joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
push edi
push 0x118
mov edi, eax
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00433ff0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ecx
lea edx, [esp + 0x20]
lea esi, [edi + 8]
push edx
mov dword [edi + 4], esi
call fcn.00422d00
add esp, 0x14
test eax, eax
mov dword [esp + 0xc], eax
jne 0x423398
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
add esi, 4
mov edx, dword [ecx]
mov dword [esi - 4], edx
mov edx, dword [ecx + 4]
add ecx, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [edi]
sub edx, 1
add esi, 4
sub ecx, 0x1c
test edx, edx
jle 0x423378
mov edi, edi
mov edi, 4
jmp 0x423310
movzx eax, byte [ecx + 3]
movzx eax, byte [eax + 0x4620e0]
movzx ebx, byte [ecx + 2]
movzx ebx, byte [ebx + 0x4620e0]
mov eax, dword [eax*4 + 0x4621e0]
xor eax, dword [ebx*4 + 0x4625e0]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [ebx + 0x4620e0]
xor eax, dword [ebx*4 + 0x462a08]
mov ebx, dword [ecx]
and ebx, 0xff
movzx ebx, byte [ebx + 0x4620e0]
xor eax, dword [ebx*4 + 0x462e08]
add esi, 4
mov dword [esi - 4], eax
add ecx, 4
sub edi, 1
jne 0x423310
sub edx, 1
sub ecx, 0x20
test edx, edx
jg 0x423300
mov eax, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add esi, 4
add ecx, 4
mov dword [esi], edx
mov ecx, dword [ecx + 4]
mov dword [esi + 4], ecx
mov ecx, 0x118
lea edx, [esp + 0x10]
sub ecx, 1
mov byte [edx], 0
add edx, 1
test ecx, ecx
jne 0x4233a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
test al, 7
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
mov ebx, edx
je 0x42499c
mov eax, 0xffffffce
pop edi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 1
jne 0x424a3d
test eax, eax
jbe 0x424ab6
add eax, 0xffffffff
shr eax, 3
add eax, 1
mov dword [esp + 0xc], eax
movzx edx, byte [ebx]
xor dl, byte [esi]
mov byte [edi], dl
movzx eax, byte [ebx + 1]
xor al, byte [esi + 1]
mov byte [edi + 1], al
movzx ecx, byte [ebx + 2]
xor cl, byte [esi + 2]
mov byte [edi + 2], cl
movzx edx, byte [ebx + 3]
xor dl, byte [esi + 3]
mov byte [edi + 3], dl
movzx eax, byte [ebx + 4]
xor al, byte [esi + 4]
mov byte [edi + 4], al
movzx ecx, byte [ebx + 5]
xor cl, byte [esi + 5]
mov byte [edi + 5], cl
movzx edx, byte [ebx + 6]
xor dl, byte [esi + 6]
mov byte [edi + 6], dl
movzx eax, byte [ebx + 7]
xor al, byte [esi + 7]
mov edx, dword [esp + 0x10]
mov byte [edi + 7], al
mov eax, edi
call fcn.00424700
mov ecx, dword [edi]
mov dword [esi], ecx
mov edx, dword [edi + 4]
add ebx, 8
add edi, 8
sub dword [esp + 0xc], 1
mov dword [esi + 4], edx
jne 0x4249bb
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret
test eax, eax
jbe 0x424ab6
add eax, 0xffffffff
shr eax, 3
add eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, ebx
mov dword [esp + 0x18], ecx
call fcn.00424700
movzx edx, byte [esi]
xor byte [edi], dl
movzx eax, byte [esi + 1]
xor byte [edi + 1], al
movzx ecx, byte [esi + 2]
xor byte [edi + 2], cl
movzx edx, byte [esi + 3]
xor byte [edi + 3], dl
movzx eax, byte [esi + 4]
xor byte [edi + 4], al
movzx ecx, byte [esi + 5]
xor byte [edi + 5], cl
movzx edx, byte [esi + 6]
xor byte [edi + 6], dl
movzx eax, byte [esi + 7]
xor byte [edi + 7], al
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add ebx, 8
add edi, 8
sub dword [esp + 0xc], 1
mov dword [esi], ecx
mov dword [esi + 4], edx
jne 0x424a4e
mov ecx, dword [esp + 0x1c]
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043244e
mov esp, ebp
pop ebp
ret
Function at 0x424f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
test al, 7
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
mov ebx, edx
je 0x424f9c
mov eax, 0xffffffce
pop edi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 1
jne 0x42503d
test eax, eax
jbe 0x4250b6
add eax, 0xffffffff
shr eax, 3
add eax, 1
mov dword [esp + 0xc], eax
movzx edx, byte [ebx]
xor dl, byte [esi]
mov byte [edi], dl
movzx eax, byte [ebx + 1]
xor al, byte [esi + 1]
mov byte [edi + 1], al
movzx ecx, byte [ebx + 2]
xor cl, byte [esi + 2]
mov byte [edi + 2], cl
movzx edx, byte [ebx + 3]
xor dl, byte [esi + 3]
mov byte [edi + 3], dl
movzx eax, byte [ebx + 4]
xor al, byte [esi + 4]
mov byte [edi + 4], al
movzx ecx, byte [ebx + 5]
xor cl, byte [esi + 5]
mov byte [edi + 5], cl
movzx edx, byte [ebx + 6]
xor dl, byte [esi + 6]
mov ecx, edi
mov byte [edi + 6], dl
movzx eax, byte [ebx + 7]
xor al, byte [esi + 7]
mov byte [edi + 7], al
mov eax, dword [esp + 0x10]
call fcn.00424ad0
mov ecx, dword [edi]
mov dword [esi], ecx
mov edx, dword [edi + 4]
add ebx, 8
add edi, 8
sub dword [esp + 0xc], 1
mov dword [esi + 4], edx
jne 0x424fbb
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret
test eax, eax
jbe 0x4250b6
add eax, 0xffffffff
shr eax, 3
add eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov ecx, ebx
call fcn.00424ad0
movzx edx, byte [esi]
xor byte [edi], dl
movzx eax, byte [esi + 1]
xor byte [edi + 1], al
movzx ecx, byte [esi + 2]
xor byte [edi + 2], cl
movzx edx, byte [esi + 3]
xor byte [edi + 3], dl
movzx eax, byte [esi + 4]
xor byte [edi + 4], al
movzx ecx, byte [esi + 5]
xor byte [edi + 5], cl
movzx edx, byte [esi + 6]
xor byte [edi + 6], dl
movzx eax, byte [esi + 7]
xor byte [edi + 7], al
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add ebx, 8
add edi, 8
sub dword [esp + 0xc], 1
mov dword [esi], ecx
mov dword [esi + 4], edx
jne 0x42504e
mov ecx, dword [esp + 0x1c]
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043244e
mov esp, ebp
pop ebp
ret
Function at 0x425b20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0xdc], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0xd8
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00433ff0
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
je 0x425b9a
push edi
lea ecx, [esp + 0xc]
call fcn.00425960
add esp, 4
push esi
lea esi, [esp + 0xc]
call fcn.004259f0
add esp, 4
mov eax, 0xd8
mov ecx, esi
mov edi, edi
sub eax, 1
mov byte [ecx], 0
add ecx, 1
test eax, eax
jne 0x425bb0
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret

Function at 0x425be0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4e0
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x4dc], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x459108
push eax
mov esi, ecx
call fcn.00438ae5
mov edi, eax
add esp, 8
test edi, edi
je 0x425ce3
push 0xd8
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00433ff0
push edi
push 0x400
lea ecx, [esp + 0xf4]
push 1
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
call fcn.00438466
add esp, 0x1c
test eax, eax
jbe 0x425ca6
lea edx, [esp + 0xe0]
push edx
lea ecx, [esp + 0xc]
call fcn.00425960
add esp, 4
push edi
push 0x400
lea eax, [esp + 0xe8]
push 1
push eax
call fcn.00438466
add esp, 0x10
test eax, eax
ja 0x425c76
push esi
lea esi, [esp + 0xc]
call fcn.004259f0
add esp, 4
mov eax, 0xd8
mov ecx, esi
lea ebx, [ebx]
sub eax, 1
mov byte [ecx], 0
add ecx, 1
test eax, eax
jne 0x425cc0
push edi
call fcn.0043885a
add esp, 4
test eax, eax
push edi
je 0x425cfc
call fcn.004352b8
add esp, 4
mov eax, 0xffffff8c
pop edi
pop esi
mov ecx, dword [esp + 0x4dc]
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret
call fcn.004352b8
mov ecx, dword [esp + 0x4e8]
add esp, 4
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0043244e
mov esp, ebp
pop ebp
ret
Function at 0x425d20
Capabilities:
Authenticate hmac
Encode data using xor
Hash data with md5

Disassembly:
sub esp, 0x18
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, ecx
cmp edi, 0x40
mov ebx, edx
jbe 0x425d57
lea eax, [esp + 0x14]
push eax
push edi
push ebp
call fcn.00425b20
add esp, 0xc
mov edi, 0x10
lea ebp, [esp + 0x14]
push 0x40
lea eax, [ebx + 0x58]
push 0x36
push eax
call fcn.00433ff0
push 0x40
lea esi, [ebx + 0x98]
push 0x5c
push esi
call fcn.00433ff0
add esp, 0x18
test edi, edi
jbe 0x425d94
mov eax, esi
mov esi, ebp
nop
mov cl, byte [esi]
xor byte [eax - 0x40], cl
mov dl, byte [esi]
xor byte [eax], dl
add esi, 1
add eax, 1
sub edi, 1
jne 0x425d80
lea eax, [ebx + 0x58]
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx], 0x40
call fcn.004250d0
mov eax, 0x10
lea ecx, [esp + 0x14]
mov edi, edi
sub eax, 1
mov byte [ecx], 0
add ecx, 1
test eax, eax
jne 0x425dd0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043244e
add esp, 0x18
ret

Function at 0x425df0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x14
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
call fcn.004259f0
lea ecx, [esi + 0x98]
push ecx
mov eax, 0x40
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
call fcn.00425960
lea edx, [esp + 0xc]
push edx
mov eax, 0x10
mov ecx, esi
call fcn.00425960
push edi
call fcn.004259f0
add esp, 0x10
mov eax, 0x10
lea ecx, [esp + 4]
pop esi
jmp 0x425e70
sub eax, 1
mov byte [ecx], 0
add ecx, 1
test eax, eax
jne 0x425e70
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0043244e
add esp, 0x14
ret
Function at 0x42b5a0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
test ecx, ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0xe8], ecx
jne 0x42b5f0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
ret
Function at 0x42e650
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, edx
mov dword [esp + 0x10], 0x10
lea ecx, [ecx]
xor ecx, dword [edi]
add edi, 4
mov eax, ecx
shr eax, 8
movzx ebx, al
movzx ebp, cl
shr eax, 8
mov dword [esp + 0x14], ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
mov ecx, dword [edx + ecx*4 + 0x48]
movzx eax, al
add ecx, dword [edx + eax*4 + 0x448]
movzx eax, word [esp + 0x14]
xor ecx, dword [edx + eax*4 + 0x848]
movzx eax, bp
add ecx, dword [edx + eax*4 + 0xc48]
xor ecx, esi
sub dword [esp + 0x10], 1
mov esi, ebx
jne 0x42e670
mov eax, dword [edx + 0x44]
mov esi, dword [esp + 0x1c]
mov edx, dword [edx + 0x40]
xor eax, ebx
pop edi
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
pop esi
xor edx, ecx
pop ebp
mov dword [eax], edx
pop ebx
add esp, 8
ret

Function at 0x42e6f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
lea edi, [edx + 0x44]
mov dword [esp + 0x10], 0x10
mov edi, edi
xor ecx, dword [edi]
sub edi, 4
mov eax, ecx
shr eax, 8
movzx ebx, al
movzx ebp, cl
shr eax, 8
mov dword [esp + 0x14], ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
mov ecx, dword [edx + ecx*4 + 0x48]
movzx eax, al
add ecx, dword [edx + eax*4 + 0x448]
movzx eax, word [esp + 0x14]
xor ecx, dword [edx + eax*4 + 0x848]
movzx eax, bp
add ecx, dword [edx + eax*4 + 0xc48]
xor ecx, esi
sub dword [esp + 0x10], 1
mov esi, ebx
jne 0x42e710
mov eax, dword [edx]
mov esi, dword [esp + 0x1c]
mov edx, dword [edx + 4]
xor eax, ebx
pop edi
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
pop esi
xor edx, ecx
pop ebp
mov dword [eax], edx
pop ebx
add esp, 8
ret
Function at 0x42e78e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, eax
lea eax, [ebx - 0x20]
cmp eax, 0x1a0
push esi
mov esi, ecx
ja 0x42e8c8
test bl, 7
jne 0x42e8c8
mov ecx, dword [esp + 0x14]
push ebp
push edi
shr ebx, 3
mov eax, 0x450270
add ecx, 0x48
mov edi, 4
mov edx, 0x100
jmp 0x42e7c0
mov ebp, dword [eax]
mov dword [ecx], ebp
add eax, 4
add ecx, 4
sub edx, 1
jne 0x42e7c0
sub edi, 1
jne 0x42e7b6
mov ebp, dword [esp + 0x1c]
mov ecx, 0x450228
xor eax, eax
sub ecx, ebp
mov edi, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0x12
nop
movzx ecx, byte [eax + esi]
add eax, 1
cmp eax, ebx
jb 0x42e7fd
xor eax, eax
movzx edx, byte [eax + esi]
shl ecx, 8
add eax, 1
or edx, ecx
cmp eax, ebx
jb 0x42e80f
xor eax, eax
movzx ecx, byte [eax + esi]
shl edx, 8
add eax, 1
or ecx, edx
cmp eax, ebx
jb 0x42e821
xor eax, eax
movzx edx, byte [eax + esi]
shl ecx, 8
add eax, 1
or edx, ecx
cmp eax, ebx
jb 0x42e833
xor eax, eax
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + edi]
xor ecx, edx
mov dword [edi], ecx
add edi, 4
sub dword [esp + 0x14], 1
jne 0x42e7f0
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
mov edx, ebp
call fcn.0042e650
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebp + esi*4], ecx
mov dword [ebp + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jb 0x42e852
lea esi, [ebp + 0x4c]
mov ebx, 4
mov edi, 0x80
jmp 0x42e890
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
mov edx, ebp
call fcn.0042e650
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 8
add esi, 8
sub edi, 1
jne 0x42e890
sub ebx, 1
jne 0x42e886
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
pop esi
mov eax, 0xffffffea
pop ebx
add esp, 8
ret
Function at 0x42e990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
test al, 7
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
mov ebx, edx
je 0x42e9cc
mov eax, 0xffffffe8
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
jne 0x42ea6b
test eax, eax
jbe 0x42eaf6
add eax, 0xffffffff
shr eax, 3
add eax, 1
mov dword [esp + 0xc], eax
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
push 0
mov eax, ebx
call fcn.0042e8e0
movzx ecx, byte [edi]
xor byte [esi], cl
movzx edx, byte [edi + 1]
xor byte [esi + 1], dl
movzx eax, byte [edi + 2]
xor byte [esi + 2], al
movzx ecx, byte [edi + 3]
xor byte [esi + 3], cl
movzx edx, byte [edi + 4]
xor byte [esi + 4], dl
movzx eax, byte [edi + 5]
xor byte [esi + 5], al
movzx ecx, byte [edi + 6]
xor byte [esi + 6], cl
movzx edx, byte [edi + 7]
xor byte [esi + 7], dl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esp, 4
add ebx, 8
add esi, 8
sub dword [esp + 0xc], 1
mov dword [edi], eax
mov dword [edi + 4], ecx
jne 0x42e9eb
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret
test eax, eax
jbe 0x42eaf6
add eax, 0xffffffff
shr eax, 3
add eax, 1
mov dword [esp + 0xc], eax
movzx edx, byte [ebx]
xor dl, byte [edi]
mov byte [esi], dl
movzx eax, byte [ebx + 1]
xor al, byte [edi + 1]
mov byte [esi + 1], al
movzx ecx, byte [ebx + 2]
xor cl, byte [edi + 2]
mov byte [esi + 2], cl
movzx edx, byte [ebx + 3]
xor dl, byte [edi + 3]
mov byte [esi + 3], dl
movzx eax, byte [ebx + 4]
xor al, byte [edi + 4]
mov byte [esi + 4], al
movzx ecx, byte [ebx + 5]
xor cl, byte [edi + 5]
mov byte [esi + 5], cl
movzx edx, byte [ebx + 6]
xor dl, byte [edi + 6]
mov ecx, dword [ebp + 8]
mov byte [esi + 6], dl
movzx eax, byte [ebx + 7]
xor al, byte [edi + 7]
mov edx, dword [esp + 0x10]
mov byte [esi + 7], al
push ecx
mov eax, esi
call fcn.0042e8e0
mov edx, dword [esi]
mov dword [edi], edx
mov eax, dword [esi + 4]
add esp, 4
add ebx, 8
add esi, 8
sub dword [esp + 0xc], 1
mov dword [edi + 4], eax
jne 0x42ea80
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043244e
mov esp, ebp
pop ebp
ret
Function at 0x4305e5
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x45f2c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00430524
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00433ff0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x430634
cmp dword [ebp - 0x1c], 5
jb 0x43064c
jmp 0x430648
cmp dword [ebp - 0x10], 1
jne 0x43064c
cmp dword [ebp - 0x1c], 4
ja 0x430648
jne 0x43064c
cmp dword [ebp - 0x18], 0
jbe 0x43064c
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44d3a8
call fcn.0040abf0
test eax, eax
jge 0x43066d
mov byte [0x46450c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043244e
add ebp, 0x78
leave
ret

Function at 0x43244e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45f2c0]
jne 0x432458
repz ret
jmp fcn.00439465
Function at 0x4381ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x438207
cmp dword [ebp + 0x14], edi
je 0x438207
cmp ecx, edi
jne 0x43820e
call fcn.00439421
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00432563
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x438222
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x438243
cmp ebx, 0xffffffff
je 0x438232
push ebx
push edi
push ecx
call fcn.00433ff0
add esp, 0xc
cmp esi, edi
je 0x4381ef
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4381ef
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43825f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x438266
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x438357
test word [esi + 0xc], 0x10c
je 0x4382ba
mov eax, dword [esi + 4]
test eax, eax
je 0x4382ba
jl 0x4383b8
cmp ebx, eax
mov edi, ebx
jb 0x43828b
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x43835f
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004323d3
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x43834f
cmp ebx, dword [ebp - 0xc]
jb 0x438327
cmp dword [ebp - 0xc], 0
je 0x4382e4
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x4382d9
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4382e0
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4382ef
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x4382ef
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x43838b
push eax
push dword [ebp - 8]
push esi
call fcn.0043e3fc
pop ecx
push eax
call fcn.0044308d
add esp, 0xc
test eax, eax
je 0x4383ca
cmp eax, 0xffffffff
je 0x4383b8
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43834f
push esi
call fcn.0043e2dc
cmp eax, 0xffffffff
pop ecx
je 0x4383bc
cmp dword [ebp - 4], 0
je 0x43838b
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43826e
mov eax, dword [ebp + 0x14]
jmp 0x438209
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x438376
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00433ff0
add esp, 0xc
call fcn.00439421
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4381ff
cmp dword [ebp + 0xc], 0xffffffff
je 0x4383a1
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00433ff0
add esp, 0xc
call fcn.00439421
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4381ff
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x438209
or dword [esi + 0xc], 0x10
jmp 0x4383bc
Function at 0x439bca
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x45f708]
je 0x439be5
inc edi
cmp edi, 0x17
jb 0x439bd6
cmp edi, 0x17
jae 0x439d65
push ebp
push 3
call fcn.0044531f
cmp eax, 1
pop ecx
je 0x439d31
push 3
call fcn.0044531f
test eax, eax
pop ecx
jne 0x439c19
cmp dword [0x45f2b0], 1
je 0x439d31
cmp ebx, 0xfc
je 0x439d64
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x461810
push ebp
call fcn.00433ca7
add esp, 0xc
test eax, eax
je 0x439c4f
push esi
push esi
push esi
push esi
push esi
call fcn.00432467
add esp, 0x14
push 0x104
mov esi, 0x461829
push esi
push 0
mov byte [0x46192d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x439c93
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00433ca7
add esp, 0xc
test eax, eax
je 0x439c93
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00432467
add esp, 0x14
push esi
call fcn.00434270
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x439cd8
push esi
call fcn.00434270
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x461b24
push 0x44e4dc
sub ecx, eax
push ecx
push eax
call fcn.00440626
add esp, 0x14
test eax, eax
je 0x439cd8
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00432467
add esp, 0x14
jmp 0x439cda
xor esi, esi
push 0x44e4d8
push ebx
push ebp
call fcn.00440564
add esp, 0xc
test eax, eax
je 0x439cfa
push esi
push esi
push esi
push esi
push esi
call fcn.00432467
add esp, 0x14
push dword [edi*8 + 0x45f70c]
push ebx
push ebp
call fcn.00440564
add esp, 0xc
test eax, eax
je 0x439d1c
push esi
push esi
push esi
push esi
push esi
call fcn.00432467
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00445162
add esp, 0xc
jmp 0x439d64
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x439d64
cmp ebp, 0xffffffff
je 0x439d64
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x45f70c]
push dword [esi]
call fcn.00434270
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret