joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f060
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4abc38
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], edx
lea esi, [esp + 0x18]
mov dword [eax + 8], ecx
call fcn.0045fcb0
mov esi, ebx
lea edi, [esp + 0xc]
mov dword [esp + 0x38], 0
call fcn.00456f30
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x45f0e9
test al, 1
jne 0x45f0e9
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x45f0e9
lea edx, [esp + 0x14]
push 2
push edx
mov ecx, edx
push ecx
call eax
add esp, 0xc
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461a60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b03b3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [esi + 4]
mov dword [esi], 0x4cd868
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x24
mov dword [eax], 0x4c7e30
call fcn.00485951
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x461abd
push eax
call fcn.004293d0
mov edi, eax
jmp 0x461abf
xor edi, edi
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
push edi
lea ecx, [eax + 0xc]
mov dword [eax + 8], edi
call fcn.00429f20
mov eax, dword [ebp - 0x10]
push edi
add eax, 8
push edi
push eax
call fcn.00401ce0
fldz
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4c7d54
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov ecx, dword [eax]
mov dword [esi + 0x28], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x2c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x30], ecx
mov edx, dword [eax + 0xc]
fst dword [esi + 0x3c]
fstp dword [esi + 0x40]
add esp, 0xc
fld1
mov dword [esi + 0x34], edx
fst dword [esi + 0x44]
mov word [esi + 0x38], bx
fst dword [esi + 0x48]
mov byte [esi + 0x3a], 1
fst dword [esi + 0x58]
mov dword [esi + 0x4c], 0xff00
fst dword [esi + 0x5c]
mov byte [esi + 0x50], bl
fst dword [esi + 0x60]
mov dword [esi + 0x54], 0xff000000
fstp dword [esi + 0x64]
mov byte [esi + 0x68], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46cd50
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac63b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], 0x4d238c
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
push 0x18
mov dword [esi + 0x30], ebx
call fcn.00485951
add esp, 4
cmp eax, ebx
je 0x46cdf2
mov dword [esi + 0x2c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x2c]
mov al, 1
mov byte [ecx + 0x14], al
mov edx, dword [esi + 0x2c]
mov byte [edx + 0x15], al
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov word [esi + 0x6c], 0x101
mov byte [esi + 0x6e], bl
mov dword [esi + 0x38], 0x4d2398
mov byte [esi + 0x70], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.00485c38
push 0x4dc294
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], 0x4bef88
call fcn.0048acad
int3

Function at 0x472a40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac523
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x20], 0x4fe4a8
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 4], eax
lea edi, [ebx + 0x34]
mov dword [ebx], 0x4c86d4
mov dword [edi], 0x4fe4a8
mov byte [ebp - 4], 1
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x3c], ecx
push 0x4c489f
xor esi, esi
mov dword [ebx + 0x38], 4
mov byte [ebx + 0x44], al
mov byte [ebx + 0x2c], al
mov dword [ebx + 0x30], eax
call fcn.00473860
xor eax, eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x472c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x472c67
cmp byte [ebx + 0x2c], 0
jne 0x472c5d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [0x4f6750]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472c40
sub eax, esi
push edx
lea edi, [ebx + 0x34]
mov esi, eax
call fcn.00473860
or eax, 0xffffffff
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x472c81
mov edi, edi
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
test esi, esi
jne 0x472c70
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
push edi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.004899bc
push edi
call fcn.00489bcc
push 0
mov esi, eax
push 0
push edi
mov dword [ebp - 4], esi
call fcn.004899bc
add esp, 0x1c
test esi, esi
jg 0x472cdf
cmp byte [ebx + 0x2c], 0
jne 0x472c5d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 0xc
mov edx, dword [0x4f6778]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472cd3
jmp 0x472c47
lea eax, [esi + 1]
push eax
call fcn.00485951
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edi, eax
push esi
push edi
mov byte [edi], 0
call fcn.00488244
add esp, 0x14
cmp eax, 1
je 0x472d3c
push edi
call fcn.00485637
add esp, 4
cmp byte [ebx + 0x2c], 0
jne 0x472c5d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [0x4f6750]
mov eax, edx
lea esi, [eax + 1]
jmp 0x472d30
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472d30
jmp 0x472c47
mov edx, dword [ebp - 4]
mov byte [edi + edx], 0
cmp byte [edi], 0
mov eax, edi
mov esi, edi
je 0x472d6c
lea esp, [esp]
mov cl, byte [eax]
cmp cl, 0xd
jne 0x472d63
mov byte [esi], 0xa
inc eax
inc esi
cmp byte [eax], 0xa
jne 0x472d67
jmp 0x472d66
mov byte [esi], cl
inc esi
inc eax
cmp byte [eax], 0
jne 0x472d50
push 0
mov byte [esi], 0
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 0
push edi
mov ecx, ebx
call edx
push edi
call fcn.00485637
add esp, 4
xor eax, eax
cmp byte [ebx + 0x2c], al
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x478930
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4f6734]
test eax, eax
je 0x478b10
push ebx
xor edx, edx
mov dword [0x4f6734], 0
xor eax, eax
push edi
lea ecx, [ecx]
movzx edi, byte [eax + 0x4c3259]
movzx ebx, byte [eax + 0x4c3258]
mov ecx, 0x1f
sub ecx, edi
mov edi, 1
shl edi, cl
mov ecx, 0x1f
sub ecx, ebx
mov ebx, 1
shl ebx, cl
add eax, 2
or edi, ebx
or edx, edi
cmp eax, 0xe
jb 0x478950
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x478993
xor eax, edx
test al, 1
je 0x47899d
shr eax, 1
xor eax, edx
jmp 0x47899f
shr eax, 1
test al, 1
je 0x4789a9
shr eax, 1
xor eax, edx
jmp 0x4789ab
shr eax, 1
test al, 1
je 0x4789b5
shr eax, 1
xor eax, edx
jmp 0x4789b7
shr eax, 1
test al, 1
je 0x4789c1
shr eax, 1
xor eax, edx
jmp 0x4789c3
shr eax, 1
test al, 1
je 0x4789cd
shr eax, 1
xor eax, edx
jmp 0x4789cf
shr eax, 1
test al, 1
je 0x4789d9
shr eax, 1
xor eax, edx
jmp 0x4789db
shr eax, 1
test al, 1
je 0x4789e5
shr eax, 1
xor eax, edx
jmp 0x4789e7
shr eax, 1
mov dword [ecx*4 + 0x4fc3e0], eax
inc ecx
cmp ecx, 0x100
jl 0x478988
mov ecx, 0x4fd7e0
lea esp, [esp]
mov eax, dword [ecx - 0x1400]
mov edi, eax
and edi, 0xff00
mov ebx, eax
shl ebx, 0x10
add edi, ebx
shl edi, 8
mov edx, eax
shr edx, 8
mov ebx, edx
and ebx, 0xff00
add edi, ebx
mov ebx, eax
shr ebx, 0x18
add edi, ebx
mov dword [ecx - 0x400], edi
and eax, 0xff
mov eax, dword [eax*4 + 0x4fc3e0]
xor eax, edx
mov edi, eax
and edi, 0xff00
mov ebx, eax
shl ebx, 0x10
add edi, ebx
mov edx, eax
shr edx, 8
shl edi, 8
mov ebx, edx
and ebx, 0xff00
add edi, ebx
mov ebx, eax
shr ebx, 0x18
add edi, ebx
mov dword [ecx], edi
mov dword [ecx - 0x1000], eax
and eax, 0xff
mov eax, dword [eax*4 + 0x4fc3e0]
xor eax, edx
mov edi, eax
and edi, 0xff00
mov ebx, eax
mov edx, eax
shr edx, 8
shl ebx, 0x10
add edi, ebx
mov ebx, edx
shl edi, 8
and ebx, 0xff00
add edi, ebx
mov ebx, eax
mov dword [ecx - 0xc00], eax
shr ebx, 0x18
add edi, ebx
mov dword [ecx + 0x400], edi
and eax, 0xff
mov eax, dword [eax*4 + 0x4fc3e0]
xor eax, edx
mov edx, eax
and edx, 0xff00
mov edi, eax
shl edi, 0x10
add edx, edi
mov edi, eax
shr edi, 8
shl edx, 8
and edi, 0xff00
mov dword [ecx - 0x800], eax
add edx, edi
shr eax, 0x18
add edx, eax
mov dword [ecx + 0x800], edx
add ecx, 4
cmp ecx, 0x4fdbe0
jl 0x478a00
pop edi
mov dword [0x4f6730], 0
pop ebx
ret
mov eax, dword [0x4f6730]
test eax, eax
jne 0x478b10
ret
Function at 0x47bc00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4ffe20], ecx
inc edx
cmp edx, 0x100
jb 0x47bc02
ret

Function at 0x47bcb0
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xffffffff
test ecx, ecx
je 0x47bcda
push esi
jmp 0x47bcc0
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4ffe20]
inc edx
dec ecx
jne 0x47bcc0
pop esi
ret
Function at 0x47e9f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx]
and esi, 7
mov dword [ebp - 4], 0
cmp eax, 5
jae 0x47ea12
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
lea edx, [edx + eax - 4]
push ebx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], edx
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
add edi, eax
cmp edi, edx
jae 0x47ea40
mov cl, byte [edi]
and cl, 0xfe
cmp cl, 0xe8
je 0x47ea40
inc edi
cmp edi, edx
jb 0x47ea31
mov ebx, edi
sub ebx, eax
mov eax, ebx
sub eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x47eb47
cmp eax, 3
jbe 0x47ea77
xor esi, esi
mov al, byte [edi + 4]
mov dword [ebp - 8], ebx
test al, al
je 0x47eab4
cmp al, 0xff
je 0x47eab4
and esi, 3
add esi, esi
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x47ea25
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x47ea5b
movzx eax, byte [esi + 0x4c2850]
mov ecx, edi
sub ecx, eax
cmp byte [esi + 0x4c2848], 0
mov al, byte [ecx + 4]
je 0x47eaa0
test al, al
je 0x47eaa0
cmp al, 0xff
jne 0x47ea5b
and esi, 3
add esi, esi
mov dword [ebp - 8], ebx
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x47ea25
movzx ecx, byte [edi + 2]
movzx edx, al
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
sub edx, ebx
lea eax, [edx - 5]
test esi, esi
je 0x47eb17
movzx edx, byte [esi + 0x4c2850]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
mov cl, bl
test cl, cl
je 0x47eafe
cmp cl, 0xff
jne 0x47eb14
mov ebx, dword [ebp - 4]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x47ead2
mov ebx, dword [ebp - 4]
mov ecx, eax
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
add ebx, 5
mov byte [edi + 3], dl
mov edx, dword [ebp - 0xc]
mov byte [edi + 2], cl
mov byte [edi + 1], al
mov dword [ebp - 4], ebx
jmp 0x47ea25
cmp eax, 3
jbe 0x47eb5c
mov edx, dword [ebp + 0xc]
pop edi
xor esi, esi
mov eax, ebx
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [eax - 1]
shl esi, cl
pop edi
mov eax, ebx
pop ebx
and esi, 7
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x481210
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea ecx, [ebp - 4]
push ecx
lea esi, [eax + 0x48]
mov eax, dword [eax + 0x3c]
lea edx, [ebp - 8]
push edx
push esi
push 0x20000013
push eax
mov dword [ebp - 8], 4
mov dword [ebp - 4], 0
mov dword [esi], 0x194
call dword [0x4be388]
mov esi, dword [esi]
cmp esi, 0xc8
je 0x48125f
cmp esi, 0x130
je 0x48125f
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x483d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b55e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
lea ebx, [esi + 4]
push ecx
mov dword [esp + 0x30], 0
call fcn.00407e10
add esp, 8
lea edi, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.00404de0
xor bl, bl
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x483dec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401550
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x30], 2
call fcn.00403e30
add esp, 4
push eax
mov byte [esp + 0x30], bl
call fcn.00403fe0
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x483e44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a7710
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4aa818
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4ed4e0]
xor eax, esp
mov dword [esp + 0x34], eax
push ebp
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x4a7620
push 0
push 0
call fcn.00486312
mov ebp, eax
add esp, 0x18
test ebp, ebp
jne 0x4a77b2
call fcn.004a83c0
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
mov esi, eax
lea edi, [ebp + 0xb]
mov dword [esp + 0x14], 0x4c3a7c
call fcn.00485c38
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebp
mov byte [esp + 0x28], 0
mov dword [esp + 0x14], 0x4c24a0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x54], ebp
call fcn.00405ad0
mov ecx, dword [esi]
add ecx, 4
mov edx, 1
lock xadd dword [ecx], edx
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x4a77d5
cmp eax, 0xffffffff
je 0x4a77d5
push eax
call dword [0x4be094]
mov dword [edi + 8], ebp
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push ecx
call dword [0x4be25c]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00485642
add esp, 0x44
ret
Function at 0x40737b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c7b8
cmp edx, dword [eax]
je 0x40739d
add eax, 8
inc ecx
cmp eax, 0x40c848
jl 0x40738e
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c7b8]
jne 0x4074cb
mov eax, dword [0x40d208]
cmp eax, 1
je 0x4074a5
test eax, eax
jne 0x4073ce
cmp dword [0x40c704], 1
je 0x4074a5
cmp edx, 0xfc
je 0x4074cb
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407405
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00403930
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403a20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x407448
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403a20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40a62c
push edi
call fcn.00403760
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00403930
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403940
lea eax, [ebp - 0xa0]
push 0x40a60c
push eax
call fcn.00403940
push dword [esi + 0x40c7bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403940
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408376
add esp, 0x2c
pop edi
jmp 0x4074cb
lea eax, [ebp + 8]
lea esi, [esi + 0x40c7bc]
push 0
push eax
push dword [esi]
call fcn.00403a20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x1167601
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
dec edx
test eax, eax
je 0x116763b
mov eax, dword [ecx + 0x6c]
push esi
lea esi, [edx + 1]
mov edx, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
movzx edi, byte [edx]
and ecx, 0xff
xor ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 8
mov ecx, dword [eax + ecx*4]
inc edx
xor edi, ecx
dec esi
mov dword [ebp + 0x10], edi
jne 0x1167619
pop edi
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc

Function at 0x1168bad
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push dword [ebp + 8]
call dword [fcn.0041c3d8]
test eax, eax
je 0x1168c63
lea eax, [ebp - 0x118]
push 0xff
push eax
push dword [ebp + 0xc]
call fcn.0116a2e9
add esp, 0xc
cmp dword [ebp + 0xc], 0x452
jne 0x1168c53
lea eax, [ebp - 0x118]
push eax
call dword [fcn.0041c164]
test eax, eax
je 0x1168c0f
lea eax, [ebp - 0x118]
push 0x42016c
push eax
call fcn.0117052a
pop ecx
test eax, eax
pop ecx
jne 0x1168c2b
mov eax, 0x486
push eax
mov dword [0x425fa0], eax
call fcn.0116a275
pop ecx
push dword [0x425fa0]
call fcn.01170428
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.0116b286
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [fcn.0041c328]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call dword [fcn.0041c3ac]
leave
ret 8
Function at 0x1196d3a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x1196d81
cmp edx, 0x10
jl 0x1196d6d
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x1196d5a
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x1196d81
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x1196d79
and edx, 3
cmp edx, 3
jne 0x1196d95
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x1196d9a
cmp edx, 2
jne 0x1196da6
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x1196dab
cmp edx, 1
jne 0x1196db1
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x130cec2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x130cf09
cmp edx, 0x10
jl 0x130cef5
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x130cee2
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x130cf09
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x130cf01
and edx, 3
cmp edx, 3
jne 0x130cf1d
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x130cf22
cmp edx, 2
jne 0x130cf2e
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x130cf33
cmp edx, 1
jne 0x130cf39
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret