joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104491aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x104492cb
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x104492af
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x10449201
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x104491df
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x105050e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x105051ec
test eax, eax
je 0x105051ec
push esi
push edi
mov ecx, 0x10
mov esi, 0x5e4e018
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x105051d3
lea edi, [eax + 4]
jmp 0x10505137
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1050514c
mov dword [ebp - 4], 2
jmp 0x1050516d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10505163
mov dword [ebp - 4], 1
jmp 0x1050516d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x105051e3
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x105051a6
mov byte [ecx], 0x3d
jmp 0x105051b2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x105051bd
mov byte [ecx], 0x3d
jmp 0x105051c3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10505134
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1058e4bf
Capabilities:
Encode data using xor

Disassembly:
or al, ah
aaa
lodsb al, byte [esi]
mov esi, dword [esi - 0x6cf737cb]
salc
aaa
or byte [ebp - 0x6abbc836], 0xfe
and al, cl
outsb dx, byte [esi]
fcom qword [0xa211cec8]
enter 0x11ce, 0xffffffffffffffa2
leave
aaa
dec esp
xor cl, bl
fst dword [esi + 0x63]
loop 0x1058e499
xlatb
cwde
imul esi, dword [esi + 0x10762c35], 0xf01557ca
out dx, eax
mov esi, dword [ebp + 0xa91efc9]
sbb eax, 0x9c391033
xor eax, 0xca10762c
push edi
adc eax, 0xb58beff0
leave
out dx, eax
xchg ecx, eax
or bl, byte [0x9c391033]
pop ss
sub edx, dword [eax]
jecxz 0x1058e476
xchg dword [ecx], edx
adc bl, bh
wait
test eax, 0x6762efc3
mov esi, 0x1124effc
into
shr edi, 1
imul esi, dword [ebp - 0x25], 0x35
adc byte [ecx], dh
mov dword [0xeefc00d], eax
aam 0x42
iretd
push 0x112b6bc6
call fcn.10544479
jae 0x1058e44c
jae 0x1058e464
insb byte es:[edi], dx
mov dh, 0xec
push edx
xchg edi, eax
inc esi
mov ecx, 0x8668ef41
iretd
Function at 0x4012a0
Capabilities:
Clear file content

Disassembly:
sub esp, 8
add dword [esp + 0x1c], 0xfffff171
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
xor eax, 0x1de6
push ebp
mov dword [esp + 0x1c], eax
mov ebp, ebx
lea edx, [ebx + 0x1f6]
xor ebp, 0x1715
push esi
lea ecx, [ebx + 0x26d]
mov dword [esp + 0x10], edx
mov eax, edx
mov dword [esp + 0xc], ecx
lea esi, [ebx + 0x73f]
xor eax, 0x1676
xor ebx, 0xa7e
cmp ebx, eax
mov eax, ebx
jl 0x4013b0
xor eax, 0x4e9
cmp esi, eax
je 0x4014b6
mov edx, dword [esp + 0x1c]
cmp dword [edx + 0xc], 0x172bf
ja 0x401322
mov eax, dword [0x4ae074]
add eax, 0x167028
add eax, dword [edx + 0x2c]
mov dword [0x4ae074], eax
mov eax, dword [0x4ac344]
sub ebx, 0x703
cmp dword [eax + 0x90], 0x8137
jae 0x401354
mov eax, dword [edx + 0x48]
add eax, dword [0x4ae070]
xor eax, 0x155562
imul eax, dword [edx + 0x80]
mov dword [edx + 0x80], eax
mov eax, dword [0x4ae074]
cmp eax, dword [edx + 0xc]
je 0x401373
mov eax, dword [0x4ae0d8]
sub eax, dword [edx + 0x64]
add eax, 0x1bd935
mov dword [edx + 0xa8], eax
jmp 0x40138b
mov eax, dword [edx + 0xf8]
xor eax, dword [edx + 0xf0]
imul eax, dword [0x4ae108]
mov dword [0x4ae108], eax
mov eax, dword [0x4ac344]
pop esi
pop ebp
mov eax, dword [eax + 0xa0]
add eax, 0x15064c
xor ebx, 0xfea
mov dword [edx + 0x90], eax
mov eax, ebx
pop ebx
add esp, 8
ret
or eax, esi
sub eax, ebx
cmp ecx, eax
jl 0x4014b6
lea eax, [ebp + 0x10b2]
imul eax, eax, 0x1801
push edi
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 0x9c]
imul eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [0x4ae0a8]
or eax, 0xf7d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x64]
add eax, dword [edi + 0xdc]
xor eax, dword [edi + 0xb0]
xor esi, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x28]
or eax, dword [esp + 0x14]
add eax, 0x1d6b
push eax
imul eax, dword [0x4ae06c], 0xe5b
push edi
push esi
or eax, 0xe5b
push eax
call fcn.0041af90
mov edx, dword [0x4ac344]
mov esi, dword [esp + 0x38]
sub esi, dword [edi + 0xec]
mov eax, dword [edx + 0x1c]
and eax, dword [esp + 0x40]
mov ecx, dword [edx + 0xe0]
add eax, dword [0x4ae140]
xor ecx, dword [edi + 0xdc]
push eax
add ecx, ebp
mov eax, ebx
push ecx
push edx
xor eax, ebp
push esi
push eax
call fcn.0041af90
mov ecx, dword [0x4ac344]
mov edx, eax
push edi
or ebp, edx
push ebp
mov eax, dword [ecx + 0xd0]
mov ebp, dword [esp + 0x44]
or eax, edx
mov ecx, dword [ecx + 0x10]
imul eax, ebx
and ecx, 0x1ee6
push eax
mov eax, dword [edi + 0xc]
and eax, dword [esp + 0x58]
add eax, ebp
or ebp, 0xd19
push eax
push ebp
lea eax, [edx - 0x1801]
push eax
push ecx
call fcn.0041dda0
add esp, 0x44
pop edi
pop esi
xor ebx, 0xfea
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x405a60
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, eax
mov edx, dword [esp + 8]
xor ecx, 0x1d27
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor ebp, 0xe5b
mov dword [esp + 0xc], ecx
push edi
lea esi, [eax - 0xb26]
mov edi, ebx
mov eax, ebp
lea ecx, [ebx - 0x74f]
xor edi, 0x526
mov dword [esp + 0x20], ecx
xor eax, 0xbea
cmp edi, eax
jl 0x405ae3
mov eax, dword [0x4ae114]
cmp eax, dword [edx + 0xf0]
jbe 0x405aca
mov eax, dword [edx + 0xa8]
xor eax, 0x6d28a
sub dword [edx + 0x9c], eax
jmp 0x405b0b
mov eax, dword [edx + 0x74]
xor eax, dword [edx + 0x2c]
xor eax, dword [edx + 0x9c]
xor eax, 0x1356a
mov dword [edx + 0x9c], eax
jmp 0x405b0b
mov ecx, dword [edx + 8]
mov eax, dword [0x4ac344]
xor ecx, ebp
imul ecx, dword [esp + 0x10]
cmp dword [eax + 0xe4], ecx
mov ecx, dword [esp + 0x20]
je 0x405b0b
mov eax, dword [edx + 0xd0]
and eax, 0xf7d
or ebx, eax
mov eax, esi
xor eax, 0xd33
cmp ecx, eax
je 0x405b3d
mov eax, dword [0x4ac344]
mov ecx, dword [edx + 0x48]
cmp ecx, dword [eax + 0xdc]
ja 0x405b33
mov eax, dword [edx + 0xb4]
xor eax, 0x348a6811
mov dword [edx], eax
mov ecx, dword [esp + 0x20]
sub esi, 0x284
mov eax, dword [esp + 0x10]
add eax, 0x9e1
cmp ebx, eax
je 0x405b81
lea eax, [ecx - 0x399]
cmp ebp, eax
je 0x405b74
mov eax, dword [0x4ac344]
mov ecx, dword [0x4ae07c]
add ecx, 0x125f
pop edi
mov dword [eax + 4], ecx
lea eax, [esi + 0xed7]
pop esi
pop ebp
pop ebx
pop ecx
ret
xor edi, 0x1129
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
pop edi
lea eax, [esi + 0xed7]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x405fc0
Capabilities:
Allocate or change rwx memory
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
add eax, 0x12d
push ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
lea edx, [eax - 0x1801]
xor ebp, 0x180a
mov dword [esp + 0x10], edx
xor eax, 0x11e0
push edi
mov edi, ecx
mov dword [esp + 0x18], eax
xor edi, 0xf7d
lea eax, [ebp + 0x1ee6]
add ecx, 0x88d
mov ebx, edi
mov dword [esp + 0x1c], ecx
cmp edi, eax
jge 0x406062
lea eax, [edx + 0x180a]
cmp ebx, eax
jge 0x406036
add edx, 0x1d27
add ebp, 0x9e1
add edi, 0x1715
jmp 0x406062
mov eax, dword [esi + 0x78]
add eax, 0x180a
cmp dword [esi + 0xf4], eax
jne 0x406062
mov eax, ebx
or eax, edx
imul eax, ecx
push eax
mov eax, ecx
imul eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor ebp, 0x16d3
cmp dword [esp + 0x20], ebp
jg 0x40610f
xor ecx, 0x101
lea eax, [edx - 0x526]
push ecx
xor edi, 0xe1e
push edi
push eax
push dword [0x4ac344]
lea eax, [ebx + 0x190b]
xor ebx, 0x1ee6
push eax
push ebx
call fcn.004196c0
add esp, 0x18
cmp dword [esi + 0x90], 0x827
jae 0x4060cf
mov ecx, dword [0x4ac344]
mov eax, dword [esi + 0xa8]
pop edi
pop esi
sub dword [ecx + 0xc4], eax
mov eax, dword [esp + 0x10]
pop ebp
add eax, 0x820
pop ebx
ret
mov eax, dword [0x4ac344]
mov ecx, dword [eax + 0xa0]
mov eax, dword [esi + 0x80]
add ecx, 0x3000
add eax, 0x40
push eax
push ecx
push dword [esi + 0x38]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add eax, 0x6000
pop edi
mov dword [esi + 0xb8], eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
add eax, 0x820
pop ebx
ret
lea eax, [edi - 0x1e54]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [esi + 0x78]
mov edi, dword [esp + 0x18]
xor eax, edi
imul eax, eax, 0x1d6b
push eax
mov eax, dword [esi + 0x30]
and eax, 0x1715
imul eax, dword [0x4ae154]
push eax
mov eax, dword [esi + 0x90]
or eax, ebx
push eax
mov eax, edi
xor eax, ebx
push eax
mov eax, dword [esp + 0x30]
add eax, 0xffffef4e
push eax
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
lea eax, [edi + 0x820]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x415b20
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov eax, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor eax, 0x1e54
push esi
mov esi, dword [esp + 0x18]
lea edx, [ecx - 0x1e54]
mov dword [esp + 0xc], eax
add esi, 0xffffe295
mov eax, dword [esp + 0x1c]
add ebp, 0xfffff9ad
add eax, 0x399
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
lea eax, [esi + 0x1801]
mov dword [esp + 0x20], ebp
cmp ebp, eax
mov eax, dword [0x4ac344]
push edi
jg 0x415c47
mov esi, dword [esp + 0x28]
mov eax, dword [eax + 0xc4]
cmp eax, dword [esi + 0xf0]
je 0x415b92
mov dword [esi + 0xa4], 0x476b30
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [esi + 0xa4]
mov ecx, dword [0x4ac344]
mov edx, dword [edi + eax]
add edi, 4
mov eax, dword [esi + 0x10]
xor eax, dword [esi + 0xd0]
imul eax, dword [ecx + 0xd0]
mov dword [ecx + 0xd0], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x78]
add ecx, 0xfffffff6
add eax, ecx
xor dword [0x4ae068], eax
mov ebx, dword [esi + 0x5c]
mov eax, dword [0x4ae10c]
mov ecx, dword [esi + 0x60]
imul ebx, edx
mov edx, ebx
shr edx, 8
mov byte [eax + ecx], dl
inc dword [esi + 0x60]
mov eax, dword [0x4ac344]
mov ecx, dword [eax + 0xac]
mov eax, dword [0x4ae0c0]
mov byte [eax + ecx], bl
mov eax, dword [0x4ae140]
inc dword [0x4ae0c0]
add eax, 0xffac654c
add eax, dword [esi + 0xb0]
xor dword [esi + 0x1c], eax
mov eax, 0xffee2bdb
sub eax, dword [0x4ae13c]
add dword [esi + 0x90], eax
cmp edi, 0x21a8
jl 0x415ba0
pop edi
pop esi
lea eax, [ebp - 0xec]
pop ebp
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x28]
mov edi, esi
mov ecx, dword [ebx + 0xa8]
add ecx, esi
and ecx, dword [eax + 0x54]
cmp esi, ecx
jbe 0x415c3b
lea ecx, [esi + ebp]
add edx, 0xffffe6f5
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
nop dword [eax]
mov ecx, dword [eax + 0x1c]
xor ecx, dword [esp + 0x18]
or ecx, dword [eax + 8]
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xffffe1ac
push eax
mov eax, dword [ebx + 0x4c]
imul eax, esi
push edx
push eax
push dword [esp + 0x30]
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [0x4ac344]
lea edx, [ebp - 0x190b]
mov ecx, dword [ebx + 0xa8]
add edi, 4
add ecx, esi
and ecx, dword [eax + 0x54]
cmp edi, ecx
ja 0x415c70
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
add eax, 0xffffff14
pop ebx
pop ecx
ret
Function at 0x418cf0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
lea ecx, [eax - 0x100e]
lea ebx, [eax - 0xc75]
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x1c]
mov edx, esi
add eax, 0xffffe2d9
xor edx, 0x6b0
push edi
lea edi, [esi - 0x1982]
mov dword [esp + 0x1c], eax
mov eax, edi
mov dword [esp + 0x24], edx
xor eax, 0x1982
cmp ecx, eax
jg 0x418dca
push esi
push dword [0x4ac344]
mov eax, ebx
lea ebp, [edi + 0xd19]
xor eax, 0xdd9
xor edx, 0x738
push eax
push ebp
lea eax, [edi + 0x1ee6]
sub edx, 9
push eax
push edx
push esi
call fcn.004048a0
lea ecx, [edi + 0x1d6b]
add esp, 0x1c
cmp dword [esp + 0x1c], ecx
jg 0x418e67
mov esi, dword [esp + 0x18]
lea eax, [edi + 0x1e54]
push esi
push eax
push ebp
push ecx
xor ebx, 0xee6
push ebx
call fcn.00415b20
add esp, 0x14
cmp dword [esi + 0xb4], 0x804b
jb 0x418e67
mov eax, dword [0x4ac344]
pop edi
mov eax, dword [eax + 0xc4]
xor eax, 0xa8fe53a9
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x18]
pop esi
pop ebp
xor eax, 0x1715
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x18]
mov ebp, ebx
mov eax, dword [edx + 0x90]
and eax, 0xfffffb9f
not eax
and eax, 0x1d6b
cmp ebx, eax
jbe 0x418e67
mov esi, dword [0x4ac344]
imul eax, dword [esi + 0xdc], 0x1ee6
or eax, ecx
nop dword [eax]
mov ecx, dword [esi + 0x90]
cmp ecx, eax
ja 0x418e4c
mov edi, dword [esp + 0x24]
or edi, 0x1ee6
mov eax, dword [edx + 0x90]
add ecx, 2
and eax, ebx
xor dword [0x4ae0f8], eax
mov eax, dword [edx + 0x84]
imul eax, edi
mov dword [edx + 0x84], eax
mov esi, dword [0x4ac344]
imul eax, dword [esi + 0xdc], 0x1ee6
or eax, dword [esp + 0x10]
cmp ecx, eax
jbe 0x418e14
mov ecx, dword [edx + 0x90]
add ebp, 4
and ecx, 0xfffffb9f
not ecx
and ecx, 0x1d6b
cmp ebp, ecx
ja 0x418e00
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor eax, 0x1715
pop ebx
pop ecx
ret
Function at 0x4196c0
Capabilities:
Create pipe
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 4]
add edx, 0x549
push ebx
mov ebx, dword [esp + 0xc]
add ecx, 0xffffef75
push esi
mov esi, dword [esp + 0x14]
add ebx, 0xfffff8f6
push edi
mov edi, dword [esp + 0x1c]
add edi, 0x653
mov dword [esp + 0x14], edx
mov eax, edi
xor eax, 0x15be
cmp ebx, eax
jl 0x41974f
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 8]
xor eax, 0xffffe084
mov dword [0x4ae098], eax
mov eax, dword [esi + 0xf4]
cmp eax, dword [esi + 0x80]
jne 0x419737
mov eax, dword [0x4ac344]
mov eax, dword [eax + 0xf0]
sub eax, dword [esi + 8]
sub eax, 0x2d1dc
add dword [esi + 0x3c], eax
jmp 0x41985c
mov ecx, dword [esi + 0xf8]
mov eax, 0xfffff558
xor ecx, dword [esi + 0x74]
sub eax, ecx
add dword [esi + 0x38], eax
jmp 0x41985c
mov eax, dword [esi + 0x48]
add eax, dword [0x4ae06c]
cmp dword [esi + 0xf8], eax
jne 0x41985c
mov eax, dword [0x4ae0b0]
or eax, 0x1715
imul eax, dword [esi + 0x50]
push ebp
mov ebp, dword [esi + 0xc0]
cmp ebp, eax
jbe 0x41985b
lea eax, [ecx - 0x1982]
imul edx, ebx
mov dword [esp + 0x24], eax
mov eax, edi
imul eax, edi
xor edx, 0x1668
xor dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], eax
nop word [eax + eax]
mov ecx, dword [0x4ac344]
mov eax, dword [ecx + 0xd0]
imul eax, dword [esi + 0xbc]
sub eax, dword [esi + 0xb0]
push eax
imul eax, dword [esi + 0x90], 0xbea
push eax
mov eax, dword [ecx + 0xf4]
and eax, ebx
push eax
mov eax, dword [0x4ae0cc]
and eax, edi
push eax
mov eax, dword [esi + 0x10]
xor eax, ebx
and eax, 0x1801
push eax
mov eax, dword [esi + 0x9c]
imul eax, dword [0x4ae0e0]
push edx
push dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [0x4ac344]
push dword [esp + 0x14]
push dword [esp + 0x1c]
mov eax, dword [ecx + 0x88]
imul eax, edi
push eax
imul eax, dword [ecx + 0xe0], 0xaf3
push eax
mov eax, ebx
sub eax, dword [0x4ae070]
sub eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov eax, dword [0x4ae0b0]
add ebp, 3
mov edx, dword [esp + 0x20]
or eax, 0x1715
imul eax, dword [esi + 0x50]
cmp ebp, eax
ja 0x4197b0
pop ebp
lea eax, [edi + 0x92]
cmp edi, eax
jge 0x4198a0
mov eax, dword [esi + 0xf4]
cmp eax, dword [0x4ae110]
je 0x419880
add dword [0x4ae098], 0x39a
jmp 0x419887
or dword [esi + 0x14], 0x12218
mov eax, dword [0x4ac344]
mov eax, dword [eax + 0x90]
add eax, dword [esi + 0xc0]
xor eax, 0x23b002
add dword [esi + 0x38], eax
mov eax, dword [esp + 0x24]
pop edi
pop esi
add eax, 0xfffff2df
pop ebx
ret
Function at 0x41a550
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
add edx, 0x1473
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, 0xce7
push esi
mov esi, dword [esp + 0x24]
add ebp, 0xffffe2d9
push edi
mov edi, dword [esp + 0x2c]
mov eax, edi
xor eax, 0x134d
mov dword [esp + 0x2c], eax
lea eax, [ebp + 0x1715]
lea ecx, [edi - 0xff9]
xor edi, 0xc55
mov dword [esp + 0x20], ecx
cmp ecx, eax
jge 0x41a5d6
mov eax, dword [esp + 0x24]
sub ebx, 0xce5
add dword [esi + 4], 0x1c071bc3
add eax, 0xfffff61f
xor eax, 0x190b
cmp edi, eax
jge 0x41a5d6
mov dword [0x4ae0a0], 0xc457
mov eax, dword [esi + 0x1c]
add eax, 0x41064c34
mov dword [esi + 0x58], eax
mov eax, ecx
xor eax, 0x1651
cmp ebx, eax
je 0x41a61e
lea eax, [edi - 0x70e]
cmp dword [esp + 0x2c], eax
jle 0x41a701
mov eax, dword [0x4ac344]
pop edi
mov eax, dword [eax + 0xf8]
sub eax, dword [esi + 0xf4]
xor eax, 0xffe732a6
mov dword [esi + 0xcc], eax
mov eax, dword [esp + 0x20]
pop esi
pop ebp
add eax, 0x1473
pop ebx
add esp, 8
ret
mov eax, dword [esi + 8]
add eax, edi
or eax, 0x1982
cmp ebp, eax
je 0x41a701
imul edx, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], edx
cmp ebp, edx
jl 0x41a701
mov eax, ecx
xor ebx, 0x1d27
and eax, dword [esp + 0x24]
add eax, 0xfffff1a5
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [0x4ae130]
xor eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
add edx, 0xfffff61f
push ebx
push eax
mov eax, dword [0x4ae06c]
and eax, edx
add eax, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x2c]
and eax, dword [esi + 0x78]
push eax
mov eax, dword [esi + 0x20]
push dword [esp + 0x20]
and eax, edi
and eax, ebp
push eax
mov eax, dword [esi + 0xb4]
imul eax, dword [esi + 0x1c]
xor eax, 0x1d27
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x990
push 0x375f
push 0xf33
push 0x95a
push 0x631
push 0x351d
push 0x114d
push 0x5c2
push 0x9ad
push 0xb70
call fcn.0041dae0
mov byte [0x4ae8f1], al
add esp, 0x28
mov eax, dword [esp + 0x1c]
add eax, 3
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x14]
jge 0x41a658
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
add eax, 0x1473
pop ebx
add esp, 8
ret
Function at 0x522c44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00522cc3
jae 0x522c50
xor ecx, ecx
call fcn.00522cc3
jae 0x522c7a
xor eax, eax
call fcn.00522cc3
jae 0x522c8b
mov al, 0x10
call fcn.00522cc3
adc al, al
jae 0x522c6c
jne 0x522cb8
stosb byte es:[edi], al
jmp 0x522c51
call fcn.00522ccf
dec ecx
loop 0x522c97
mov eax, ebp
call fcn.00522ccd
jmp 0x522cb9
lodsb al, byte [esi]
shr eax, 1
je 0x522cdf
adc ecx, 2
mov ebp, eax
jmp 0x522cb9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00522ccd
cmp eax, 0x7d00
jae 0x522cb7
cmp eax, 0x500
jae 0x522cb8
cmp eax, 0x7f
ja 0x522cb9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x522c51
pop ebp
ret 8
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x4010ea
Capabilities:
Execute command

Disassembly:
mov eax, 0x10004
call fcn.00401220
mov eax, str.node__C:_Users_woobi_AppData_Roaming_npm_node_modules_lix_bin_haxeshim.js_
push eax
lea eax, [ebp - 0x10000]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, 1
mov dword [ebp - 0x10004], eax
mov eax, dword [ebp - 0x10004]
mov ecx, dword [ebp + 8]
cmp eax, ecx
jge 0x40115b
jmp 0x401139
mov eax, dword [ebp - 0x10004]
inc eax
mov dword [ebp - 0x10004], eax
jmp 0x401114
mov eax, dword [ebp - 0x10004]
shl eax, 2
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov eax, dword [ecx]
push eax
lea eax, [ebp - 0x10000]
push eax
call section..text
add esp, 8
jmp 0x40112a
lea eax, [ebp - 0x10000]
push eax
call sub.msvcrt.dll_system
add esp, 4
jmp 0x40116f
leave
ret