joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416892
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x24]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
sub esp, 0x40
mov edx, dword [ebp + 0x20]
mov edi, esp
push 0x10
pop ecx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
dec ecx
jne 0x4168b2
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
push 9
pop edx
mov ecx, 0x2547a39e
sub ebx, 4
jb 0x4168f9
mov eax, dword [esp + edx*4]
mov esi, ecx
inc edx
shr esi, 6
shr eax, 1
and esi, 0xf
and edx, 0xf
xor eax, dword [esp + esi*4]
mov esi, ecx
xor eax, dword [edi]
and esi, 3
sub eax, dword [ebp + 0x20]
add ecx, dword [ebp + 0x20]
xor eax, dword [ebp + esi*4 - 0x10]
add ecx, eax
stosd dword es:[edi], eax
sub ebx, 4
jae 0x4168cc
and ebx, 3
je 0x41690f
xor eax, eax
mov esi, dword [ebp + 0x24]
mov al, byte [edi]
xor al, 0xbc
mov al, byte [esi + eax + 0x40]
stosb byte es:[edi], al
dec ebx
jne 0x416903
leave
pop edi
pop esi
pop ebx
ret 0x14

Function at 0x417624
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
push fcn.00431334
mov edi, dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
cmp edi, 0x13
jb 0x417697
cmp dword [esi], 0x48535153
jne 0x417697
cmp byte [esi + 4], 2
jne 0x417697
mov eax, dword [esi + 7]
lea ecx, [edi - 0x13]
cmp eax, ecx
jb 0x417650
xchg ecx, eax
lea edx, [esi + 0x13]
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x1c], edx
cmp byte [esi + 6], 0
je 0x417672
test ecx, ecx
je 0x417672
xor ebx, ebx
mov al, byte [edx]
sub al, bl
xor al, bl
mov byte [edx], al
inc edx
inc ebx
dec ecx
jne 0x417665
mov ecx, dword [esi + 0xb]
mov eax, dword [ebp + 0x18]
cmp eax, ecx
jb 0x41767d
xchg ecx, eax
mov dword [ebp + 0x18], eax
mov al, byte [esi + 5]
pop edx
cmp al, 1
jne 0x41768d
mov edx, 0x41769e
cmp al, 2
jne 0x417696
mov edx, fcn.0043141d
push edx
pop eax
leave
pop edi
pop esi
pop ebx
jmp eax

Function at 0x418303
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
push ecx
mov ebx, dword [ebp + 0x18]
add ebx, 8
imul ebx, dword [ebp + 0x14]
mov eax, esp
push ebp
mov ebp, dword [ebp]
push 0
push ebx
push 0
push eax
call fcn.004016b7
pop ebp
jb 0x41836b
mov esi, dword [ebp - 4]
xor edx, edx
xor ecx, ecx
mov eax, edx
imul eax, ecx
lea eax, [eax + eax*2]
add eax, dword [ebp + 0x1c]
xor byte [esi + ecx], al
inc ecx
cmp ecx, dword [ebp + 0x18]
jb 0x41832f
add esi, ecx
movzx ecx, byte [ebp + 0x1d]
mov eax, dword [ebp + 0x20]
xor dword [esi + ecx*4], eax
inc edx
add esi, 8
cmp edx, dword [ebp + 0x14]
jb 0x41832d
mov esi, dword [ebp - 4]
mov ebp, dword [ebp]
push edx
call fcn.0040179b
push ebx
push esi
call fcn.00401976
pop eax
pop ebp
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x418373
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov esi, dword [ebp + 0x14]
xor edx, edx
cmp byte [esi + edx], 0
je 0x41838a
inc edx
cmp edx, dword [ebp + 0x18]
jb 0x41837e
test edx, edx
je 0x4183b1
xor ebx, ebx
mov edi, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
mov ebp, dword [ebp + 0x1c]
test ecx, ecx
je 0x4183b1
movzx eax, byte [esi + ebx]
add eax, ebp
xor byte [edi], al
inc edi
inc ebx
inc ebp
cmp ebx, edx
sbb eax, eax
and ebx, eax
dec ecx
jne 0x41839d
pop ebp
pop edi
pop esi
pop ebx
ret 0x14

Function at 0x4188d5
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov ecx, dword [esi]
mov edx, 0x20000b
movzx eax, word [esi + 4]
dec ecx
sub edx, dword [esi + 0x10]
shr ecx, 0xf
lea edi, [eax - 1]
or edx, ecx
ror eax, 4
lea ecx, [eax + 3]
dec eax
shr eax, 1
or eax, edx
jne 0x41892e
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
add eax, edi
add edx, edi
movsx edi, word [esi + 6]
shr eax, cl
shr edx, cl
shr edi, 0xf
sub ax, word [esi + 0x1c]
sub dx, word [esi + 0x1e]
or eax, dword [esi + 8]
or edx, dword [esi + 0xc]
or eax, edi
or eax, edx
je 0x418936
stc
leave
pop edi
pop esi
pop ebx
ret 8
movzx eax, word [esi + 6]
mov edi, eax
shl eax, 2
sub ebx, eax
jb 0x41892e
push ecx
mov ecx, dword [esi]
movzx eax, word [esi + 0x1c]
movzx edx, word [esi + 0x1e]
shl ecx, 1
imul eax, edx
mul ecx
test edx, edx
jne 0x41892e
sub ebx, eax
jb 0x41892e
mov dword [ebp + 0x18], ebx
shr eax, 1
xor edx, edx
xchg ebx, eax
lea esi, [esi + edi*4 + 0x20]
movzx eax, word [esi]
inc esi
inc esi
mov ecx, eax
add cx, di
jb 0x41897a
cmp edx, eax
jae 0x41897a
xchg edx, eax
dec ebx
jne 0x418969
pop ecx
push 4
shl ecx, 1
pop edi
shl edi, cl
inc edi
inc edi
imul edx, edi
cmp dword [ebp + 0x18], edx
jb 0x41892e
clc
jmp 0x41892f

Function at 0x41a2ba
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 8]
test ebx, ebx
je 0x41a2e1
push 0x40
pop eax
cmp ebx, eax
jb 0x41a2cf
xchg ebx, eax
xor ecx, ecx
mov al, byte [ecx + 0x41a2e5]
inc ecx
xor byte [edx], al
inc edx
and ecx, 0xf
dec ebx
jne 0x41a2d1
pop ebx
ret 8
Function at 0x41c56e
Capabilities:
Enumerate pe sections

Disassembly:
stc
leave
ret
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx eax, word [esi + 4]
movzx edx, word [esi + 6]
lea eax, [eax + eax*2]
not edx
lea eax, [esi + eax*8 + 8]
and edx, 0x10
sub esi, 0x10
shl edx, 6
xor edi, edi
lea esi, [esi + 0x18]
add eax, edi
mov edi, dword [esi + 0x14]
sub ecx, edx
jb 0x41c4f6
sub ecx, edi
jb 0x41c4f6
add edi, edx
dec ebx
jns 0x41c590
mov dword [ebp - 8], eax
mov edi, dword [esi]
mov edx, dword [esi + 4]
mov ebx, edi
mov ecx, dword [ebp - 4]
imul ebx, edx
add ecx, 0x78
push edx
push edi
push ecx
call fcn.00402122
jb 0x41c5f7
xchg edi, eax
mov eax, dword [esi + 0xc]
shl eax, 0x10
mov ax, word [esi + 8]
mov dword [edi + 8], eax
add edi, 0x12
cmp dword [ebp - 4], 0
jne 0x41c5f8
push dword [esi + 0x14]
mov esi, dword [ebp - 8]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
push esi
push ebx
push edi
call fcn.0041c644
clc
ret
lea ecx, [ebx + ebx*2]
push ecx
call fcn.00430880
jb 0x41c5f7
lea ecx, [ebx + ebx*2]
push dword [esi + 0x14]
xchg esi, eax
push dword [ebp - 8]
push ecx
push esi
call fcn.0041c644
push esi
push 3
pop eax
push edi
mov ecx, ebx
movsb byte es:[edi], byte [esi]
inc edi
inc edi
dec ecx
jne 0x41c61b
pop edi
inc edi
dec eax
jne 0x41c618
call fcn.004308ae
clc
ret

Function at 0x422609
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
sub ecx, 4
jb 0x4225da
pop eax
sub esp, 0x41c
mov edi, esp
push eax
mov dword [ebx], edi
xor ebx, ebx
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [edi + 8], ebx
or dword [edi + 0xc], 0xffffffff
mov dword [edi + 0x14], ebx
xor ecx, ecx
xor eax, eax
mov dl, 0x80
lodsb al, byte [esi]
xor al, dl
ror dl, 1
add ebx, eax
mov word [edi + ecx*4 + 0x16], ax
mov word [edi + ecx*4 + 0x18], bx
inc cl
jne 0x422636
inc ebx
mov dword [edi + 0x10], ebx
ret

Function at 0x422be5
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
test esi, esi
je 0x422c0f
xor ebx, ebx
xor ecx, ecx
mov al, byte [ecx + 0x422c15]
add al, bl
xor byte [edi + ebx], al
inc ecx
inc ebx
cmp ecx, 0xb
sbb eax, eax
and ecx, eax
dec esi
jne 0x422bf8
pop edi
pop esi
pop ebx
ret 8

Function at 0x425502
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ebx + 3]
mov eax, dword [esi + 4]
add esi, 8
xor eax, 0xdeadbeef
mov edx, esi
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0x425515
ret

Function at 0x425f37
Capabilities:
Encode data using xor

Disassembly:
mov edx, esp
push ebx
push esi
push edi
mov esi, dword [edx + 4]
mov edi, dword [edx + 8]
mov ebx, dword [edx + 0xc]
mov eax, 0x200
cmp ebx, eax
jb 0x425f4f
xchg ebx, eax
xor edx, edx
shr ebx, 2
je 0x425f6a
mov eax, dword [edi]
mov cl, byte [edx + 0x425f70]
inc edx
rol eax, cl
and edx, 7
xor eax, esi
stosd dword es:[edi], eax
dec ebx
jne 0x425f56
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x42732f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebp - 4]
add dword [ebp - 4], ebx
mov eax, 0xaaaaaaab
mul ecx
shr edx, 3
imul edx, edx, 0xc
sub ecx, edx
mov al, byte [ebp + ecx - 0x14]
inc ecx
xor byte [esi], al
inc esi
cmp ecx, 0xc
sbb eax, eax
and ecx, eax
dec ebx
jne 0x427344
ret

Function at 0x42837b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x14]
lea edi, [esi + ebx]
lea ecx, [ebx + 4]
stosd dword es:[edi], eax
test eax, eax
xchg ecx, eax
je 0x4283d7
lea eax, [ebx + ecx - 1]
xor edx, edx
div ecx
stosd dword es:[edi], eax
lea eax, [edi + eax*2]
push eax
push edi
xchg edi, eax
xor eax, eax
rep stosb byte es:[edi], al
sub edi, esi
mov dword [ebp + 0x1c], edi
pop edi
test ebx, ebx
je 0x4283d4
mov ecx, dword [ebp + 0x14]
sub ebx, ecx
jae 0x4283bb
add ecx, ebx
xor ebx, ebx
mov edx, dword [ebp - 4]
push ecx
push esi
lodsb al, byte [esi]
xor byte [edx], al
inc edx
dec ecx
jne 0x4283c0
push 1
call fcn.00431fc3
stosw word es:[edi], ax
test ebx, ebx
jne 0x4283b0
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
leave
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x42c601
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x20]
shl edi, 6
mov esi, dword [ebp + 0x18]
add edi, dword [ebp + 0x1c]
call fcn.0042c71f
mov eax, dword [edi]
mov edx, dword [edi + 4]
xor dword [esi], eax
xor dword [esi + 4], edx
mov eax, dword [edi + 8]
mov edx, dword [edi + 0xc]
xor dword [esi + 8], eax
xor dword [esi + 0xc], edx
sub edi, 8
jmp 0x42c662
mov eax, dword [esi]
and eax, dword [edi]
rol eax, 1
mov edx, dword [edi + 4]
xor eax, dword [esi + 4]
or edx, eax
mov dword [esi + 4], eax
xor dword [esi], edx
mov eax, dword [esi + 0xc]
or eax, dword [edi - 4]
mov edx, dword [edi - 8]
xor eax, dword [esi + 8]
and edx, eax
rol edx, 1
mov dword [esi + 8], eax
xor dword [esi + 0xc], edx
sub edi, 0x10
push 3
pop ecx
push ecx
call fcn.0042c6b7
xor dword [esi], eax
xor dword [esi + 4], ecx
call fcn.0042c6b7
sub esi, 0x10
xor dword [esi], eax
xor dword [esi + 4], ecx
pop ecx
dec ecx
jne 0x42c665
dec dword [esp + 0x14]
jne 0x42c636
sub edi, 8
mov eax, dword [esi + 8]
mov edx, dword [esi]
xor eax, dword [edi]
xor edx, dword [edi + 8]
mov dword [esi], eax
mov dword [esi + 8], edx
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
xor eax, dword [edi + 4]
xor edx, dword [edi + 0xc]
mov dword [esi + 4], eax
mov dword [esi + 0xc], edx
call fcn.0042c71f
pop ebp
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x42cf17
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
enter 0xc8, 0
mov ebx, esp
add esp, 0xffffff80
mov edi, esp
mov eax, dword [ebp + 0x18]
mov dword [ebx], eax
and dword [ebx + 4], 0
push edi
push 8
push ebx
call fcn.00434e99
lea edx, [edi + 0x10]
push edx
push 8
push ebx
call fcn.00435059
push 4
pop ecx
mov eax, 0x36363636
mov edx, dword [edi + 0x10]
xor edx, eax
xor dword [edi], edx
add edi, 4
dec ecx
jne 0x42cf4b
add ecx, 0x1c
rep stosd dword es:[edi], eax
mov edi, esp
mov esi, 0x80
push ebx
call fcn.00435120
push esi
push edi
push ebx
call fcn.00435178
push 0x50
push dword [ebp + 0x14]
push ebx
call fcn.00435178
sub esp, 0x40
push esp
push ebx
call fcn.004351ee
xor ecx, ecx
xor dword [edi + ecx*4], 0x6a6a6a6a
inc ecx
cmp ecx, 0x20
jb 0x42cf89
push ebx
call fcn.00435120
push esi
push edi
push ebx
call fcn.00435178
mov edx, esp
push 0x40
push edx
push ebx
call fcn.00435178
push dword [ebp + 0x1c]
push ebx
call fcn.004351ee
leave
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x42d3ae
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov esi, dword [ebp + 0x14]
mov edx, dword [esi]
push dword [esi + 4]
mov ecx, edx
mov eax, dword [esi + 0xc]
neg ecx
lea eax, [eax + ecx*4]
mov dword [ebp + 0x14], eax
mov ebx, dword [ebp + 0x18]
mov esi, dword [esi + 8]
mov ecx, edx
mov edi, esi
lodsd eax, dword [esi]
xor eax, ebx
shr eax, 0x18
stosb byte es:[edi], al
dec ecx
jne 0x42d3d3
add esi, dword [ebp + 0x14]
dec dword [ebp - 4]
jne 0x42d3cf
leave
pop edi
pop esi
pop ebx
ret 8

Function at 0x42d445
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov edx, dword [esi]
push dword [esi + 4]
mov ecx, edx
mov eax, dword [edi + 0xc]
neg ecx
lea eax, [eax + ecx*4]
add ecx, dword [esi + 0xc]
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], ecx
mov esi, dword [esi + 8]
mov edi, dword [edi + 8]
mov ebx, dword [ebp + 0x1c]
mov ecx, edx
movzx eax, byte [esi]
add edi, 4
xor eax, ebx
inc esi
mov byte [edi - 1], al
dec ecx
jne 0x42d474
add esi, dword [ebp + 0x18]
add edi, dword [ebp + 0x14]
dec dword [ebp - 4]
jne 0x42d472
leave
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x42e0eb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
imul eax, ebx
shl eax, 2
add eax, 0xc
push eax
call fcn.00430880
jb 0x42e14f
push ebx
push eax
xchg edi, eax
mov eax, dword [esi]
stosd dword es:[edi], eax
xchg edx, eax
mov eax, ebx
stosd dword es:[edi], eax
imul eax, edx
stosd dword es:[edi], eax
mov ecx, edx
mov eax, dword [esi + 0xc]
neg ecx
mov esi, dword [esi + 8]
lea eax, [eax + ecx*4]
mov dword [ebp + 0x14], eax
xor ebx, ebx
mov ecx, edx
lodsd eax, dword [esi]
ror eax, 8
shr ah, 3
shr ax, 2
ror eax, 0xb
shr ax, 5
xor al, 0xff
or ebx, eax
stosd dword es:[edi], eax
dec ecx
jne 0x42e12c
add esi, dword [ebp + 0x14]
dec dword [ebp - 4]
jne 0x42e12a
pop eax
movzx edx, bl
leave
pop edi
pop esi
pop ebx
ret 4
Function at 0x42e159
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
imul eax, ebx
shl eax, 2
add eax, 0xc
push eax
call fcn.00430880
jb 0x42e1af
push ebx
push eax
xchg edi, eax
mov eax, dword [esi]
stosd dword es:[edi], eax
xchg edx, eax
mov eax, ebx
stosd dword es:[edi], eax
imul eax, edx
stosd dword es:[edi], eax
mov ecx, edx
mov eax, dword [esi + 0xc]
neg ecx
mov esi, dword [esi + 8]
lea eax, [eax + ecx*4]
mov dword [ebp + 0x14], eax
xor ebx, ebx
mov ecx, edx
lodsd eax, dword [esi]
xor eax, 0xff000000
stosd dword es:[edi], eax
or ebx, eax
dec ecx
jne 0x42e19a
add esi, dword [ebp + 0x14]
dec dword [ebp - 4]
jne 0x42e198
pop eax
mov edx, ebx
shr edx, 0x18
leave
pop edi
pop esi
pop ebx
ret 4

Function at 0x42eafa
Capabilities:
Hash data using crc32b

Disassembly:
lodsd eax, dword [esi]
dec dword [ebp + 0x20]
je 0x42eaae
imul eax, dword [esi], 0x4c11db7
imul edx, dword [esi + 4], 0x17c59493
xor eax, edx
shr eax, 0x10
mov edx, dword [ebp - 4]
mov ecx, esi
xchg dword [edx + eax*4], ecx
sub ecx, esi
shr ecx, 2
cmp ecx, 0xfffff001
sbb eax, eax
neg ecx
mov edx, esi
or ecx, eax
shr edx, 2
mov eax, dword [ebp - 8]
and edx, 0xfff
mov word [eax + edx*2], cx
add esi, 4
ret

Function at 0x42eb40
Capabilities:
Hash data using crc32b

Disassembly:
push edi
push 0
push 1
mov ebx, 0xfff
cmp ecx, ebx
jae 0x42eb50
mov ebx, ecx
imul eax, dword [esi], 0x4c11db7
imul edx, dword [esi + 4], 0x17c59493
xor eax, edx
shr eax, 0x10
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + eax*4]
sub ecx, esi
sar ecx, 2
jmp 0x42ebaa
lea edi, [esi + ecx*4]
push ecx
neg ecx
xor edx, edx
cmp ecx, ebx
jb 0x42eb7d
mov ecx, ebx
mov eax, dword [esi + edx*4]
cmp dword [edi + edx*4], eax
jne 0x42eb8a
inc edx
cmp edx, ecx
jb 0x42eb7d
pop ecx
pop eax
cmp eax, edx
jae 0x42eb97
xchg edx, eax
pop edx
cmp eax, ebx
jae 0x42ebb4
push ecx
push eax
shr edi, 2
and edi, 0xfff
mov edx, dword [ebp - 8]
movzx edi, word [edx + edi*2]
sub ecx, edi
cmp ecx, 0xfffff001
jae 0x42eb6f
pop eax
pop ecx
pop edi
ret
Function at 0x42ee86
Capabilities:
Encode data using xor

Disassembly:
call fcn.00431089
jb 0x42ef68
push eax
push dword [ebp + 0x10]
call fcn.00430f1a
jb 0x42ef6e
push eax
push dword [ebp + 0x14]
push 1
call fcn.0042b8f2
jb 0x42ef6e
push eax
xchg esi, eax
mov ebx, dword [esi]
push ebx
lea eax, [ebx + 0x3f]
shr eax, 6
add eax, ebx
imul ebx, dword [esi + 4]
imul eax, dword [esi + 4]
push eax
lea edi, [eax + 0x30c]
lea eax, [edi + ebx]
push eax
call fcn.00430880
jb 0x42ef6e
xchg esi, eax
add edi, esi
push esi
push edi
mov edi, esi
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
stosd dword es:[edi], eax
mov eax, dword [esi + 4]
shl eax, 0x10
mov ax, word [esi]
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
mov esi, dword [esi + 0x18]
mov ecx, pe_nt_image_headers32
movsb byte es:[edi], byte [esi]
lodsw ax, word [esi]
xchg ah, al
stosw word es:[edi], ax
inc esi
dec ecx
jne 0x42eeff
pop edi
pop esi
push dword [ebp - 0xc]
push edi
call fcn.0042ef76
push dword [ebp - 0xc]
call fcn.004308ae
mov dword [ebp - 0xc], esi
mov eax, 0x30c
xchg edi, eax
lea edx, [esi + edi]
push dword [ebp - 0x10]
push ebx
push eax
push dword [ebp - 0x14]
push edx
call fcn.0042efa1
lea ebx, [eax + edi]
cmp dword [ebp - 4], 1
je 0x42ef53
mov edx, esi
xor ecx, ecx
mov al, byte [edx]
xor al, 0xf3
add al, cl
add cl, 7
mov byte [edx], al
inc edx
dec edi
jne 0x42ef44
push 0x21
push dword [ebp + 0x18]
call fcn.00430960
jb 0x42ef68
xchg edi, eax
push ebx
push esi
push edi
call fcn.004308ec
push edi
call fcn.0043098d
push esi
call fcn.004308ae
leave
ret

Function at 0x4308c9
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, esp
push 0
push ecx
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
call sub.KERNEL32.DLL_ReadFile
add eax, 0xffffffff
pop eax
sbb ecx, ecx
and eax, ecx
cmp eax, dword [esp + 0xc]
ret 0xc

Function at 0x4308ec
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, esp
push 0
push ecx
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
call sub.KERNEL32.DLL_WriteFile
add eax, 0xffffffff
pop eax
sbb ecx, ecx
and eax, ecx
cmp eax, dword [esp + 0xc]
ret 0xc
Function at 0x430992
Capabilities:
Accept command line arguments

Disassembly:
call sub.KERNEL32.DLL_GetCommandLineW
test eax, eax
jne 0x4309a0
pop edx
push eax
push eax
push edx
ret
push esi
push edi
push eax
xor edi, edi
xchg esi, eax
cld
xor edx, edx
xor eax, eax
lea ecx, [eax + 0x20]
lodsw ax, word [esi]
cmp eax, ecx
je 0x4309ae
test eax, eax
je 0x4309d9
add edx, esi
cmp eax, 0x22
jne 0x4309c5
inc edx
inc edx
mov ecx, eax
lodsw ax, word [esi]
test eax, eax
je 0x4309cd
cmp eax, ecx
jne 0x4309c3
dec edx
dec edx
inc edi
sub edx, esi
and edx, 0xfffffffc
test eax, eax
jne 0x4309a9
pop esi
neg edx
lea ecx, [edx + edi*4 + 8]
mov edx, esp
mov eax, 0xfffff000
add ecx, eax
jae 0x4309f4
lea esp, [esp + eax + 4]
push eax
add ecx, eax
jb 0x4309eb
sub ecx, eax
sub esp, ecx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov edx, dword [edx + 8]
add esp, 0xc
lea edi, [esp + edi*4 + 8]
push edx
push ecx
xor edx, edx
push eax
mov dword [edi - 4], edx
xor eax, eax
lea ecx, [eax + 0x20]
lodsw ax, word [esi]
cmp eax, 0x20
je 0x430a14
test eax, eax
je 0x430a44
mov dword [esp + edx*4 + 0x10], edi
cmp eax, 0x22
jne 0x430a2c
mov ecx, eax
lodsw ax, word [esi]
stosw word es:[edi], ax
test eax, eax
je 0x430a36
cmp eax, ecx
jne 0x430a2a
mov byte [edi - 2], ah
add edi, 3
inc edx
and edi, 0xfffffffc
test eax, eax
jne 0x430a0f
pop edi
pop esi
mov dword [esp + 4], edx
xchg edx, eax
ret

Function at 0x430b11
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
push ecx
push ecx
enter 0x650, 0
mov dword [ebp + 8], esp
lea edi, [esp + 0x250]
or ebx, 0xffffffff
mov esi, dword [ebp + 0x20]
mov dword [ebp + 0x20], edi
xor eax, eax
test esi, esi
je 0x430b43
cmp word [esi], ax
je 0x430b43
call fcn.00430c06
je 0x430bdd
mov dword [ebp + 4], edi
mov dword [edi], 0x2a
push dword [ebp + 8]
push dword [ebp + 0x20]
call sub.KERNEL32.DLL_FindFirstFileW
push ebx
push edi
mov ebx, eax
inc eax
je 0x430bbc
mov esi, dword [ebp + 8]
add esi, 0x2c
movzx eax, word [esi]
movzx edx, word [esi + 2]
test eax, eax
je 0x430ba6
cmp eax, 0x2e
jne 0x430b82
test edx, edx
je 0x430ba6
sub eax, edx
jne 0x430b82
cmp word [esi + 4], ax
je 0x430ba6
lodsw ax, word [esi]
cmp edi, ebp
je 0x430ba6
stosw word es:[edi], ax
test eax, eax
jne 0x430b82
mov esi, dword [ebp + 8]
call fcn.00430be6
je 0x430ba6
js 0x430bd0
test byte [esi], 0x10
je 0x430ba6
call fcn.00430c19
jne 0x430b46
mov edi, dword [esp]
push dword [ebp + 8]
push ebx
call sub.KERNEL32.DLL_FindNextFileW
test eax, eax
jne 0x430b5e
push ebx
call sub.KERNEL32.DLL_FindClose
pop edi
pop ebx
cmp ebx, 0xffffffff
je 0x430bdd
xor esi, esi
mov word [edi - 2], si
call fcn.00430be6
jns 0x430ba6
push ebx
call sub.KERNEL32.DLL_FindClose
pop edi
pop ebx
cmp ebx, 0xffffffff
jne 0x430bd0
leave
pop ecx
pop ecx
pop edi
pop esi
pop ebx
ret 8
Function at 0x430d0f
Capabilities:
Parse pe header

Disassembly:
push esi
mov ecx, dword [esp + 8]
mov esi, dword [ecx]
mov ecx, dword [ecx + 4]
cmp ecx, 0x40
jb 0x430d68
cmp word [esi], 0x5a4d
jne 0x430d68
mov edx, dword [esi + 0x3c]
lea eax, [edx + 0x78]
test edx, edx
js 0x430d68
cmp ecx, eax
jb 0x430d68
cmp dword [esi + edx], 0x4550
jne 0x430d68
cmp word [esi + edx + 0x18], 0x10b
jne 0x430d68
movzx eax, word [esi + edx + 0x14]
cmp eax, 0x60
jb 0x430d68
lea eax, [edx + eax + 0x18]
movzx edx, word [esi + edx + 6]
test edx, edx
je 0x430d68
imul edx, edx, 0x28
add eax, edx
cmp ecx, eax
jb 0x430d68
xchg esi, eax
jmp 0x430d6a
xor eax, eax
pop esi
ret 4

Function at 0x430d6e
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
add ecx, dword [ecx + 0x3c]
cmp edi, dword [ecx + 0x54]
mov eax, edi
jb 0x430dae
movzx edx, word [ecx + 0x14]
lea edx, [ecx + edx + 0x18]
movzx esi, word [ecx + 6]
mov ecx, dword [edx + 0xc]
mov eax, edi
test ecx, ecx
je 0x430da5
sub eax, ecx
jb 0x430da5
cmp eax, dword [edx + 0x10]
jae 0x430da5
add eax, dword [edx + 0x14]
jmp 0x430dae
add edx, 0x28
dec esi
jne 0x430d8e
or eax, 0xffffffff
cmp eax, 0xffffffff
cmc
pop edi
pop esi
ret 8

Function at 0x431f42
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, 0x43ac78
mov ecx, dword [ebx]
test ecx, ecx
jne 0x431f66
mov eax, ecx
push 8
pop edx
ror eax, 1
jb 0x431f5c
xor eax, 0x6db88320
dec edx
jne 0x431f53
mov dword [ebx + ecx*4], eax
inc cl
jne 0x431f4e
push esi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
shr ecx, 2
mov esi, dword [esp + 0x10]
je 0x431fa6
xor edx, edx
xor eax, dword [esi]
add esi, 4
movzx edx, al
shr eax, 8
xor eax, dword [ebx + edx*4]
movzx edx, al
shr eax, 8
xor eax, dword [ebx + edx*4]
movzx edx, al
shr eax, 8
xor eax, dword [ebx + edx*4]
movzx edx, al
shr eax, 8
xor eax, dword [ebx + edx*4]
dec ecx
jne 0x431f7a
mov ecx, dword [esp + 0x14]
and ecx, 3
je 0x431fbe
movzx edx, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [ebx + edx*4]
dec ecx
jne 0x431faf
pop esi
pop ebx
ret 0xc