joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41112b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [ecx]
add esi, 0x3f
xor eax, eax
cmp esi, 0x40
jb 0x411179
mov dword [esp], edx
mov edx, dword [esp + 0x18]
shr esi, 5
neg edx
xor ebx, ebx
inc ebx
xor ebp, ebp
mov edi, dword [ecx + ebx*4]
add ebp, edi
mov eax, ebp
mov ebp, dword [esp]
sub eax, dword [ebp + ebx*4]
mov ebp, eax
and ebp, 0x7fffffff
xor ebp, edi
and ebp, edx
xor ebp, edi
mov dword [ecx + ebx*4], ebp
mov ebp, eax
sar ebp, 0x1f
inc ebx
cmp esi, ebx
jne 0x41114d
shr eax, 0x1f
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4112d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, ecx
xor eax, eax
cmp ecx, dword [esp + 0x24]
cmove edi, eax
mov ebx, 0x20
xor ecx, ecx
inc ecx
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
mov ecx, dword [esp]
shl edi, cl
mov ebp, edx
mov dword [esp + 8], edx
dec ebx
mov ecx, ebx
shr ebp, cl
or ebp, edi
mov edi, ebp
mov eax, dword [esp + 0x24]
sub edi, eax
xor ebp, eax
mov esi, edi
xor esi, eax
and esi, ebp
xor esi, edi
mov ebp, dword [esp + 4]
shr ebp, cl
not esi
shr esi, 0x1f
or ebp, esi
mov ecx, dword [esp]
shr edi, cl
mov ecx, ebx
shl eax, cl
sub edx, eax
mov eax, dword [esp + 0xc]
mov ecx, ebp
neg ecx
mov esi, dword [esp + 4]
xor edi, esi
and edi, ecx
xor edi, esi
mov esi, dword [esp + 8]
xor edx, esi
and edx, ecx
mov ecx, ebx
shl ebp, cl
mov ecx, dword [esp]
xor edx, esi
or eax, ebp
inc ecx
cmp ebx, 1
ja 0x4112f1
mov esi, edx
mov ebx, dword [esp + 0x24]
sub esi, ebx
mov ecx, edx
xor ecx, ebx
xor ebx, esi
and ebx, ecx
xor ebx, esi
not ebx
shr ebx, 0x1f
or edi, ebx
or eax, edi
neg edi
xor esi, edx
and esi, edi
xor esi, edx
mov ecx, dword [esp + 0x28]
mov dword [ecx], esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4114bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], edx
mov esi, dword [ecx]
add esi, 0x3f
xor eax, eax
cmp esi, 0x40
jb 0x411503
mov edx, dword [esp + 0x18]
shr esi, 5
neg edx
xor ebx, ebx
inc ebx
xor ebp, ebp
mov edi, dword [ecx + ebx*4]
add ebp, edi
mov eax, dword [esp]
add ebp, dword [eax + ebx*4]
mov eax, ebp
and ebp, 0x7fffffff
xor ebp, edi
and ebp, edx
xor ebp, edi
shr eax, 0x1f
mov dword [ecx + ebx*4], ebp
inc ebx
cmp esi, ebx
mov ebp, eax
jne 0x4114dd
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411974
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10c
mov dword [esp + 8], edx
mov esi, ecx
mov edi, dword [esp + 0x124]
mov bl, byte [esp + 0x128]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov eax, dword [eax + 4]
mov dword [esp], eax
lea ebp, [esp + 0xc]
push edi
push dword [esp + 0x124]
push ebp
call fcn.0040307b
add esp, 0xc
test edi, edi
je 0x4119c0
mov eax, edi
xor byte [ebp], bl
inc ebp
dec eax
jne 0x4119b9
mov ecx, dword [esp]
shr ecx, 0x17
and cl, 0xf
xor ebp, ebp
inc ebp
shl ebp, cl
lea eax, [esp + edi + 0xc]
mov ecx, ebp
sub ecx, edi
movzx edx, bl
push ecx
push edx
push eax
call fcn.00403060
add esp, 0xc
push esi
mov eax, dword [esp + 8]
call dword [eax + 8]
add esp, 4
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ebp
push ecx
push esi
call dword [eax + 0xc]
add esp, 0xc
mov eax, dword [esi]
push dword [esp + 8]
push esi
call dword [eax + 0x14]
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411f99
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x484
mov dword [esp + 4], edx
mov ebp, ecx
mov esi, 0xe4
lea ebx, [esp + 0x3a0]
push esi
push ecx
push ebx
call fcn.0040307b
add esp, 0xc
mov ecx, ebx
mov edx, ebx
push 0x42c132
push dword [esp + 0x4a0]
call fcn.004121c6
add esp, 8
lea edi, [esp + 0x2bc]
push esi
mov dword [esp + 4], ebp
push ebp
push edi
call fcn.0040307b
add esp, 0xc
mov ecx, edi
mov edx, ebx
push str.U8_b6X9
mov ebx, dword [esp + 0x4a0]
push ebx
call fcn.004121c6
add esp, 8
lea edi, [esp + 0x14]
push 0xe0
push 0
push edi
call fcn.00403060
add esp, 0xc
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [edi + 0x94], eax
mov dword [edi + 0x48], eax
mov dword [edi - 4], eax
mov eax, dword [esp + 0x498]
mov dword [esp + 8], eax
cmp dword [esp + 0x498], 0
je 0x4121a8
xor edi, edi
inc edi
mov ebx, 6
mov dword [esp + 0xc], edi
lea ebp, [esp + 0x10]
mov ecx, ebp
mov edx, ebp
mov eax, 0x42c132
push eax
mov edi, dword [esp + 0x4a0]
push edi
call fcn.004121c6
add esp, 8
mov ecx, ebp
mov edx, ebp
mov eax, 0x42c132
push eax
push edi
call fcn.004121c6
add esp, 8
push esi
push dword [esp + 4]
lea eax, [esp + 0xfc]
push eax
call fcn.0040307b
add esp, 0xc
push esi
push ebp
lea eax, [esp + 0x1e0]
push eax
call fcn.0040307b
add esp, 0xc
mov eax, dword [esp + 4]
movzx eax, byte [eax]
mov ebp, ebx
mov ecx, ebx
shr eax, cl
and eax, 3
mov ecx, 0xffffff1c
lea edx, [esp + ecx + 0xf4]
lea ebx, [edx + esi]
lea edi, [esp + ecx + 0x3a0]
add edi, esi
cmp eax, 2
cmovne edi, ebx
mov bl, byte [edi]
mov byte [edx + 0xe4], bl
inc ecx
jne 0x4120bd
mov ecx, 0xffffff1c
lea edx, [esp + ecx + 0xf4]
lea edi, [edx + esi]
lea ebx, [esp + ecx + 0x2bc]
add ebx, esi
cmp eax, 3
cmovne ebx, edi
mov bl, byte [ebx]
mov byte [edx + 0xe4], bl
inc ecx
jne 0x4120e6
xor ebx, ebx
test eax, eax
setne bl
lea ecx, [esp + 0x1d8]
lea edx, [esp + 0xf4]
push str.U8_b6X9
push dword [esp + 0x4a0]
call fcn.004121c6
add esp, 8
mov edi, dword [esp + 0xc]
mov eax, edi
and eax, ebx
neg al
mov ecx, 0xffffff1c
mov dl, byte [esp + ecx + 0xf4]
mov dh, byte [esp + ecx + 0x1d8]
xor dh, dl
and dh, al
xor dh, dl
mov byte [esp + ecx + 0xf4], dh
inc ecx
jne 0x412142
mov eax, edi
not eax
and eax, ebx
neg al
mov ecx, 0xffffff1c
mov dl, byte [esp + ecx + 0xf4]
mov dh, byte [esp + ecx + 0x2bc]
xor dh, dl
and dh, al
xor dh, dl
mov byte [esp + ecx + 0xf4], dh
inc ecx
jne 0x41216d
not ebx
and edi, ebx
test ebp, ebp
lea ebx, [ebp - 2]
jne 0x41204c
inc dword [esp + 4]
dec dword [esp + 8]
jne 0x412047
lea eax, [esp + 0x10]
push 0xe4
push eax
push dword [esp + 8]
call fcn.0040307b
add esp, 0x490
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414323
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x22c
mov dword [esp + 4], edx
mov ebp, ecx
lea ebx, [esp + 0x1c0]
mov ecx, 0x1b
mov edi, ebx
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.00414a78
lea eax, [esp + 0x154]
mov ecx, 0x1b
mov edi, eax
mov dword [esp], ebp
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov edx, ebx
call fcn.00414856
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x60], xmm0
xor eax, eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x240]
mov dword [esp + 8], eax
cmp dword [esp + 0x240], 0
je 0x4144c0
xor esi, esi
inc esi
lea edi, [esp + 0x7c]
mov ebx, 6
mov dword [esp + 0xc], esi
lea ebp, [esp + 0x10]
mov ecx, ebp
call fcn.00414a78
mov ecx, ebp
call fcn.00414a78
mov ecx, 0x1b
mov esi, dword [esp]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1b
lea edi, [esp + 0xe8]
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 4]
movzx eax, byte [eax]
mov ebp, ebx
mov ecx, ebx
shr eax, cl
and eax, 3
mov ecx, 0xffffff94
cmp eax, 2
lea edx, [esp + ecx + 0xe8]
lea esi, [esp + ecx + 0x22c]
cmovne esi, edx
mov bl, byte [esi]
mov byte [edx], bl
inc ecx
jne 0x414403
mov ecx, 0xffffff94
cmp eax, 3
lea edx, [esp + ecx + 0xe8]
lea esi, [esp + ecx + 0x1c0]
cmovne esi, edx
mov bl, byte [esi]
mov byte [edx], bl
inc ecx
jne 0x414423
xor ebx, ebx
test eax, eax
setne bl
lea ecx, [esp + 0xe8]
lea edi, [esp + 0x7c]
mov edx, edi
call fcn.00414856
mov esi, dword [esp + 0xc]
mov eax, esi
and eax, ebx
neg al
mov ecx, 0xffffff94
mov dl, byte [esp + ecx + 0x7c]
mov dh, byte [esp + ecx + 0xe8]
xor dh, dl
and dh, al
xor dh, dl
mov byte [esp + ecx + 0x7c], dh
inc ecx
jne 0x414466
mov eax, esi
not eax
and eax, ebx
neg al
mov ecx, 0xffffff94
mov dl, byte [esp + ecx + 0x7c]
mov dh, byte [esp + ecx + 0x154]
xor dh, dl
and dh, al
xor dh, dl
mov byte [esp + ecx + 0x7c], dh
inc ecx
jne 0x41448b
not ebx
and esi, ebx
test ebp, ebp
lea ebx, [ebp - 2]
jne 0x4143be
inc dword [esp + 4]
dec dword [esp + 8]
jne 0x4143b9
lea esi, [esp + 0x10]
mov ecx, 0x1b
mov edi, dword [esp]
rep movsd dword es:[edi], dword [esi]
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4196ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov ecx, dword [ecx + 8]
mov ebx, dword [edi + 0xc]
mov eax, ecx
add eax, 1
mov dword [edi + 8], eax
mov eax, ebx
adc eax, 0
mov dword [edi + 0xc], eax
mov eax, ebx
shr eax, 0x18
mov byte [esp + 3], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 4], al
mov byte [esp + 5], bh
mov byte [esp + 6], bl
mov eax, ecx
shr eax, 0x18
mov byte [esp + 7], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 8], al
mov byte [esp + 9], ch
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov eax, dword [esp + 0x30]
mov byte [esp + 0xc], ah
mov byte [esp + 0xd], al
mov eax, dword [esp + 0x38]
mov byte [esp + 0xe], ah
mov byte [esp + 0xf], al
movsd xmm0, qword [edi + 0x30]
movsd qword [esp + 0x10], xmm0
mov eax, dword [edi + 0x38]
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x34]
mov esi, 8
xor byte [esp + esi + 0x13], cl
shrd ecx, ebx, 8
shr ebx, 8
dec esi
jne 0x419758
lea eax, [edi + 0x10]
lea edx, [esp + 3]
lea esi, [esp + 0x10]
push dword [esp + 0x40]
push dword [edi + 0x3c]
push dword [esp + 0x44]
push 0xd
push edx
push dword [esp + 0x4c]
push ebp
push esi
push eax
call dword [edi + 0x40]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41b4a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp], ecx
mov eax, dword [edx]
bswap eax
lea edi, [esp + 0x14]
mov dword [edi], eax
mov eax, dword [edx + 4]
bswap eax
lea ebx, [esp + 0x10]
mov dword [ebx], eax
mov ecx, edi
mov edx, ebx
call fcn.0041b293
mov eax, dword [ebx]
mov ebp, eax
mov ecx, eax
shr ecx, 4
mov esi, 0xff00000
and esi, ecx
mov edx, dword [edi]
mov ebx, edx
shr ebx, 0xc
shr ebp, 0xc
mov edi, 0xff0
and ebp, edi
or ebp, esi
mov esi, 0xff000
and ebx, esi
or ebp, ebx
mov ebx, edx
shr ebx, 0x14
and ebx, 0xf
or ebx, ebp
mov ebp, edx
shl ebp, 4
and ebp, esi
and ecx, edi
movzx eax, al
shl eax, 0x14
or ecx, eax
or ecx, ebp
shr edx, 0x10
and edx, 0xf
or edx, ecx
xor esi, esi
mov eax, 0x8103
bt eax, esi
setae al
mov ah, al
inc ah
mov ebp, ebx
mov cl, ah
shl ebp, cl
xor al, 0x1b
mov ecx, eax
shr ebx, cl
mov edi, edx
mov cl, ah
shl edi, cl
mov ecx, eax
shr edx, cl
mov eax, 0xffffffe
and ebp, eax
or ebx, ebp
and edi, eax
or edx, edi
mov eax, dword [esp]
mov dword [eax + esi*8], ebx
mov dword [eax + esi*8 + 4], edx
inc esi
cmp esi, 0x10
jne 0x41b51f
xor eax, eax
mov ecx, dword [esp]
lea edx, [eax + eax]
mov esi, dword [ecx + eax*8]
mov dword [esp + 0xc], eax
lea eax, [eax + eax + 1]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov ebp, dword [ecx + edx*4 + 4]
mov edi, 0xfffffff0
xor edx, edx
xor eax, eax
add eax, eax
mov cl, byte [edi + 0x42d878]
mov ebx, esi
shr ebx, cl
add edx, edx
and ebx, 1
shl ebx, 0x10
or ebx, eax
movzx ecx, byte [edi + 0x42d888]
xor eax, eax
bt ebp, ecx
setb al
or eax, ebx
mov cl, byte [edi + 0x42d898]
mov ebx, esi
shr ebx, cl
and ebx, 1
shl ebx, 0x10
or ebx, edx
movzx ecx, byte [edi + 0x42d8a8]
xor edx, edx
bt ebp, ecx
setb dl
or edx, ebx
inc edi
jne 0x41b589
mov ecx, dword [esp]
mov esi, dword [esp + 8]
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ecx + eax*4], edx
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 0x10
jne 0x41b566
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41d974
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov esi, ecx
mov edi, esp
mov ecx, edi
push dword [ebp + 8]
call fcn.0041d0fd
add esp, 4
mov ecx, eax
shl ecx, 4
movdqa xmm0, xmmword [esp + ecx]
movdqu xmmword [esi], xmm0
cmp eax, 2
jb 0x41d9c3
mov edx, eax
dec edx
lea edi, [ecx + edi - 0x10]
lea ebx, [esi + 0x10]
aesimc xmm0, xmmword [edi]
movdqu xmmword [ebx], xmm0
add edi, 0xfffffff0
add ebx, 0x10
dec edx
jne 0x41d9b1
movaps xmm0, xmmword [esp]
movups xmmword [esi + ecx], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41f6f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [ecx + 0x44]
test ebp, ebp
mov dword [esp], edx
je 0x41f789
mov edi, 0x10
sub edi, ebp
cmp edi, eax
cmovae edi, eax
test edx, edx
je 0x41f741
test edi, edi
je 0x41f75c
lea ecx, [ebp + esi + 0x34]
xor edx, edx
mov al, byte [ebx + edx]
mov ah, byte [ecx + edx]
xor ah, al
mov byte [ecx + edx], al
mov byte [ebx + edx], ah
inc edx
cmp edi, edx
jne 0x41f72c
jmp 0x41f75c
test edi, edi
je 0x41f75c
lea ecx, [ebp + esi + 0x34]
xor edx, edx
mov al, byte [ebx + edx]
xor al, byte [ecx + edx]
mov byte [ebx + edx], al
mov byte [ecx + edx], al
inc edx
cmp edi, edx
jne 0x41f74b
add ebp, edi
cmp ebp, 0x10
jb 0x41f81f
mov ebp, dword [esp + 0x28]
sub ebp, edi
add ebx, edi
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esi + 0x14]
lea edi, [esi + 0x34]
push 0x10
push edi
push edx
push eax
call dword [ecx + 0x1c]
mov eax, ebp
add esp, 0x10
mov edx, dword [esp]
mov dword [esp + 0xc], eax
mov edi, eax
and edi, 0xfffffff0
xor eax, eax
test edx, edx
setne al
mov edx, dword [esi]
mov ecx, dword [edx]
mov dword [esp + 8], ecx
lea ecx, [esi + 4]
lea ebp, [esi + 0x14]
push edi
push ebx
push ebp
mov dword [esp + 0x10], ecx
push ecx
push edx
mov ecx, dword [esp + 0x1c]
call dword [ecx + eax*4 + 0x10]
add esp, 0x14
mov ebp, dword [esp + 0xc]
and ebp, 0xf
je 0x41f806
add ebx, edi
lea eax, [esi + 0x34]
xor edi, edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov ecx, dword [esi]
mov edx, dword [ecx]
push 0x10
push eax
push dword [esp + 0xc]
push ecx
call dword [edx + 0x18]
add esp, 0x10
cmp dword [esp], 0
je 0x41f80a
mov al, byte [ebx + edi]
mov cl, byte [esi + edi + 0x34]
xor cl, al
mov byte [esi + edi + 0x34], al
mov byte [ebx + edi], cl
inc edi
cmp ebp, edi
jne 0x41f7ef
jmp 0x41f81f
xor ebp, ebp
jmp 0x41f81f
xor eax, eax
mov cl, byte [ebx + eax]
xor cl, byte [esi + eax + 0x34]
mov byte [ebx + eax], cl
mov byte [esi + eax + 0x34], cl
inc eax
cmp ebp, eax
jne 0x41f80c
mov dword [esi + 0x44], ebp
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41f82a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x41f864
lea ebx, [esi + 0x34]
lea ecx, [esi + eax + 0x34]
mov edx, 0x10
sub edx, eax
push edx
push 0
push ecx
call fcn.00403060
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esi + 0x14]
push 0x10
push ebx
push edx
push eax
call dword [ecx + 0x1c]
add esp, 0x10
cmp dword [esi + 0x48], 0
je 0x41f87e
xor eax, eax
mov cl, byte [esi + eax + 0x24]
xor byte [esi + eax + 0x14], cl
inc eax
mov ecx, dword [esi + 0x48]
cmp eax, ecx
jb 0x41f86c
jmp 0x41f880
xor ecx, ecx
lea eax, [esi + 0x14]
push ecx
push eax
push edi
call fcn.0040307b
add esp, 0xc
mov eax, dword [esi + 0x48]
pop esi
pop edi
pop ebx
ret
Function at 0x4913c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x67000]
push edi
or ebp, 0xffffffff
jmp 0x4913e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4913e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4913d8
mov eax, 1
add ebx, ebx
jne 0x4913fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4913f0
jne 0x49140c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4913f0
xor ecx, ecx
sub eax, 3
jb 0x491420
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x491492
mov ebp, eax
add ebx, ebx
jne 0x49142b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x491438
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x49145c
inc ecx
add ebx, ebx
jne 0x491448
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49143d
jne 0x491459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49143d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49147c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49146d
jmp 0x4913de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49147c
add edi, ecx
jmp 0x4913de
pop esi
mov edi, esi
mov ecx, 0x436
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49149a
cmp byte [edi], 7
jne 0x49149a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49149f
lea edi, [esi + 0x8f000]
mov eax, dword [edi]
or eax, eax
je 0x49150e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x93a9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x93af4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4914cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x93afc]
or eax, eax
je 0x491508
mov dword [ebx], eax
add ebx, 4
jmp 0x4914e9
call dword [esi + 0x93af8]
mov ebp, dword [esi + 0x93b00]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x491542
sub esp, 0xffffff80
jmp 0x4015cd
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x1186710
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x1186710], ecx
mov eax, dword [esi + 4]
mov dword [0x1186714], eax
mov edx, dword [esi + 8]
mov dword [0x1186718], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x118671c], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0x1186720], esi
shl eax, 8
add eax, edx
mov dword [0x1186710], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0x1186710], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1186710], eax
call fcn.00401224
mov dword [0x1186714], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x1c0000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0xfc737c
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0x4087d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539be1
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x58d214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x40]
call fcn.00407750
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407750
mov byte [ebp - 4], 1
push 0x544c7c
mov ecx, dword [ebp + 0xc]
call fcn.0040b5b0
push eax
call fcn.00512cbf
add esp, 8
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x40889d
mov eax, dword [ebp + 0xc]
push eax
push str.fopen_file__fialed_:
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00405820
add esp, 0xc
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
call fcn.0040b5b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x8c]
call fcn.00407ce0
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x50], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407ce0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00407ce0
mov eax, dword [ebp - 0x50]
jmp 0x4089c3
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 4]
call fcn.00421020
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xc8
je 0x408993
mov edx, dword [ebp - 0x44]
push edx
lea eax, [ebp - 0xec]
push eax
call fcn.0040c170
add esp, 8
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x5c]
push edx
push str._failed_return_value
mov eax, dword [ebp + 0xc]
push eax
push str.download_file
lea ecx, [ebp - 0xd4]
push ecx
call fcn.00405820
add esp, 0xc
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x64], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x64]
push eax
lea ecx, [ebp - 0xbc]
push ecx
call fcn.004057a0
add esp, 0xc
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xa4]
push ecx
call fcn.004056f0
add esp, 0xc
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
call fcn.0040b5b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0xa4]
call fcn.00407ce0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xbc]
call fcn.00407ce0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd4]
call fcn.00407ce0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xec]
call fcn.00407ce0
mov edx, dword [ebp - 0x48]
push edx
call fcn.00512aa5
add esp, 4
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407ce0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00407ce0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d48f1
mov esp, ebp
pop ebp
ret 8