joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x869008], 0x8088405
inc edx
mov dword [ebx + 0x869008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e5a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x850a63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e655
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e63e
test esi, esi
jbe 0x41e655
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e630
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e655
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e60d
jmp 0x41e655
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e655
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x850a6a
ret
Function at 0x41eec4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x851473
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eeff
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ef18
lea eax, [ebp - 0x10]
mov edx, dword [0x86b2a4]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ef2b
lea eax, [ebp - 0x10]
mov edx, dword [0x86b2a4]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ef37
adc edx, 0
mov edx, dword [edx*4 + 0x86a10c]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41f045
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41f038
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41f038
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41f038
cmp dx, 0x150
ja 0x41f038
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41f038
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41f05d
inc ebx
cmp ebx, 0x19
jne 0x41eef1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x85147a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x422230
Capabilities:
Get disk information
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x49e044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [edi + 4], eax
lea esi, [edi + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
test edx, edx
je 0x422261
mov byte [edx], al
push str.rpcrt4.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x42227f
push str.rpcrt4.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4222a6
push str.UuidCreateSequential
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4222a6
lea ecx, [ebp - 0x1c]
push ecx
call eax
test eax, eax
jne 0x4222a6
mov eax, dword [ebp - 0x12]
mov dword [esi], eax
mov ax, word [ebp - 0xe]
mov word [esi + 4], ax
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 0xa]
push eax
push 0
push 0
push 0x48d728
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0xe
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf0], 0x67452301
push edi
push eax
mov dword [ebp - 0xec], 0xefcdab89
mov dword [ebp - 0xe8], 0x98badcfe
mov dword [ebp - 0xe4], 0x10325476
mov dword [ebp - 0xe0], 0xc3d2e1f0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
call fcn.0043ddc0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0043de60
push 0xa
lea eax, [ebp - 0x110]
mov dword [ebp - 0x78], 0x67452301
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x74], 0xefcdab89
push eax
mov dword [ebp - 0x70], 0x98badcfe
mov dword [ebp - 0x6c], 0x10325476
mov dword [ebp - 0x68], 0xc3d2e1f0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
call fcn.0043ddc0
add esp, 0x14
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0043de60
lea eax, [ebp - 0x98]
add esp, 8
cmp esi, eax
je 0x4223d0
mov eax, dword [ebp - 0x98]
mov dword [esi], eax
mov eax, dword [ebp - 0x94]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x90]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x8c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x88]
mov dword [esi + 0x10], eax
push 4
lea eax, [ebp - 0x170]
mov dword [ebp - 0x168], 0x67452301
push edi
push eax
mov dword [ebp - 0x164], 0xefcdab89
mov dword [ebp - 0x160], 0x98badcfe
mov dword [ebp - 0x15c], 0x10325476
mov dword [ebp - 0x158], 0xc3d2e1f0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
call fcn.0043ddc0
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.0043de60
add esp, 8
lea ecx, [ebp - 0x188]
mov edx, 5
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add dword [esi], eax
lea esi, [esi + 4]
sub edx, 1
jne 0x422453
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004528ff
mov esp, ebp
pop ebp
ret
Function at 0x422500
Capabilities:
Check if file exists
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476e97
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x49e044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x428], esi
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x42c], esi
push 0
mov dword [ebp - 0x424], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x48d72c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, eax
mov dword [esi], 0
mov ecx, edx
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4225b0
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00416e00
mov dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x424], 1
jb 0x4225e3
mov eax, dword [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
setne cl
test eax, eax
jne 0x422615
push 4
push str..old
mov ecx, esi
call fcn.0041e150
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x42260d
mov eax, dword [esi]
push eax
call edi
test eax, eax
setne cl
test cl, cl
jne 0x4226c0
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4226bb
cmp dword [0x49ef94], 8
mov eax, 0x49ef80
jb 0x42264b
mov eax, dword [0x49ef80]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, eax
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422667
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00416e00
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x422689
mov eax, dword [esi]
push 0x48d72c
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, eax
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4226a3
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00416e00
mov byte [ebx], 0
jmp 0x4226d9
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4226ca
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
sete al
or byte [ebx], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004528ff
mov esp, ebp
pop ebp
ret
Function at 0x413370
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x4134f8
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x41339a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4133a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413390
mov eax, 1
add ebx, ebx
jne 0x4133b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4133a8
jne 0x4133c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4133a8
xor ecx, ecx
sub eax, 3
jb 0x4133d8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41344a
mov ebp, eax
add ebx, ebx
jne 0x4133e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4133f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x413414
inc ecx
add ebx, ebx
jne 0x413400
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4133f5
jne 0x413411
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4133f5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413434
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413425
jmp 0x413396
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413434
add edi, ecx
jmp 0x413396
pop esi
mov edi, esi
mov ecx, 0x472
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413452
cmp byte [edi], 1
jne 0x413452
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x413457
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x4134c6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x131e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1324c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413484
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13250]
or eax, eax
je 0x4134c0
mov dword [ebx], eax
add ebx, 4
jmp 0x4134a1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4134f7
cmp al, 0xef
ja 0x4134ea
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4134cc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4134d9
popal
jmp 0x40b884
Function at 0x10388035
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
lea esp, [esp + 0xc]
jb 0x102c7686
jbe 0x10387f3c
bt cx, 0xc
pushal
pushal
cmp ah, 0x5a
jmp 0x102bcbdd
pushfd
lea esp, [esp + 0x44]
ja 0x102c7686
call fcn.10303697
invalid
push esp
clc
test dl, 0x8d
cmp ah, 0x5a
pushal
pushfd
mov word [esp + 0xc], 0xd52f
lea esp, [esp + 0x28]
ja 0x102c7686
call fcn.1038b2c6
push dword [esp]
lea esp, [esp + 8]
jae 0x10387a73
pushfd
cmp eax, 0x7f
pushfd
call fcn.1028fc53
js 0x10387f3d
or al, 0xeb
sub ah, byte [ebx + 0x79]
pop ss
jae 0x10387fc9
push 0xeb3ad341
mov dword [0x714de9f], eax
mov al, byte [0xb5c00d5c]
or byte [esi], ch
sub eax, 0x9636222a
into
outsb dx, byte [esi]
inc edx
push esp
sal byte [esp + ebp*4 - 0x343248c6], 1
iretd
daa
adc ebx, esp
arpl word [esp + ebp*4], ax
add al, 0x60
and eax, 0xb9a0e338
cmp dword [ecx - 0x5e5a677b], eax
mov esi, 0x64293765
das
cmp bl, ah
mov al, byte [0x858139b9]
cwde
movsd dword es:[edi], dword [esi]
mov eax, dword [0x293765be]
das
sub dword [edi + ebp - 0x1e], esp
xor bh, byte [eax]
jo 0x10388011
loop 0x10388016
cmp byte [eax + 0x2a], dh
sbb eax, 0x55c5e00b
add al, 0xf2
ret
push esi
out 0xb9, eax
stc
sbb byte [edx], ah
push ebx
and ch, byte [esi]
push ebx
dec ebp
push 0x41
xor dword [ebp - 0x4a], edi
xor ch, byte [eax]
aad 0x51
and edx, dword [ebx]
add dword [ebp + 0x42cd8c5d], eax
mov ebp, 0x237ef119
mov ah, 0x79
sub ebp, eax
call 0x10389088
test eax, 0x2a0bece6
arpl word [ecx - 9], di
push ebx
sub ebx, eax
jbe 0x10387fdf
in eax, 0xd
jg 0x10387fd4
and ah, dh
cdq
add al, 0x17
js 0x10387fd2
push ebx
fcom st(6)
ja 0x1038807d
invalid
add al, 8
and al, 0xa2
bound esi, qword [ebp - 0x68]
movsd dword es:[edi], dword [esi]
mov edx, 0xacdffd1f
invalid
xor esp, ebx
scasb al, byte es:[edi]
in al, 0xc9
jecxz 0x1038805e
push edi
adc edi, ebx
aas
push ecx
add byte [edx], 0x2c
sub al, 0x81
xor esi, ecx
in eax, 0xb7
imul ebp, dword [eax - 0x4db86729], 0x73dbebec
sub al, 0x89
xchg ebp, eax
mov bl, 0x80
push 0x3dee5138
loop 0x10388103
xchg byte [esi - 1], ch
xor al, 0x24
or al, 0xf
test byte [esi - 0x17000006], bh
out dx, al
aam 0
add byte [edx], dl
imul esi, edi, 0x46
sub byte [ebx + 0x79], ah
mov edi, 0x34a64d9
out 0x72, al
pop ebx
add ch, byte [eax]
invalid
jmp 0x1028ffb7
Function at 0x10397649
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ah
sub bp, di
mov ebp, esp
cwde
rcl ah, 7
movsx ax, cl
sub esp, 0x18
push edi
mov dword [esp], esi
rcl al, cl
cwde
push edi
setno al
push ebx
sal al, cl
push edx
rol eax, 0x12
mov eax, dword [ebp + 8]
stc
cmp edx, 0xdfadb45f
bt esi, esp
test eax, eax
pushal
lea esp, [esp + 0x20]
je 0x1028b927
bsr si, sp
sbb edx, eax
shr dh, cl
cmc
mov esi, dword [eax + 0x3c]
shr dl, 6
dec dh
cmp dh, 0x84
push ebp
add esi, eax
dec dh
pop edx
shrd edx, eax, 0x1a
mov edx, dword [esi + 0x78]
bt esi, edi
pushal
test edx, edx
mov byte [esp + 0xc], cl
pushal
lea esp, [esp + 0x40]
jno 0x10385c4e
pushfd
lea esp, [esp + 4]
je 0x1028b927
shrd cx, bx, 0xc
pushfd
adc cx, 0x850a
add edx, eax
bt di, bp
clc
cmp sp, 0x82ed
cmp dl, 0xa5
mov ecx, dword [esi + 0x7c]
mov byte [esp], 0x19
add ecx, edx
cmp bl, bl
mov dword [ebp - 0x10], ecx
bsr cx, cx
mov ecx, dword [ebp + 0xc]
pushal
pushfd
cmp ecx, 0xffff
pushfd
jmp 0x1029011f
call fcn.10394a6f
push esi
das
push cs
dec esi
arpl word [ecx - 9], di
push es
out dx, al
ror ch, 0xd0
mov edi, 0xa09de994
mov byte [0x8957b35b], al
jmp 0xc6eb7d9a
sub ah, 0x6d
push ebp
movzx ax, cl
adc ah, dl
jbe 0x1028f71f
mov ebp, esp
cwde
adc ah, 0xc
sub esp, 0x18
shrd ax, bx, 0xd
jmp 0x10389d1b
Function at 0x401e50
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, dword [esp + 0x44]
mov eax, dword [0xbf9370]
xor eax, esp
mov dword [esp + 0x2c], eax
cmp ebx, 0xffffffff
je 0x401f2c
mov esi, ecx
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x401e98
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
test ecx, ecx
jle 0x401e98
add ecx, 0xffffffff
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
lea edx, [ecx + 1]
mov dword [eax], edx
mov byte [ecx], bl
jmp 0x401f7f
cmp dword [esi + 0x4c], 0
je 0x401f30
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x3c]
cmp dword [eax], ecx
jne 0x401ec0
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x401f37
mov byte [esp + 0xb], bl
lea edi, [esi + 0x40]
mov ebp, dword [ecx]
mov edx, esp
lea eax, [esp + 0xc]
push edx
lea edx, [esp + 0x30]
push edx
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1f]
push eax
push edi
call dword [ebp + 0x1c]
mov edi, 0xffffffff
cmp eax, 2
jae 0x401f5e
mov ebp, dword [esp]
lea eax, [esp + 0xc]
sub ebp, eax
je 0x401f19
push dword [esi + 0x4c]
push ebp
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebp, eax
jne 0x401f7d
mov byte [esi + 0x3d], 1
lea eax, [esp + 0xb]
cmp dword [esp + 4], eax
mov eax, 0xffffffff
jmp 0x401f78
xor ebx, ebx
jmp 0x401f7f
mov ebx, 0xffffffff
jmp 0x401f7f
movsx eax, bl
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
mov esi, eax
cmp eax, 0xffffffff
cmovne esi, ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004035fc
mov eax, esi
jmp 0x401f8c
cmp eax, 3
jne 0x401f7d
movsx eax, byte [esp + 0xb]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
mov edi, ebx
mov ebx, edi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004035fc
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4023b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
cmp esi, 1
mov eax, ecx
sbb eax, 0
jl 0x4023e0
cmp dword [ebx + 0x38], 0
je 0x4023e9
mov ecx, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
xor eax, eax
xor edx, edx
jmp 0x40249b
mov dword [esp], ecx
mov ebp, dword [esp + 0x1c]
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 4], esi
je 0x402424
mov ecx, dword [ebx + 0x2c]
mov edi, dword [ecx]
test edi, edi
je 0x402424
cmp edi, esi
cmovae edi, esi
push edi
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add ebp, edi
sub esi, edi
mov eax, dword [ebx + 0x2c]
sub dword [eax], edi
mov eax, dword [ebx + 0x1c]
add dword [eax], edi
cmp dword [ebx + 0x4c], 0
je 0x40248f
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 0x3c]
cmp dword [eax], ecx
jne 0x402448
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x54]
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop
cmp esi, 0x1000
jb 0x402475
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call edi
add esp, 0x10
add ebp, eax
sub esi, eax
cmp eax, 0xfff
je 0x402450
jmp 0x40248f
test esi, esi
je 0x40248d
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
jmp 0x40248f
xor esi, esi
mov eax, dword [esp + 4]
sub eax, esi
mov edx, dword [esp]
sbb edx, 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc