joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x60
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 8], ecx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x80]
mov dword [esp + 0xc], ebx
xor bx, bx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 0x4c], 0
call sym.__ZNSt13__facet_shims11__money_getIwEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb1EEPKNSt6locale5
mov dword [esp + 0x3c], edx
mov ecx, eax
mov edx, ebx
mov dword [esp + 0x38], eax
movzx eax, word [esp + 0x3c]
or edx, eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x4290e8
fld xword [esp + 0x50]
mov eax, dword [esp + 0x8c]
fstp xword [eax]
add esp, 0x60
mov eax, ecx
pop ebx
pop esi
pop edi
ret 0x20
mov ebx, dword [esp + 0x88]
mov dword [ebx], eax
add esp, 0x60
mov eax, ecx
pop ebx
pop esi
pop edi
ret 0x20

Function at 0x429100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x60
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 8], ecx
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x80]
mov dword [esp + 0xc], ebx
xor bx, bx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 0x4c], 0
call sym.__ZNSt13__facet_shims11__money_getIwEESt19istreambuf_iteratorIT_St11char_traitsIS2_EESt17integral_constantIbLb0EEPKNSt6locale5
mov dword [esp + 0x3c], edx
mov ecx, eax
mov edx, ebx
mov dword [esp + 0x38], eax
movzx eax, word [esp + 0x3c]
or edx, eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x4291a8
fld xword [esp + 0x50]
mov eax, dword [esp + 0x8c]
fstp xword [eax]
add esp, 0x60
mov eax, ecx
pop ebx
pop esi
pop edi
ret 0x20
mov ebx, dword [esp + 0x88]
mov dword [ebx], eax
add esp, 0x60
mov eax, ecx
pop ebx
pop esi
pop edi
ret 0x20
Function at 0x4325b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x4d53dc
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x43273d
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x43273d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4dc598
mov dword [esp + 4], 0x4dc29c
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x43273d
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.00434220
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x432710
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x4326c6
test al, al
jne 0x4326e8
cmp dl, al
jne 0x4326d4
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x4326c6
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x4326c6
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x4326b6
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x4326b6
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x432750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x4d53dc
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x4328dd
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x4328dd
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4dc598
mov dword [esp + 4], 0x4dc29c
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x4328dd
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call fcn.00434220
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x4328b0
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x432866
test al, al
jne 0x432888
cmp dl, al
jne 0x432874
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x432866
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x432866
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x432856
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x432856
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x45e930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov edi, dword [esi + 0xc]
mov eax, edi
and eax, 0xffffffb5
or eax, 8
mov dword [esi + 0xc], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t____std::num_get_wchar_t__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____._M_extract_int_unsigned_long__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____std::is
sub esp, 0x1c
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
movzx eax, word [esp + 0x2c]
mov dword [esp + 0x28], edx
mov ecx, edx
mov edx, ebx
mov ebx, dword [esp + 0x3c]
or edx, eax
mov eax, dword [esp + 0x78]
mov dword [esi + 0xc], edi
mov dword [eax], ebx
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
Function at 0x463060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x4d53dc
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x4631ed
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x4631ed
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4dc598
mov dword [esp + 4], 0x4dc29c
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x4631ed
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.00464820
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x4631c0
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x463176
test al, al
jne 0x463198
cmp dl, al
jne 0x463184
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x463176
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x463176
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x463166
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x463166
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x463200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x4d53dc
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x46338d
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x46338d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4dc598
mov dword [esp + 4], 0x4dc29c
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x46338d
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call fcn.00464820
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x463360
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x463316
test al, al
jne 0x463338
cmp dl, al
jne 0x463324
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x463316
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x463316
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x463306
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x463306
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x486cb0
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0x58
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp], eax
mov dword [esp + 0x34], sym.___gxx_personality_sj0
mov dword [esp + 0x38], 0x4d2fc8
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], 0x486d55
mov dword [esp + 0x44], esp
call sym.__Unwind_SjLj_Register
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x20], 1
mov dword [esp], eax
call sym._fileno
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
mov dword [esp], eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sym._read
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x486d40
lea eax, [esp + 0x1c]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x14]
add esp, 0x58
pop ebp
ret 8
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x486d23
jmp 0x486ce4
Function at 0x4cfe80
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], sym.___gxx_personality_sj0
mov dword [esp], esi
mov dword [esp + 0x38], 0x4d0ea4
call sym.__Unwind_SjLj_Register
mov dword [esp + 4], 0
mov dword [esp], 0x4d4344
mov dword [esp + 0x20], 0
call sym._pthread_mutex_init
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x4d4348], 0
mov dword [0x4d434c], 0
mov dword [0x4d4350], 0
call sym._getenv
mov dword [esp + 0x58], 8
mov dword [esp + 0x5c], str.obj_size
mov ebx, eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 9
mov dword [esp + 0x68], str.obj_count
mov dword [esp + 0x6c], 0x40
test eax, eax
je 0x4cfff3
lea esi, [esi]
nop
xor eax, eax
cmp byte [ebx], 0x3a
mov dword [esp + 8], 0xf
sete al
mov dword [esp], str.glibcxx.eh_pool
add ebx, eax
mov dword [esp + 4], ebx
call sym._memcmp
test eax, eax
jne 0x4cff54
cmp byte [ebx + 0xf], 0x2e
je 0x4cffb9
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sym._strchr
mov ebx, eax
test eax, eax
jne 0x4cff28
mov eax, dword [esp + 0x6c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x60]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x4d4350], ebx
test ebx, ebx
jne 0x4d0002
mov dword [esp], sym.___tcf_0
call dbg.atexit
mov dword [esp], esi
call sym.__Unwind_SjLj_Unregister
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
add ebx, 0x10
lea edi, [esp + 0x58]
mov ebp, dword [edi]
mov eax, dword [edi + 4]
test ebp, ebp
je 0x4cffdd
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcmp
test eax, eax
jne 0x4cffe3
cmp byte [ebx + ebp], 0x3d
je 0x4d0024
add edi, 0xc
lea eax, [esp + 0x70]
cmp eax, edi
jne 0x4cffc0
jmp 0x4cff54
mov dword [0x4d4350], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sym._malloc
mov dword [0x4d434c], eax
test eax, eax
je 0x4d0062
xor edx, edx
mov dword [0x4d4348], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x4cff9d
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 0x54]
mov dword [esp + 4], eax
lea eax, [ebx + ebp + 1]
mov dword [esp], eax
call sym._strtoul
mov ebx, dword [esp + 0x54]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x4d0052
test dl, dl
jne 0x4cff54
test eax, eax
js 0x4cff54
mov dword [edi + 8], eax
jmp 0x4cff54
xor ecx, ecx
mov dword [0x4d4350], ecx
jmp 0x4cff9d
Function at 0x403700
Capabilities:
Encode data using xor

Disassembly:
pop eax
sub eax, 0x2d6f
mov edi, eax
mov ecx, 0x928660e
mov edx, 0x928263e
xor ecx, edx
add eax, ecx
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x40
push 0x4d
add edi, 0x71e0
push edi
call ecx
xor eax, eax
test eax, eax
je 0x40373c
jne 0x403732
jmp 0x41bd9f
mov cl, byte [edi + eax]
xor cl, 0x56
mov byte [edi + eax], cl
inc eax
cmp eax, 0x4d
jb 0x40373c
sub esp, 0x10
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0xeee020
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeee02a
pushal
call 0xeee030
pop ebp
sub ebp, 0x10
sub ebp, 0xaee020
jmp 0xeee046
call 0xb9821a53
and al, ah
scasb al, byte es:[edi]
add byte [ebx], al
lds eax, [ecx + 0x4cc0]
add byte [ecx + 0x5ad], bh
mov eax, 0xaee020
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ad
mov edx, 0x86a52ec6
xor byte [eax], dl
inc eax
dec ecx
jne 0xeee05d
jmp 0xeee070
dec ebp
or ecx, dword [ebp + 0x4f]
cli
mov dh, 0xc6
inc edi
pop es
mov dh, 0xc6
lds ecx, [ebx]
jle 0xeee042
mov dh, 0xc6
jl 0xeee075
mov dh, 0xc6
xor dword [eax*8 - 0x35b8b2f2], esp
mov dh, 0xc6
lds eax, [ebx]
xchg esi, eax
dec ebx
mov byte [0xc24f3ae2], al
loop 0xeee04d
invalid
Function at 0x4076c0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x407780
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x4077de
xor ecx, ecx
xor edx, edx
jmp 0x4077be
cmp al, 0x5c
jne 0x407830
add edx, 1
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x4077d3
cmp al, 9
je 0x4077c6
cmp al, 0x20
jne 0x4077a8
test ecx, ecx
je 0x4077d3
xor edx, edx
jmp 0x4077b3
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x4077d0
cmp al, 0x20
je 0x4077d0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x20], 1
jne 0x4077f9
mov word [ebp - 0x1c], 1
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
cmp al, 0x22
jne 0x4077ca
and edx, 1
jne 0x4077ca
xor ecx, 1
jmp 0x4077b3
Function at 0x40224c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 1
push 0x80000000
push str.C:Usersinx.cod
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
lea ecx, [ebp - 8]
mov dword [ebp - 4], eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pushal
mov eax, dword [ebp - 4]
call eax
popal
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x53
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
nop
nop
push ebp
mov ebp, esp
nop
sub eax, 0xffffffff
dec eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4023bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x402409
cmp byte [esi + 0x3d], bl
je 0x402409
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x402438
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x402410
sub eax, 1
je 0x402413
dec eax
sub eax, 1
jne 0x402438
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402430
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00409fe2
add esp, 0x10
cmp edi, eax
jne 0x402438
cmp byte [esi + 0x3d], bl
sete al
jmp 0x40240b
xor al, al
jmp 0x40240b