joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bcac
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40bd49
push ebx
push esi
call fcn.0040bc75
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bc0b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bcf6
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bd48
push edi
push eax
call fcn.00408aa0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40bd16
call fcn.004080b0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bd47
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bc0b
add esp, 0x20
test eax, eax
jne 0x40bd35
push edi
call fcn.004080b0
jmp 0x40bd3d
push ebx
call fcn.004080b0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41035b
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x410375
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x41038c
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x4103e4
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.0040c3f9
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x4103e4
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4103e4
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4103e4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x4103de
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x4103e0
xor bl, bl
mov al, bl
jmp 0x4103e6
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x414160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41418d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41418d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x473a90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa498
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4cf084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x473acb
mov eax, dword [edi]
jmp 0x473acd
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x473af3
test esi, esi
je 0x473aec
mov dword [esi], 0
call fcn.00472b40
mov dword [esi + 4], eax
mov al, 1
jmp 0x473b79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x64], 0
call fcn.00472b40
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.004749f0
add esp, 0xc
cmp dword [ebp - 0x6c], 3
sete al
test al, al
je 0x473b37
test esi, esi
je 0x473b77
mov dword [esi], 0
call fcn.00472b40
jmp 0x473b74
test esi, esi
jne 0x473b6d
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x28]
call fcn.0046fd80
mov dword [ebp - 4], esi
call fcn.00472b40
push eax
push ebx
push edi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00472e10
push 0x4cb9c4
lea eax, [ebp - 0x5c]
push eax
call fcn.004796a3
call fcn.00472b40
mov dword [esi], ebx
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret
Function at 0x4749f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa682
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4cf084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x474a31
mov eax, dword [edi]
jmp 0x474a33
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x474a52
push esi
push edi
push ebx
call fcn.004741c0
add esp, 0xc
jmp 0x474b4e
test eax, 0x400
je 0x474b0d
cmp dword [edi + 0x14], 8
jb 0x474a67
mov eax, dword [edi]
jmp 0x474a69
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.00473010
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00430950
cmp esi, 0xffffffff
jne 0x474ac2
push dword [ebp - 0x34]
push edi
push ebx
call fcn.004741c0
add esp, 0xc
jmp 0x474b4e
push edi
call fcn.00473d30
add esp, 4
test al, al
jne 0x474af5
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.00473e10
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x474b4e
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x474b1f
mov dword [esi], 0
call fcn.00472b40
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x474b36
mov dword [ebp - 0x30], 2
call fcn.00473e10
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret

Function at 0x495547
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x495582
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x495569
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x49557a
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x495584
inc edi
add eax, 0x28
cmp edi, esi
jb 0x49555f
xor eax, eax
pop edi
pop esi
ret
Function at 0x496435
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38

Function at 0x49648b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00495517

Function at 0x498755
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004985d4
Function at 0x404292
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404de1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x408460]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x2c], edi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x14], ecx
mov cl, byte [ebp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], edi
test cl, cl
jne 0x404365
mov dword [ebp + 0x28], edi
test eax, eax
je 0x404332
lea ecx, [edx + 0xc]
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
jbe 0x40431c
mov edi, eax
add ecx, 0x10
dec edx
jne 0x404314
mov dword [ebp + 0x28], edi
mov eax, 0x406784
cmp edi, 0x100000
ja 0x404335
lea eax, [ebp + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.00404a32
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x40435b
push eax
call fcn.00404ac8
add esp, 4
mov dword [esi + 0x24], edi
push 0
call fcn.00404ac8
add esp, 4
xor ecx, ecx
mov eax, ebx
mov edx, 0x44
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00404a32
add esp, 4
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4043b1
push 0x402640
push 0x402600
push ebx
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebx
call fcn.00404b8f
jmp 0x4043b3
xor edi, edi
mov eax, dword [esi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x4043e2
test eax, eax
je 0x4043df
mov ecx, dword [eax - 4]
lea ebx, [eax - 4]
push 0x402640
push ecx
push 0x44
push eax
call fcn.00404b2c
push ebx
call fcn.00404ac8
add esp, 4
mov dword [esi + 0x2c], edi
mov ecx, esi
call fcn.00403ed2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24

Function at 0xdb48e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdb48ea
pushal
call 0xdb48f0
pop ebp
sub ebp, 0x10
sub ebp, 0x9b48e0
jmp 0xdb4906
mov eax, 0x9b48e0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bb
mov edx, 0xb575b241
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb491d
jmp 0xdb4930
retf 0xca8c
Function at 0x401cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, edx
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x60]
mov eax, dword [0x458020]
mov dword [esp + 0x3c], eax
xor eax, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], edx
mov edi, dword [eax]
movsx ebx, byte [edi + 9]
movsx eax, byte [edi + 0xa]
shl ebx, 8
shl eax, 0x10
and ebx, 0xffff
and eax, 0xff0000
or ebx, eax
movsx eax, byte [edi + 0xb]
shl eax, 0x18
or ebx, eax
movzx eax, byte [edi + 8]
or ebx, eax
movsx esi, byte [edi + ebx + 0xe]
movsx eax, byte [edi + ebx + 0xd]
shl esi, 0x10
shl eax, 8
and esi, 0xff0000
and eax, 0xffff
or esi, eax
movsx eax, byte [edi + ebx + 0xf]
shl eax, 0x18
or esi, eax
movzx eax, byte [edi + ebx + 0xc]
or esi, eax
test ecx, ecx
je 0x401e68
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp]
mov dword [esp], edi
lea eax, [edx + eax + 4]
add eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 0x24], eax
call sub.msvcrt.dll_realloc
test eax, eax
mov edi, eax
je 0x401e75
mov eax, dword [esp + 0x18]
mov edx, dword [ebp]
add eax, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 0x18
mov byte [edi + edx + 3], cl
mov ecx, eax
sar eax, 8
mov edx, dword [ebp]
sar ecx, 0x10
mov byte [edi + edx + 2], cl
mov edx, dword [ebp]
mov byte [edi + edx + 1], al
movzx edx, byte [esp + 0x1c]
mov eax, dword [ebp]
add dl, byte [esp + 0x18]
mov byte [edi + eax], dl
mov eax, dword [esp + 0x20]
test eax, eax
je 0x401dff
mov edx, dword [esp + 0x18]
mov eax, dword [ebp]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x20]
lea eax, [edi + eax + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp]
mov edx, dword [esp + 0x18]
lea eax, [edx + eax + 4]
mov edx, dword [esp + 0x1c]
add eax, edi
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
lea eax, [esi + 1]
mov edx, eax
shr edx, 0x18
mov byte [edi + ebx + 0xf], dl
mov edx, eax
sar eax, 8
mov byte [edi + ebx + 0xd], al
lea eax, [esi + 1]
sar edx, 0x10
mov byte [edi + ebx + 0xc], al
mov eax, dword [esp + 0x28]
mov byte [edi + ebx + 0xe], dl
mov edx, dword [esp + 0x24]
mov dword [eax], edi
mov eax, dword [esp + 0x3c]
xor eax, dword [0x458020]
mov dword [ebp], edx
jne 0x401ea9
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], 0
jmp 0x401d66
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
mov dword [esp], str.realloc_failed_in_comment_add___n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call sub.msvcrt.dll_exit
call fcn.00442960
nop
Function at 0x401eb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov ebx, eax
mov eax, dword [0x458020]
mov dword [esp + 0x1c], eax
xor eax, eax
mov eax, dword [ebx + 4]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
mov dword [esp + 0x24], esi
mov esi, edx
mov dword [esp + 0x28], edi
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov edi, eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add eax, edi
mov edx, dword [esp + 0x1c]
xor edx, dword [0x458020]
jne 0x401f29
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
call fcn.00442960
nop
Function at 0x406d70
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ebp, ebp
push edi
xor edi, edi
push esi
mov esi, 1
push ebx
mov ebx, 0x44f7a0
sub esp, 0x4c
mov edx, dword [esp + 0x60]
mov dword [esp + 0x20], 0
mov eax, dword [0x458020]
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x2c], edx
jmp 0x406dfa
cmp ebp, ecx
jge 0x406de7
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 1
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], ecx
sub eax, ebp
mov dword [esp + 8], eax
lea eax, [edi + ebp]
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ecx, dword [esp + 0x1c]
add ebp, eax
cmp ecx, ebp
jg 0x406df4
mov dword [esp + 4], ebp
mov dword [esp], edi
call dword [ebx]
test eax, eax
jne 0x406e30
add ebx, 0x18
add esi, 1
mov eax, dword [ebx]
lea edx, [esi - 1]
mov dword [esp + 0x24], edx
test eax, eax
je 0x406e70
mov ecx, dword [ebx + 4]
cmp dword [esp + 0x20], ecx
jg 0x406db0
mov dword [esp + 4], ecx
mov dword [esp], edi
mov dword [esp + 0x1c], ecx
call sub.msvcrt.dll_realloc
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x20], ecx
jmp 0x406db0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call dword [ebx + 8]
test eax, eax
je 0x406df4
mov dword [esp], edi
call sub.msvcrt.dll_free
mov edx, dword [esp + 0x24]
lea eax, [edx + edx*2]
lea eax, [eax*8 + 0x44f7a0]
jmp 0x406e7a
mov dword [esp], edi
call sub.msvcrt.dll_free
xor eax, eax
mov edx, dword [esp + 0x3c]
xor edx, dword [0x458020]
jne 0x406e8e
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00442960
lea esi, [esi]
lea edi, [edi]
sub esp, 0x3c
mov eax, dword [esp + 0x40]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
mov edx, dword [0x458020]
mov dword [esp + 0x1c], edx
xor edx, edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebp
movzx edx, byte [eax]
movzx ebx, byte [eax + 1]
movzx ebp, byte [eax + 2]
movzx esi, byte [eax + 3]
mov ecx, edx
movzx edi, byte [eax + 5]
and ecx, 0x7f
shl ecx, 8
or ecx, ebx
movzx ebx, byte [eax + 4]
cmp ecx, 0x7fff
je 0x406f90
mov edx, ebp
and edi, 0xff
and esi, 0xff
shl edx, 0x18
shl esi, 0x10
sub ecx, 0x403e
or edx, edi
shl ebx, 8
or edx, esi
or edx, ebx
mov dword [esp], edx
mov edx, 0x20
movss xmm0, dword [esp]
mov dword [esp + 4], edx
movlps qword [esp + 8], xmm0
fild qword [esp + 8]
movzx edx, byte [eax + 6]
fild dword [esp + 4]
fxch st(1)
movzx ebx, byte [eax + 7]
fscale
fstp st(1)
shl edx, 0x18
shl ebx, 0x10
or edx, ebx
movzx ebx, byte [eax + 9]
movzx eax, byte [eax + 8]
or edx, ebx
shl eax, 8
or edx, eax
mov dword [esp + 4], edx
fild dword [esp + 4]
mov dword [esp + 4], ecx
faddp st(1)
fild dword [esp + 4]
fxch st(1)
fscale
fstp st(1)
mov eax, dword [esp + 0x1c]
xor eax, dword [0x458020]
jne 0x406faa
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
mov eax, ebp
fld dword [0x4522cc]
test al, al
js 0x406f6e
test dl, dl
je 0x406f6e
fstp st(0)
fld dword [0x4522d0]
jmp 0x406f6e
fstp st(0)
call fcn.00442960
jmp fcn.00406fc0
Function at 0x4087c0
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [0x458020]
mov dword [esp + 0x3c], eax
xor eax, eax
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.DLL_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov dword [esp + 0x28], eax
je 0x4089b0
mov esi, dword [esp + 0x30]
lea eax, [esi*4]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x2c]
test eax, eax
mov dword [edx], eax
mov dword [ebx], esi
je 0x40897c
xor ebx, ebx
test esi, esi
mov ebp, eax
jg 0x4088a9
jmp 0x408920
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
cmp esi, eax
mov edx, dword [esp + 0x20]
jl 0x408913
test eax, eax
jle 0x408913
mov eax, dword [esp + 0x24]
mov dword [eax], edx
mov edx, dword [esp + 0x2c]
mov ebp, dword [edx]
mov eax, dword [ebp + edi]
test eax, eax
je 0x408948
add ebx, 1
cmp dword [esp + 0x30], ebx
jle 0x408920
mov eax, dword [esp + 0x28]
lea edi, [ebx*4]
add ebp, edi
mov dword [esp + 0x24], ebp
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov esi, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
jne 0x408834
xor edx, edx
jmp 0x408888
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov edx, dword [esp + 0x3c]
xor edx, dword [0x458020]
jne 0x4089e4
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str._nFATAL:_utf16_to_utf8_failed_n_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str._nFATAL:_Malloc_failed_n_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x23
mov dword [esp + 4], 1
mov dword [esp], str._nFATAL:_CommandLineToArgvW_failed_n_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
call fcn.00442960
lea esi, [esi]
Function at 0x409410
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x4094bc
mov eax, dword [ebx]
xor edx, edx
mov byte [eax + 0x16], 0
mov eax, dword [ebx]
mov byte [eax + 0x17], 0
mov eax, dword [ebx]
mov byte [eax + 0x18], 0
mov eax, dword [ebx]
mov byte [eax + 0x19], 0
mov ebp, dword [ebx + 4]
xor eax, eax
mov esi, dword [ebx]
test ebp, ebp
jle 0x409472
mov edx, esi
add ebp, esi
xor eax, eax
nop
lea esi, [esi]
movzx ecx, byte [edx]
mov edi, eax
add edx, 1
shr eax, 0x18
shl edi, 8
xor ecx, eax
mov eax, dword [ecx*4 + 0x452400]
xor eax, edi
cmp edx, ebp
jne 0x409450
mov edx, eax
shr edx, 0x18
mov ebp, dword [ebx + 0xc]
test ebp, ebp
jle 0x4094a2
mov edx, dword [ebx + 8]
add ebp, edx
nop
movzx ecx, byte [edx]
mov edi, eax
add edx, 1
shr eax, 0x18
shl edi, 8
xor ecx, eax
mov eax, dword [ecx*4 + 0x452400]
xor eax, edi
cmp edx, ebp
jne 0x409480
mov edx, eax
shr edx, 0x18
mov byte [esi + 0x16], al
mov esi, dword [ebx]
mov ecx, eax
shr ecx, 8
shr eax, 0x10
mov byte [esi + 0x17], cl
mov ecx, dword [ebx]
mov byte [ecx + 0x18], al
mov eax, dword [ebx]
mov byte [eax + 0x19], dl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x419170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
fldz
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x70]
fst dword [esp + 0x38]
mov esi, dword [esp + 0x7c]
fst dword [esp + 0x3c]
mov edi, dword [esp + 0x74]
imul ebx, eax, 0x2a
imul ecx, esi, 0x54
test eax, eax
lea ecx, [ebx + ecx + 0x452be0]
mov dword [esp + 0x18], ecx
jne 0x419310
fstp st(0)
fld dword [esi*4 + 0x452d40]
fstp dword [esp + 0x20]
fld dword [esi*4 + 0x452d30]
fstp dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ebp, dword [esp + 0x64]
shl eax, 3
cmp ebp, dword [esp + 0x68]
mov dword [esp + 0x14], eax
jge 0x419301
mov esi, edi
mov edi, dword [esp + 0x6c]
jmp 0x41925f
mov dword [esp + 8], 2
mov dword [esp + 4], 0x452d50
mov dword [esp], esi
call fcn.0041fd90
mov edx, eax
and eax, 1
sar edx, 1
neg eax
xor eax, edx
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
mov edx, dword [esp + 0x60]
mov eax, ebx
fld dword [esp + ebx*4 + 0x38]
imul eax, dword [edx + 8]
add eax, ebp
lea eax, [edi + eax*4]
fld dword [eax]
fld dword [0x452dc8]
fxch st(1)
fcomi st(1)
fcmovb st(0), st(1)
fstp st(1)
fmul dword [esp + 0x1c]
fadd st(1)
fadd st(2)
fstp dword [eax]
fld st(1)
faddp st(1)
fxch st(1)
fmul dword [esp + 0x20]
fsubp st(1)
fstp dword [esp + ebx*4 + 0x38]
add ebx, 1
cmp ebx, dword [esp + 0x78]
jl 0x419282
add ebp, 1
cmp ebp, dword [esp + 0x68]
je 0x419301
cmp ebp, 0x14
mov eax, 0x14
mov edx, dword [esp + 0x18]
cmovle eax, ebp
xor ebx, ebx
add eax, eax
lea edx, [edx + eax + 1]
add eax, dword [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
bsr eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x14]
xor eax, 0x1f
lea eax, [eax + edx - 0x20]
mov edx, dword [esp + 0x14]
sub edx, eax
cmp edx, 0xe
jg 0x4192d0
cmp edx, 1
jg 0x4191e1
fld1
fchs
jne 0x41920c
fstp st(0)
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.0041fce0
neg eax
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
jmp 0x41920c
mov edx, dword [esp + 0x24]
movzx eax, byte [edx]
mov edx, dword [esp + 0x28]
shl eax, 6
mov dword [esp + 8], eax
movzx eax, byte [edx]
mov dword [esp], esi
shl eax, 7
mov dword [esp + 4], eax
call fcn.004233f0
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
jmp 0x41920c
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
fld dword [0x452dc4]
fstp dword [esp + 0x20]
fstp dword [esp + 0x1c]
jmp 0x4191be