [ebx + esi*8 + 0x4c], bh
lcall 0x7f7d, 0xabe76a45
jne 0x4ff9aa
dec ebp
mov byte [0xb5da406a], al
inc eax
invalid
mov ch, 0x75
xlatb
std
add esp, dword [edi]
test byte [esi - 0x3a797e80], cl
das
inc ebp
sbb eax, 0x3f754a3a
daa
pop ebp
pushfd
and al, 0xa7
movsb byte es:[edi], byte [esi]
adc byte [ecx], cl
inc esi
mov eax, 0xb12fc3aa
push ecx
aaa
in eax, 0x4c
int 0xe5
inc al
push ecx
jge 0x4ff90e
jge 0x4ff94a
in al, dx
mov esi, 0x41504e7e
aad 0xdf
xor eax, 0xc0fd796
cmp edx, dword [ebp + 0x14c1d42c]
dec esp
adc al, 0x4c
adc eax, esp
xchg edx, eax
retf
xchg esi, eax
cmp edx, ebp
wait
mov cl, 0x2b
or bl, byte [ecx]
dec esp
push 0xfeaae979
xor dword [ebx + eax*2], ebp
daa
nop
scasb al, byte es:[edi]
jp 0x4ff9b3
iretd
Function at 0x52995b
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce4b
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a7e
push ecx
lea ecx, [esi + 0x18]
call fcn.0054917b
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a95
push ecx
lea ecx, [esi + 0x24]
call fcn.0054908b
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x549d7b
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0xb51967d7
imul ebx, dword ds:[esi + ebx], 0x478ff922
arpl word [ecx + 0x59e8c5de], di
mov dh, 0xdd
invalid
Function at 0x54b4fb
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
push edi
jg 0x54b4b0
imul ebx, esp, 0x4a
pop ss
cmp al, byte [ebx]
sub bl, bl
mov eax, 0x16b8e4bd
xchg esi, eax
std
add byte [ecx + 0x2cf42e25], ah
aaa
xchg dword [edi - 0x1116b9d5], edx
xor edx, dword [0xeb95a299]
and eax, 0xbdb71fbb
popfd
inc eax
pop ss
mov dword [esi], edi
stc
jl 0x54b4bd
stc
or ah, byte [ecx - 0x4cfebead]
loopne 0x54b4c4
les ecx, [edx]
out 0x56, eax
inc ecx
and eax, 0x9fe9a039
mov dword [ecx - 0x3f], edi
xlatb
pop ebx
invalid
dec ecx
push 0x9f4a397a
push 0xade18177
bnd jle 0x54b560
or ch, byte [edi]
jns 0x54b572
jns 0x54b497
xchg ecx, eax
lahf
adc dword [ebp + 0x2b], ebp
or al, 0xd6
sub ecx, ecx
retf
cmpsb byte [esi], byte es:[edi]
sub al, 0x7b
and al, 0x1b
popal
mov ecx, 0xf514e35c
sbb esp, dword [ecx - 0x47]
pop esp
jecxz 0x54b57e
cmc
add dl, byte [ebp + 0x33989d43]
mov ah, 0x2e
adc al, 0x49
xor esi, dword [esi + ebp + 0x57491466]
adc al, 0x49
push edi
or esi, eax
cmp bl, 0x2d
pushal
enter 0xfffffffffffffab7, 0x64
lodsd eax, dword [esi]
mov bh, 0xfa
lodsd eax, dword fs:[esi]
push ss
cmp esi, esp
mov al, byte [0x2d464e06]
test ecx, ebx
stc
pop ebp
mov eax, 0x21b9a628
mov ah, 0x75
lcall 0x3f57, 0xac4bac67
jg 0x54b570
in al, dx
jno 0x54b5ab
sub byte [edx], dl
cmc
cmp ebp, dword [ecx - 0x47339a6f]
jnp 0x54b564
insd dword es:[edi], dx
mov ecx, 0x71bd5304
mov bl, 2
mov dh, byte [eax - 0x2d]
mov edx, 0x76ac3b85
aaa
cmc
rol byte es:[eax + 0x4c], 1
jo 0x54b611
xor dword [esi + 0x6087e675], 0x124b1338
iretd
xor eax, 0xae259d75
cmp ebx, dword [ebx - 0x204cc7da]
push cs
or byte [eax + ecx*8], dh
push edi
add eax, ebx
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
jb 0x54b690
mov bl, 0x33
jo 0x54b67c
xor esi, dword [eax + 0x51]
call 0x14462605
mov bh, 0x97
adc byte [ebp - 0x66], ch
out dx, eax
and al, 0xec
push es
push 0x4819fa96
cmp edi, dword [esi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword es:[esi], dword es:[edi]
aaa
mov dword [0xac02182c], eax
test eax, 0x6fa02eb2
stc
push cs
or ebx, dword [edx - 0x3f36a9e2]
and dh, dh
aaa
push ss
pop ebx
insb byte es:[edi], dx
pop ecx
or dword [ecx - 0x63], ebp
cdq
inc ecx
add al, 0x19
cmp al, 0xa7
add eax, dword [edx + 0x7b]
lds ebx, [edx - 0x46]
js 0x54b628
mov ah, 0x34
sub eax, 0x8aa6c949
mov byte [0xc353f651], al
invalid
in eax, 0x4f
loop 0x54b65b
xchg ecx, eax
or byte [ecx - 0x1e6b245], bh
dec byte [eax]
mov edx, 0xf45a8883
out 0x94, eax
pop es
and dh, byte [edi]
sbb al, byte [edi]
imul ebp, dword [esi - 0x3a85a822], 0x9c4f6f6e
clc
adc eax, 0xd8809b93
mov edi, 0x833355ec
ret
Function at 0x572f6b
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a645b
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57308e
push ecx
lea ecx, [esi + 0x18]
call fcn.0059278b
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5730a5
push ecx
lea ecx, [esi + 0x24]
call fcn.0059269b
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bc8cb
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005efdbb
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bc9ee
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc0eb
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bca05
push ecx
lea ecx, [esi + 0x24]
call fcn.005dbffb
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5db1fb
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 0xf4eb09a5
and byte [edi + 0x16], cl
xor al, 0x31
or dl, byte [ebx - 0x5b81178f]
nop
vmwrite ecx, dword [edi - 0x2a5eae08]
mov dword [0xe48d83df], eax
sbb dword [edi - 0x7e], esi
loope 0x5db201
invalid
Function at 0x5e45cb
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x5c00e1f4
inc ebx
aas
dec edx
ret
movsb byte es:[edi], byte [esi]
jl 0x5e45fe
mov word [ebp - 0x3f], ss
xchg ebp, eax
pop esp
pop esi
push 0xffffffffffffffc1
fild word [esi - 0x5d]
sbb byte [ebp + 0x76942fe5], dl
mov ecx, 0x3c6a2143
inc ebx
and dword [edx + 0x3c], ebp
fisub word [edi + 0x59]
jl 0x5e459a
scasb al, byte es:[edi]
xor al, 0x20
dec edx
loop 0x5e4603
pop es
mul ebx
xor al, 0x26
loope 0x5e4608
dec byte [esi - 0x41406880]
dec dword [esi - 0x23]
movsd dword es:[edi], dword [esi]
not dword [esi + 0x20]
frstor dword [ebp - 0x4edfa909]
push ebx
mov cl, 0x53
dec ebp
cmpsb byte [esi], byte es:[edi]
popfd
scasd eax, dword es:[edi]
ja 0x5e465a
daa
or edx, 0xffffffa7
adc dword [edx], ebp
mov dl, 0x97
out dx, eax
outsd dx, dword [esi]
xchg ah, cl
or eax, 0xcae8047
je 0x5e45e0
push esi
invalid
pop edi
popal
xchg esi, eax
in eax, dx
mov ebx, 0x9eeb3b52
dec ebp
xor ebx, dword [edx + ebp*2 + 0x26]
rcl edi, 0xee
fst st(3)
scasb al, byte es:[edi]
pop es
imul esi, dword [ecx - 0x67], 0xd879241a
mov dh, 0xd5
cmc
mov ss, word [ebx]
cdq
sbb ah, byte [ecx + edi*2]
fdiv dword [esi + 0x138ef5d5]
sbb byte [edi + edi*8 + 8], 0x6a
sub byte [ecx + 0x30], cl
popfd
bound ecx, qword [esi]
cld
cdq
sar dword [ebp - 0x5a], cl
in al, dx
adc al, 0xf9
or eax, 0x75e38ddc
jp 0x5e4641
invalid

Function at 0x605f5b
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0063944b
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x60607e
push ecx
lea ecx, [esi + 0x18]
call fcn.0062577b
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606095
push ecx
lea ecx, [esi + 0x24]
call fcn.0062568b
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x64d15d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654338
cmp edx, dword [eax]
je 0x64d17f
add eax, 8
inc ecx
cmp eax, 0x6543c8
jl 0x64d170
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654338]
jne 0x64d2ad
mov eax, dword [0xa57c90]
cmp eax, 1
je 0x64d287
test eax, eax
jne 0x64d1b0
cmp dword [0x654264], 1
je 0x64d287
cmp edx, 0xfc
je 0x64d2ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d1e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064db40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064dfd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d22a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064dfd0
mov edi, eax
lea eax, [ebp - 0x1a4]
invalid
inc dword [ebx + 0x36a3be8]
lea eax, [ebp + 8]
lea esi, [esi + 0x65433c]
push 0
push eax
push dword [esi]
call fcn.0064dfd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000c455
pop dword [ebp - 0x1c]
mov eax, 0x68c2d68
sub eax, 0xf68b6913
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x33bf5
push 0
mov eax, 0x94fee441
add eax, 0x7b025c23
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x3316
mov edx, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x1c]
mov esi, 0x7deb6cd4
sub esi, 0x2552158f
sub dword [ebp - 0x10], eax
mov edi, dword [ebx]
xor dword [ebp - 4], eax
sub edi, esi
sub dword [ebp - 0x10], 0x27cdb04b
mov dword [edx], edi
mov dword [ebp - 4], 0xe74db5c8
add edx, 0x68d43f22
add edx, 0x972bc0e2
add ebx, 0xdb1d173
add ebx, 0xf24e2e91
loop 0x1000c4a8
add eax, 0xbf2b
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40288e
pop dword [ebp - 0x34]
mov eax, 0xa0008638
sub eax, 0x9fc05daa
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xeb11d992
add dword [ebp - 0x44], 0x63406bb9
mov dword [ebp - 0x40], 0x31d6be4
add dword [ebp - 0x40], 0x2f15e061
mov dword [ebp - 0x3c], 0x77afc580
add dword [ebp - 0x3c], 0xd49c7eae
mov dword [ebp - 0x38], 0x906c5179
add dword [ebp - 0x38], 0x6f93ae87
lea eax, [ebp - 0x44]
push eax
mov eax, 0x7a810182
sub eax, 0x7a40911e
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x139e7198
sub dword [ebp - 0x44], 0x9f2c0842
mov dword [ebp - 0x40], 0x1e1bbef3
add dword [ebp - 0x40], 0x2350a282
mov dword [ebp - 0x3c], 0x4d06fe02
sub dword [ebp - 0x3c], 0xe9979196
mov dword [ebp - 0x38], 0xe81831fc
add dword [ebp - 0x38], 0x17e7ce04
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x38ee2
push 0
call eax
mov ecx, 0x5156
mov edi, eax
mov esi, 0x39d2e08b
sub esi, 0x3991e08b
add esi, dword [ebp - 0x34]
mov ebx, 0x395db309
xor dword [ebp - 0x20], eax
mov edx, dword [esi]
xor edx, ebx
add dword [ebp - 0x18], 0xf36bcb6b
mov dword [edi], edx
add edi, 0xe9814f9d
add edi, 0x167eb067
add esi, 0xed5d5861
sub esi, 0xed5d585d
loop 0x40299f
add eax, 0x48e19fb3
add eax, 0xb71f9878
xor ebx, ebx
add ebx, eax
add eax, 0x2d8cb90f
sub eax, 0x2d8cb90a
mov ecx, 0x71bdb21
sub ecx, 0x6dbdb21
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x417d5e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x417d6d
pop dword [ebp - 4]
mov eax, 0xf866ecf5
add eax, 0x7da9078
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x3e76b
push 0
mov eax, 0x1ff88525
add eax, 0xe0495cef
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x4b1e
mov edi, eax
mov ebx, 0xf96bb039
add ebx, 0x6d7cfc7
add ebx, dword [ebp - 4]
mov esi, 0xa5b59e7e
mov edx, dword [ebx]
xor edx, esi
mov dword [edi], edx
add edi, 4
add ebx, 4
loop 0x417dc0
add eax, 0x11f4b
xor ebx, ebx
add ebx, eax
add eax, 0xe2c69997
sub eax, 0xe2c69992
mov ecx, 0xf1c50f0c
sub ecx, 0xf1850f0c
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0xe58130
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe5813a
pushal
call 0xe58140
pop ebp
sub ebp, 0x10
sub ebp, 0xa58130
jmp 0xe58156
mov eax, 0xa58130
add eax, ebp
add eax, 0x4c
mov ecx, 0x5be
mov edx, 0x325e72a
xor byte [eax], dl
inc eax
dec ecx
jne 0xe5816d
jmp 0xe58180
mov eax, dword [0x16a3a1e7]
sub ch, byte [edx]
sub ch, byte [ebx + 0x2a2ad2eb]
sub ch, byte [ecx]
out 0x92, eax
sub al, 0x2a
sub ch, byte [edx]
nop
add ch, byte [edx]
sub ch, byte [edx]
invalid