joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bcf7
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
aam 0xb0
inc edi
pushal
mov byte [edi - 0x4e], 0xe4
xchg esi, eax
mov edx, edx
aas
or byte [ebp + 0x36], 0xc2
cmp eax, 0x1e257859
mov bh, 0x97
xchg ebx, eax
jno 0x41bc6b
dec ebx
and eax, 0x565bb022
dec ebx
add eax, dword [ebx]
mov es, word [ecx - 0x2d]
aam 0x66
nop
nop
and eax, 0xe08b604
mov dh, 8
push cs
mov bh, 0x33
xor eax, 0x3febaed
inc al
shr ch, cl
mov ah, 0xf2
mov ebx, 0x61c77ef7
cdq
mov dh, 0x44
pop esi
push es
jbe 0x41bc4b
fbld tbyte [eax - 0x49]
push eax
pushal
mov bh, 0x50
jb 0x41bc23
jbe 0x41bc86
aad 0x28
loope 0x41bc99
and ah, byte [ebp + 0x72]
pop esi
test dword [edx - 0x73], 0xd71340f2
lahf
pop esi
mov byte [0x7c7f4c25], al
dec esp
jg 0x41bd05
aaa
and byte [edi + 0x3a2190d5], al
and dword [edx], edi
lahf
cmp byte [eax], bl
xchg byte [ebp - 0x3b], ah
loope 0x41bc4f
iretd
push es
adc dword [edx + edx*8 + 0xe9989e4], 0xffffffc0
salc
push ecx
jno 0x41bcba
sub dl, byte [esi + 0x32]
dec esi
dec edi
xchg esi, eax
jmp 0x41bcd6
pop esi
cmp eax, 0x39704a8
push es
dec edi
inc esp
push ebx
xchg edx, eax
jb 0x41bcd5
xor eax, 0x514872df
push ss
and dword [edi + 0x12c294b0], ebx
lea esp, [ecx]
and dword [ecx - 0x1025bb93], esp
mov eax, dword [0xefda446d]
invalid
out dx, al
cwde
pop esp
add eax, 0x8793b219
inc byte [esi - 0x6b8ea06d]
pop edi
jno 0x41bc8e
pop edi
jno 0x41bc8e
mov edx, 0x6397268d
add byte [ebx], cl
outsb dx, byte [esi]
inc eax
inc ecx
inc ecx
mov bl, 0x1e
loop 0x41bd0a
push esp
jbe 0x41bcec
test eax, 0xc0ca0e86
add bl, dh
jno 0x41bd44
sub eax, 0xc26bc9bc
sub cl, ah
sub eax, 0x2b960b89
mov ah, 0x46
cmp eax, 0xc37bd671
test eax, edx
inc ebx
sal dword [eax], cl
mov ah, 0x24
add dl, 0x27
xlatb
pop ebp
and esp, dword [bp + si + 0x10]
in al, dx
invalid
mov esp, 0x28c26bc9
loope 0x41bd4b
mov dword [ebx], ecx
xchg esi, eax
sub esi, dword [esi + eax*2 + 0x7bd6713d]
ret
sub dword [edx + 0x13], ecx
mov dh, 0x36
invalid
pushfd
cmp eax, 0x769d088e
lds edx, [edi]
mov cs, word [eax]
popfd
jbe 0x41bd16
pop ss
adc dword [ebx], 0xffffff96
jb 0x41bcee
wait
shr byte [edx], 1
lodsd eax, dword [esi]
mov bh, 0xb7
mov dh, 0xae
dec edi
leave
lodsb al, byte [esi]
in eax, dx
cli
movsb byte es:[edi], byte [esi]
adc ebx, esp
xchg esi, eax
ror dword [ecx], 0xa3
outsd dx, dword [esi]
jae 0x41bd92
jns 0x41bd8b
scasb al, byte es:[edi]
xchg ebp, eax
jecxz 0x41bd4a
aad 0xb8
inc eax
aam 0x5c
mov dh, 7
sbb eax, 0x36f3e38f
adc dh, byte [edi]
push ecx
add eax, 0xd8636531
ret
add eax, 0x27f1286e
xchg ecx, eax
jno 0x41bd4c
jno 0x41bd4c
dec ebx
out 0x82, al
cli
and dh, cl
xor byte [ebx - 0x6c15a9f5], 0x54
pop ds
cmpsb byte [esi], byte es:[edi]
jno 0x41be1c
adc byte [edx + 0x16], dh
and byte [edi + 3], dl
cmp ecx, dword [ecx - 0x1b4ae2f0]
xchg esi, eax
ljmp 0x25d9
mov bh, 0xe6
mov eax, dword [0xcdaf46b0]
aaa
mov al, 0x46
scasd eax, dword es:[edi]
int 0x37
xor eax, 0xd14a4e8e
sub al, 0x45
xor eax, 0x32567534
test al, 0x47
enter 0xffffffffffff8135, 0xffffffffffffffd6
pop ebx
std
fstp st(6)
cmpsd dword [esi], dword es:[edi]
cmp cl, al
jge 0x41be1f
fcom dword [edx + 0x212502d0]
or al, 0xff
jmp 0xf7b2668c
Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [esi], 0
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b83c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b84b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov eax, dword [0x65bd6c]
push eax
call sub.IMM32.dll_ImmGetContext
test bl, bl
mov dword [0x65bd6c], eax
je 0x44b86d
or dword [esi], 0x657630
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x5b1334
Capabilities:
Encode data using xor

Disassembly:
cmc
in al, dx
mov eax, dword [0xc29ea94a]
invalid
mov ebp, 0xdd6564c6
je 0x5b12ec
adc ebp, dword [esp - 0x72d7683b]
dec esi
bound esp, qword [edx + 0x1d]
mov ecx, 0xa18e9463
pop esp
cmp eax, 0x82fad1f8
mov eax, dword [0x811bd543]
mov ecx, 0x52ada4ca
jecxz 0x5b1390
cwde
in ax, 2
lea esp, [ebx + 0x7d]
push ebp
jl 0x5b13a8
push esi
xlatb
adc cl, dl
xor byte [ecx], ah
sbb eax, 0x8a9e9e81
in al, 0xd3
invalid
lea eax, [eax + 0x2dd11411]
loop 0x5b13d5
mov cl, 0x23
dec esp
xchg byte [ebp + 0x2a95f546], dl
jbe 0x5b13f4
enter 0x6d43, 0x33
mov al, byte es:[0x57a7e069]
mov al, byte [0x57a7e069]
add eax, 0xffffffb7
or byte [ebx - 0x29d44d35], 0xe3
test dword [edi - 0x75], ebp
cmc
into
or dword [ecx - 0x3c], 0xffffffcf
out 0x46, al
sal dword ss:[edi + 0x44], cl
jl 0x5b1415
dec esp
xor eax, 0xbea42107
push cs
adc edx, dword [ecx + 0x7157c786]
mul bh
fld xword [eax]
sbb eax, dword [ebp - 0x69]
mov al, 0x79
scasd eax, dword es:[edi]
mov dl, 0x44
dec esp
mov al, byte [0x5cccc60]
jbe 0x5b13c8
in eax, dx
add al, 0xc8
sub esp, dword [edi + ebp*4 + 0x7b]
adc bh, bl
and eax, dword [edx - 0x4f0f21be]
sysenter
jbe 0x5b13e2
inc edx
fdivrp st(0)
mov al, 0xf
xor al, 0x76
out 0x3f, al
aas
pop ss
pop ss
cwde
xor dh, bl
push eax
xchg edx, eax
xor dword [ebp - 0x77], esi
clc
lcall 0x2653, 0x5894c5ed
xchg esi, eax
mov eax, 0xe3b4e4ee
xchg esi, eax
jne 0x5b1477
cwde
cmpsb byte [esi], byte es:[edi]
aas
and byte [ebx - 0x70], ah
insd dword es:[edi], dx
aas
jnp 0x5b1408
mov ecx, 0xdb6251de
fcmovne st(0), st(3)
into
enter 0xffffffffffffba76, 0
add byte [esi], dl
xchg ebx, eax
shl byte [eax + 0x54], cl
insb byte es:[edi], dx
insd dword es:[edi], dx
invalid
add esp, 0xffffffb6
mov al, byte [0xa791a2f6]
pshufw mm1, mm0, 0x10
and al, 0x12
wait
push 0x10b730d1
add dl, dl
or al, byte [ebp - 0x79]
lahf
sub al, 0xe0
cmpsd dword [esi], dword es:[edi]
out dx, eax
pop edi
out dx, al
pop ebp
adc byte [eax - 0x7d], 5
les esi, [edx - 0x51]
cld
jne 0x5b14e6
cmp dword [eax - 0x21], edx
fisttp qword gs:[eax]
aaa
sub dword [edi + ebx - 0x46d0261e], 0x915957ec
dec edx
wait
dec ecx
out 0x89, al
pop ss
xchg dword fs:[esp + edx*4], ecx
cmpsd dword [esi], dword es:[edi]
daa
adc byte [esi - 4], ah
retf
dec esi
sti
push 0xffffffffffffffec
pop eax
add dword cs:[eax], ebp
jno 0x5b1564
dec esp
and dword [ebx - 0x3c], ebx
rol ecx, 1
int1
loope 0x5b14de
call 0xd69b4a2a
mov ebp, 0x83947a1e
salc
inc edi
test ch, dh
salc
sahf
adc eax, 0x73e2f2cd
sbb esp, eax
sub al, dh
add dword [esi], eax
or dl, byte [edx]
outsb dx, byte [esi]
and al, 0xd1
xchg edx, eax
jmp 0x5b150a
iretd

Function at 0x5c2067
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
push ebx
xor esi, esi
call dword [0x475488]
cmp word [ebx], si
je 0x5c20ae
mov edx, ebx
push ebp
xor eax, eax
cmp word [edi], ax
je 0x5c20a0
mov ecx, edi
lea esp, [esp]
mov ebp, esi
imul ebp, eax
add bp, word [ecx + 2]
add eax, 1
xor word [edx], bp
cmp word [edi + eax*2], 0
lea ecx, [edi + eax*2]
jne 0x5c2087
add esi, 1
cmp word [ebx + esi*2], 0
lea edx, [ebx + esi*2]
jne 0x5c207a
pop ebp
pop esi
ret
Function at 0x5f212b
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xc6479fa7
mov cl, 0x43
mov byte [0x7cf110c1], al
push esi
inc eax
ret 0xb99c
out 0x19, eax
xor bl, byte [edi + 0x8ee2739]
jb 0x5f219b
loope 0x5f218b
mov fs, word [esi]
outsd dx, dword [esi]
and dword [ebx - 0x1e], ebp
loop 0x5f20e3
xor dword [edi - 6], eax
pop eax
sti
jecxz 0x5f2148
in al, dx
stosd dword es:[edi], eax
test byte [ecx], 0xf5
push ebx
push esi
imul ebx, dword [edi - 0x68fa6d1e], 0xffffffcc
cli
dec ebx
xchg edx, eax
add eax, 0x4bfacc97
sbb dword [edx], esp
or dword [ecx], esp
cmp dh, dh
inc eax
mov al, byte [0x8d063552]
adc byte [esi + 0x7a228ac1], 0xac
mov eax, 0xa405d666
mov ebx, 0xa973580f
cmp byte [edx - 0xb56a388], bl
push 0xfb3005a8
test al, 5
xor bl, bh
mov cl, 0xa4
pop esp
ror dword [eax - 0x67446c16], cl
jg 0x5f21e5
pushal
mov ch, 0x15
pop esp
test dword [edx - 0x57], esp
jns 0x5f217b
cmp byte [esi + 0x26], cl
mov byte [0xa27107c4], al
cdq
inc edx
sub al, 0xf6
pop ecx
jbe 0x5f2150
std
cli
xchg ecx, eax
imul edi, dword [ecx + esi*2 + 0x1874ffe6], 0x1ef2091
jmp 0x5f21de
neg byte [eax + 0x26920df1]
rcl edx, 1
xchg edx, eax
rcl edx, 1
rcl byte [eax + 0x2021b506], cl
or dword [0xf6078156], esi
nop
push es
mov ch, 0x21
and byte [ecx], cl
xor eax, 0xf6078156
enter 0xffffffffffff8561, 0xffffffffffffffa7
push es
push edi
dec ecx
xor dword [ecx + 0x52], ebx
in al, dx
outsd dx, dword [esi]
add dword [ecx - 0x4489f564], edx
je 0x5f21e2
mov edi, 0x18846bd5
push cs
cmpsd dword [esi], dword es:[edi]
int 0x12
pop ss
enter 0xffffffffffffd8d3, 0x51
xchg esi, eax
adc al, 0x59
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
fidiv word [eax - 0x36]
pop edx
jbe 0x5f223f
wait
jb 0x5f225b
and al, byte [edi - 0x3495cc58]
or byte [esp + edx*4 - 0x74d2fd4b], ch
aas
bound esp, qword [edi - 0xf9e608]
add al, 0x67
fcomp dword [edx - 0x4a9b622]
sti
aam 0xc9
inc edi
mov bh, 0xfa
add eax, dword [ebx + 0x67ac2698]
enter 0x29e6, 0x43
lodsb al, byte [esi]
enter 0x29e6, 0x43
aad 0x76
fild word [esi + 0x51db3001]
cmp esi, eax
mov dh, dl
stosb byte es:[edi], al
cli
loop 0x5f2249
inc eax
mov ebx, 0x9210fefa
retf

Function at 0x63cd9a
Capabilities:
Encode data using xor

Disassembly:
out 0x7d, al
nop
and eax, 0x8c9db678
fcom qword [ecx + 0x3d]
push dword [edi - 0xd004a58]
inc ebp
xchg ecx, eax
push ds
test ecx, 0xbae23e45
xor ebp, edx
xor ebp, edx
or dword [esp + ecx*2 + 0x7165e79c], ecx
mov ebp, 0x3bdadcca
xchg esp, ecx
push es
and ebp, dword [ecx - 0x33e80dff]
pop ecx
std
sub eax, 0x46629843
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
push ebx
xor al, 0x32
mov dh, 0x7c
mov al, byte [ebx + 0x55fa5265]
scasb al, byte es:[edi]
dec ebx
loop 0x63cd63
jo 0x63cd4f
in eax, dx
adc al, byte [edi - 0x16]
ljmp 0x7cd9
Function at 0x63ef59
Capabilities:
Encode data using xor

Disassembly:
cmp cl, bh
jmp 0x738f2f25
mov ecx, 0x948057b3
loop 0x63eeee
mov dword [edx + 0x79], esp
sahf
sub eax, 0xbdbf5d60
jae 0x63ef60
push es
push es
mov ebx, 0x163e16ff
lodsb al, byte [esi]
out 0x7d, al
push ss
loop 0x63ef9c
jb 0x63ef48
retf
jmp 0x63efe4
shl dword [ebx], 0xfb
push ecx
shr bl, cl
ja 0x63f058
and eax, 0x57fc5285
mov ecx, esp
pop ebp
test eax, 0xb4f735e
xor ah, byte [ebx]
cmp eax, 0x1d41e816
in eax, dx
dec dword [esp + ecx*4 - 0x5d477b2e]
or bl, byte [edi + 0x6843c4e5]
mov ecx, dword [edx - 0x22]
popal
mov esi, 0x3d955bfc
cld
cmp esi, ebp
or ebx, ecx
push ss
in eax, dx
sbb al, 0x5a
das
or eax, 0x42b8451e
xor ebp, dword [ebp - 0x13863e53]
and esi, 0xffffff9e
sbb ebx, eax
sub dword [edi], esp
pop ebp
sub eax, 0x264858f4
ja 0x63f01e
sub byte [ecx - 0x1ccd1738], al
iretd
cmpsb byte [esi], byte es:[edi]
fist dword [edx - 0x5b]
jmp dword [esi + 0xcc9cd6e]

Function at 0x645c2e
Capabilities:
Encode data using xor

Disassembly:
aaa
popal
and byte [eax], 0xfd
mov byte [0xe5d57cac], al
jbe 0x645c29
xchg edi, eax
inc edx
add dword [ebp - 0x25bebe73], ebp
inc esi
dec ebx
mov ch, 0xc5
adc esp, ebp
adc eax, 0x153899df
mov ebx, 0x2fe8ace6
xchg dword [ecx + edi*2], edx
xchg dword [edi + 0x7f], esp
inc esi
cmp byte [ebx - 0x5f], dl
xor byte [esi], 0xa6
add edx, dword [esi]
add eax, dword [edi + 0xd]
or eax, 0xd7d5a637
xchg esi, eax
jle 0x645c90
cmp al, 0x39
sub dword [edi], 0x37
mov ah, 0x47
lodsd eax, dword [esi]
adc edx, 0xe
wait
cmp edi, eax
mov ebp, 0x7fa64ef
xor al, 0xc9
inc eax
add byte [edi - 0x27122442], 0x18
aam 0x1f
xchg ecx, eax
leave
invalid
add ebx, ecx
xor edi, dword [ebx - 0x7c]
or eax, 0xebf12f10
push ss
pop eax
jb 0x645c92
adc bl, byte [ebp - 0x1c]
out 0xb2, eax
sub dh, byte [ebx - 0x7bf34c89]
fst qword [esi - 0x52]
cmpsb byte [esi], byte es:[edi]
leave
test eax, 0x6cc72d6b
adc eax, 0x2d2d244f
mov esi, 0xed23ee25
push edi
ret
Function at 0x404837
Capabilities:
Get disk information

Disassembly:
mov eax, 0x429b10
call fcn.00428650
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00401f1f
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x40490d
mov eax, SysReAllocString
cmp ebx, eax
ja 0x404873
mov eax, ebx
add eax, eax
push eax
call fcn.00405733
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x404906
cmp ebx, dword [ebp - 0x18]
ja 0x404906
lea ecx, [ebp - 0x2c]
call fcn.00402679
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x4048ee
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4048e3
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.00405733
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401d25
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x4048b1
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.00402153
push esi
call fcn.00402153
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x40490f
push esi
call fcn.00402153
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405733
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x405742
pop dword [ebp - 0x2c]
mov eax, 0xd96454cb
sub eax, 0xd923fd89
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x396ea
push 0
mov eax, 0xe9ba6487
add eax, 0x16885ba5
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xb666a513
sub ecx, 0xb6665c74
xor edi, edi
add edi, eax
mov ebx, 0x43b800
add ebx, dword [ebp - 0x2c]
mov esi, 0x93fdc0a1
add esi, 0x95f50c21
mov edx, dword [ebx]
xor dword [ebp - 0x10], 0x9d5998d1
add edx, esi
sub dword [ebp - 0x20], ecx
mov dword [edi], edx
add dword [ebp - 8], ecx
add edi, 0x4e92d2f3
add edi, 0xb16d2d11
add ebx, 4
loop 0x40579d
add eax, 0x79671e5f
add eax, 0x8699f6f0
mov ebx, eax
add eax, 0x677da071
sub eax, 0x677da06c
mov ecx, 0xa471870a
sub ecx, 0xa431870a
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x5cfe26a9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5dd367c4
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403d20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
jmp 0x403d47
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jge 0x403db3
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0x10]
cmp ecx, 2
jl 0x403d7e
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
cmp eax, 0x2f72
jne 0x403d7e
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 1]
cmp edx, 0x2f6e
jne 0x403d7e
jmp 0x403d3e
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
movzx ecx, byte [eax]
cmp ecx, 0x2f6e
jne 0x403d91
jmp 0x403d3e
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
cmp eax, 0x3d
jne 0x403da8
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x403d3e
cmp dword [ebp - 0xc], 0
jne 0x403dc0
xor eax, eax
jmp 0x403eeb
mov edx, dword [ebp - 0xc]
imul edx, edx, 6
add edx, 7
sar edx, 3
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0xc]
jae 0x403deb
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, 0xfffffff0
jmp 0x403eeb
mov dword [ebp - 0x14], 3
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
jmp 0x403e19
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
cmp dword [ebp - 0x10], 0
jle 0x403ede
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
cmp eax, 0x2f72
je 0x403e3e
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp edx, 0x2f6e
jne 0x403e40
jmp 0x403e07
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
movzx edx, byte [ecx + 0x4853f0]
xor eax, eax
cmp edx, 0x40
sete al
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
shl edx, 6
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
movzx eax, byte [ecx + 0x4853f0]
and eax, 0x3f
or edx, eax
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 4
jne 0x403ed9
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x14], 0
jle 0x403ea8
mov edx, dword [ebp - 8]
shr edx, 0x10
mov eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x14], 1
jle 0x403ec2
mov edx, dword [ebp - 8]
shr edx, 8
mov eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x14], 2
jle 0x403ed9
mov edx, dword [ebp - 4]
mov al, byte [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x403e07
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407580
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478148
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48d744]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x20]
call fcn.004169e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00416630
lea ecx, [ebp - 0x20]
call fcn.00402850
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4075f4
cmp dword [ebp - 0x30], 1
je 0x4075fd
cmp dword [ebp - 0x30], 2
je 0x407606
jmp 0x40760d
mov dword [ebp - 0x14], connect
jmp 0x40760d
mov dword [ebp - 0x14], 0x40000000
jmp 0x40760d
mov dword [ebp - 0x14], 0xc0000000
push 0
push 0x80
push 4
push 0
push 3
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x1c], 0xffffffff
jne 0x407669
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
push 0x4831a4
call fcn.0044b4a1
add esp, 8
mov byte [ebp - 0x25], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416a10
mov al, byte [ebp - 0x25]
jmp 0x407694
push 0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x20], eax
mov byte [ebp - 0x26], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416a10
mov al, byte [ebp - 0x26]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4076b0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x1c], 0xffffffff
je 0x4076cb
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x1c], 0
jne 0x4076d2
xor al, al
jmp 0x407760
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
mov byte [ebp - 0x11], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
jne 0x40771f
xor al, al
jmp 0x407760
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
ja 0x4076e4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 4]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0xc], edx
push 0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20], eax
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x407770
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x1c], 0xffffffff
je 0x40778b
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x1c], 0
jne 0x407792
xor al, al
jmp 0x40781c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne dl
mov byte [ebp - 0xd], dl
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x4077d3
xor al, al
jmp 0x40781c
cmp dword [ebp - 8], 0
jne 0x4077db
jmp 0x4077f3
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 4], 0
ja 0x4077a4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 4]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xc], ecx
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x20], eax
mov al, 1
mov esp, ebp
pop ebp
ret