joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42aea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436e8d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [ebp + 0x20]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.00433240
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x30], eax
jae 0x42aef4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x20]
call fcn.004330b0
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x30], eax
jb 0x42aee0
xor edx, edx
test eax, eax
je 0x42af22
nop word [eax + eax]
cmp dword [ebp + 0x34], 0xf
lea eax, [ebp + 0x20]
cmova eax, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0xf
mov cl, byte [eax + edx]
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
xor byte [eax + edx], cl
inc edx
cmp edx, dword [ebp + 0x18]
jb 0x42af00
mov ecx, dword [ebp - 0x18]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, 0xf
mov dword [esi + 0x14], 0
movups xmm0, xmmword [ebp + 8]
mov byte [ebp + 8], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp + 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], eax
cmp ecx, eax
jbe 0x42af8c
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42af7f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42aff3
push ecx
push edx
call fcn.00435743
mov eax, dword [ebp + 0x1c]
add esp, 8
cmp eax, 0xf
jbe 0x42afbb
mov edx, dword [ebp + 8]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x42afb1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42aff3
push ecx
push edx
call fcn.00435743
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0xf
jbe 0x42b003
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42aff9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42aff9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00435743
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4312a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x4312c2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x4312b0
mov byte [esi + 6], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 5]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4312e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x431302
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x4312f0
mov byte [esi + 8], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 7]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x431342
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x431330
mov byte [esi + 7], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 6]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x431382
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x431370
mov byte [esi + 4], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 3]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4313a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x27], 0
je 0x4313c2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x26
jb 0x4313b0
mov byte [esi + 0x27], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x26]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4313e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x431402
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x4313f0
mov byte [esi + 0xb], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xa]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x431442
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x431430
mov byte [esi + 0xe], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xd]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x431460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x42], 0
je 0x431482
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x41
jb 0x431470
mov byte [esi + 0x42], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x41]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4314a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x4314c2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x3b
jb 0x4314b0
mov byte [esi + 0x3c], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x3b]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x431692
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0x431680
mov byte [esi + 0x29], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x28]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4316b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x4316d2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x2b
jb 0x4316c0
mov byte [esi + 0x2c], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2b]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4316f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x431712
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x431700
mov byte [esi + 0x1c], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1b]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x31], 0
je 0x431752
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x30
jb 0x431740
mov byte [esi + 0x31], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x30]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
je 0x431792
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x2c
jb 0x431780
mov byte [esi + 0x2d], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2c]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4317b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x4317d2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x4317c0
mov byte [esi + 0x16], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x15]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4317f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x32], 0
je 0x431812
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x31
jb 0x431800
mov byte [esi + 0x32], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x31]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x35], 0
je 0x431852
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x34
jb 0x431840
mov byte [esi + 0x35], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x34]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x431892
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x33
jb 0x431880
mov byte [esi + 0x34], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x33]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4318b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x4318d2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x4318c0
mov byte [esi + 0x14], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x13]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4318f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x431912
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x431900
mov byte [esi + 5], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x431952
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x431940
mov byte [esi + 0x11], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x431970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x431992
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x431980
mov byte [esi + 0x13], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x12]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4319b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x4319d2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x4319c0
mov byte [esi + 0xf], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xe]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x431da0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x431dcc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x431df4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x431dfa
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x431e62
jg 0x431e11
test esi, esi
je 0x431e62
test ecx, ecx
jl 0x431e5d
jg 0x431e1b
test eax, eax
je 0x431e5d
cmp edi, ecx
jg 0x431e2f
jl 0x431e25
cmp esi, eax
jae 0x431e2f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x431e65
mov ecx, dword [ebp + 8]
jmp 0x431e6f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x431e89
jg 0x431e6f
test esi, esi
je 0x431e89
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x431e89
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x431ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x431ec4
jl 0x431eb9
test ecx, ecx
jne 0x431ec4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x431ede
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x431f24
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x431f2a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp + 8], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x431f2a
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x431f99
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x431f56
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x431f87
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x431f99
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x431f63
test edi, edi
je 0x431f99
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x43233c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x43236e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x43236e
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x432431
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x432396
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4323a2
movsx eax, bl
jmp 0x4323da
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4323fa
sub eax, 1
je 0x4323fa
sub eax, 2
jne 0x432431
movsx eax, byte [ebp - 1]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x432418
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x432431
lea ecx, [ebp - 1]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 8], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4326a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x4326c2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x4326b0
mov byte [esi + 0xc], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xb]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4326e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x432702
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x4326f0
mov byte [esi + 3], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 2]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x432720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x432742
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x432730
mov byte [esi + 0xa], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 9]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x432760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x432782
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x432770
mov byte [esi + 0x12], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x11]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4327a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x4327c2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x4327b0
mov byte [esi + 0x10], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xf]
push eax
push esi
call fcn.00433f10
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x433550
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x433572
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x433560
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x433580
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x4335a2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x433590
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x4335b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x4335d2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x4335c0
mov byte [esi + 0x13], 0
pop esi
ret
Function at 0x4335e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x43366c
cmp byte [esi + 0x3d], 0
je 0x43366c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x433664
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x433635
sub eax, 1
je 0x433639
sub eax, 2
jne 0x433664
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x433657
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x433664
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x433850
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x433872
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x433860
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x433880
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x4338a2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x41]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x433890
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x436035
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x436074
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x436074
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x436074
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x436074
cmp dword [ecx + 0x74], 0xe
jbe 0x436074
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret