joyce8/EMBER2024-capa huggingface dataset:
Function at 0x534ade
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x54a859
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x54a866
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0054a872

Function at 0x54c157
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 8]
push esi
push edi
sub eax, 0
je 0x54c1d4
sub eax, 1
je 0x54c1c5
sub eax, 1
je 0x54c1b6
sub eax, 1
je 0x54c19e
sub eax, 1
je 0x54c191
sub eax, 1
jne 0x54c1ea
cmp byte [ecx], 0
mov eax, str.true
mov edx, str.false
cmove eax, edx
push eax
jmp 0x54c1d9
cmp dword [ecx], 0
mov eax, 0x5a8800
cmovne eax, dword [ecx]
jmp 0x54c18e
movsd xmm0, qword [ecx]
push ecx
push ecx
movsd qword [esp], xmm0
push dword [ebp + 8]
call fcn.0054de26
add esp, 0xc
jmp 0x54c1e1
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.0054df28
jmp 0x54c1b1
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.0054debd
jmp 0x54c1b1
push 0x5a8800
mov ecx, dword [ebp + 8]
call fcn.00407aa0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 4
push 8
pop ecx
mov esi, 0x59d3e8
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
call fcn.0050c309
int3

Function at 0x54c224
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 0xffffffff
jne 0x54c240
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x54c237
sub esi, ecx
mov eax, bind
cmp esi, 0x7fffffff
cmovae esi, eax
lea eax, [esi + 1]
push eax
call fcn.00510780
mov edi, eax
pop ecx
test edi, edi
je 0x54c275
push esi
push dword [ebp + 8]
push edi
call fcn.00505560
add esp, 0xc
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret
push 9
pop ecx
mov esi, str.Failed_to_allocate_string_value_buffer
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.0050c309
int3
Function at 0x55668e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
call fcn.0050e146
mov ecx, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0xc]
xorps xmm1, xmm1
movsd qword [ebp - 0x20], xmm1
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
mov al, byte [eax]
mov dword [esi], ecx
mov byte [ebp - 1], al
movzx eax, byte [ecx]
test byte [eax + 0x5a00b1], 8
je 0x5566d9
inc ecx
movzx eax, byte [ecx]
test byte [eax + 0x5a00b1], 8
jne 0x5566c9
mov dword [ebp + 8], ecx
lea eax, [ebp + 8]
push eax
call fcn.00555d1e
mov esi, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x18], eax
cmp byte [esi], 0x30
jne 0x556816
mov cl, byte [esi + 1]
cmp cl, 0x78
je 0x556703
cmp cl, 0x58
jne 0x556816
mov al, byte [ebp - 1]
add esi, 2
mov cl, byte [esi]
cmp cl, al
jne 0x55671e
cmp dword [ebp - 0xc], 0
jne 0x55677c
mov dword [ebp - 0xc], 1
jmp 0x556779
movzx eax, cl
test byte [eax + 0x5a00b1], 0x10
je 0x55677c
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x55673b
cmp cl, 0x30
jne 0x55673b
inc dword [ebp - 0x14]
jmp 0x55676f
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1e
jg 0x55676e
movsx eax, cl
push eax
call fcn.00556289
movsd xmm1, qword [ebp - 0x20]
mulsd xmm1, qword [0x59e288]
pop ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
jmp 0x55676f
inc edi
cmp dword [ebp - 0xc], 0
mov al, byte [ebp - 1]
je 0x556779
dec edi
inc esi
jmp 0x556709
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], edi
push 0
pop edi
add eax, ecx
je 0x556816
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov cl, byte [esi]
shl eax, 2
cmp cl, 0x70
je 0x5567a7
cmp cl, 0x50
jne 0x5567f7
lea eax, [ebp + 8]
inc esi
push eax
mov dword [ebp + 8], esi
call fcn.00555d1e
mov edx, dword [ebp + 8]
mov esi, eax
pop ecx
mov al, byte [edx]
movzx ecx, al
test byte [ecx + 0x5a00b1], 2
je 0x556816
imul ecx, edi, 0xa
movsx edi, al
add edi, 0xffffffd0
add edi, ecx
inc edx
movzx eax, byte [edx]
test byte [eax + 0x5a00b1], 2
mov al, byte [edx]
jne 0x5567c8
test esi, esi
je 0x5567e8
neg edi
mov ecx, dword [ebp - 8]
mov eax, ecx
mov esi, dword [ebp + 0xc]
shl eax, 2
add eax, edi
mov dword [esi], edx
cmp dword [ebp - 0x18], 0
je 0x556804
xorps xmm1, xmmword [0x5adff0]
push eax
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.0051054f
add esp, 0xc
jmp 0x556818
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55c608
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.004ffcc0
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1018], ebx
call fcn.0054ec21
push ebx
lea esi, [eax - 1]
mov dword [ebp - 0x1020], esi
call fcn.005695e3
pop ecx
pop ecx
test esi, esi
jne 0x55c67e
push 1
push ebx
push edi
call fcn.0055cc92
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov ebx, eax
inc esi
push dword [ebp - 0x1018]
call fcn.0050cd90
pop ecx
test eax, eax
je 0x55c7da
push 0
push 0
push edi
call fcn.00550281
jmp 0x55c7d5
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.005500f3
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [ebp - 0x1020]
add esp, 0xc
inc ebx
mov dword [ebp - 0x101c], esi
dec eax
mov dword [ebp - 0x1020], eax
test ebx, ebx
je 0x55c65b
push esi
push edi
call fcn.0054f9d7
pop ecx
pop ecx
cmp eax, 3
jne 0x55c74b
push esi
push edi
call fcn.0054ff80
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x55c6fb
mov ebx, dword [ebp - 0x1018]
push ebx
call fcn.0050d1e1
mov esi, eax
push ebx
push esi
call fcn.0050d93f
push 0x5a8800
push edi
call fcn.0054f0e7
xor ebx, ebx
add esp, 0x14
cmp esi, 0xffffffff
setne bl
jmp 0x55c743
lea eax, [ebp - 0x1014]
push eax
push edi
call fcn.0054fed4
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.0055080a
push dword [ebp - 0x1018]
push esi
push 1
push eax
call fcn.0050dd47
mov esi, eax
lea eax, [ebp - 0x1014]
add dword [ebp - 0x100c], esi
push eax
call fcn.00550889
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb ebx, ebx
neg ebx
mov esi, dword [ebp - 0x101c]
jmp 0x55c7af
push 0
push esi
push edi
call fcn.0054ffe0
add esp, 0xc
cmp byte [eax], 0x2a
jne 0x55c75d
inc eax
movsx eax, byte [eax]
sub eax, 0x4c
je 0x55c79c
sub eax, 0x15
je 0x55c789
sub eax, 0xb
je 0x55c785
dec eax
sub eax, 1
jne 0x55c7c9
push dword [ebp - 0x1018]
push edi
call fcn.0055cda7
pop ecx
pop ecx
jmp 0x55c7ad
push 1
jmp 0x55c79e
push dword [ebp - 0x1018]
push edi
call fcn.0055cc1e
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x55c7af
push 0
push dword [ebp - 0x1018]
push edi
call fcn.0055cc92
add esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x1020]
inc esi
mov dword [ebp - 0x101c], esi
test eax, eax
jne 0x55c6a2
jmp 0x55c65b
push str.invalid_format
push esi
push edi
call fcn.0054fdf7
add esp, 0xc
jmp 0x55c7f4
test ebx, ebx
jne 0x55c7ef
push 0xfffffffffffffffe
push edi
call fcn.0054f6a2
push edi
call fcn.0054f0b5
add esp, 0xc
sub esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x55c805
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.0054ec21
mov edi, dword [ebp + 0x10]
pop ecx
push 1
pop esi
sub eax, edi
je 0x55c8cb
dec eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.0054f9d7
pop ecx
pop ecx
cmp eax, 3
jne 0x55c89e
push edi
push ebx
call fcn.0054ecdc
pop ecx
pop ecx
push 0
push edi
push ebx
test eax, eax
je 0x55c860
call fcn.0054f82e
push edx
push eax
push str._lld
push dword [ebp + 0xc]
call fcn.0054ddd3
add esp, 0x1c
jmp 0x55c87b
call fcn.0054f8f7
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.0054ddd3
add esp, 0x10
test esi, esi
je 0x55c883
test eax, eax
jg 0x55c8c6
xor esi, esi
mov eax, dword [ebp - 4]
inc edi
test eax, eax
jne 0x55c824
test esi, esi
jne 0x55c8cb
push esi
push esi
push ebx
call fcn.00550281
add esp, 0xc
jmp 0x55c8ce
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
call fcn.0054ffe0
add esp, 0xc
test esi, esi
je 0x55c883
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.0050d5dc
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x55c883
xor esi, esi
inc esi
jmp 0x55c885
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x55cc1e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004ffcc0
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1014]
push esi
mov esi, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.0054fed4
pop ecx
pop ecx
mov edi, 0x1000
lea eax, [ebp - 0x1014]
push edi
push eax
call fcn.0055080a
push esi
push edi
push 1
push eax
call fcn.0050dd47
add dword [ebp - 0x100c], eax
add esp, 0x18
cmp eax, edi
je 0x55cc51
lea eax, [ebp - 0x1014]
push eax
call fcn.00550889
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x566a1e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5bfcc8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x5bfcb8
jne 0x566aa8
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00505ae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x444]
call fcn.00407830
push eax
mov ecx, edi
call fcn.00419100
push 0
push 1
lea ecx, [ebp - 0x444]
call fcn.00407d80
push ebx
lea ecx, [ebp - 0x42c]
call fcn.004078b0
cmp dword [0x5bfccc], 8
lea ecx, [ebp - 0x444]
cmovae edi, dword [0x5bfcb8]
push edi
call fcn.00407830
push str._install_path_
lea ecx, [ebp - 0x45c]
call fcn.00407830
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.00566969
add esp, 0xc
lea ecx, [ebp - 0x45c]
xor ebx, ebx
push ebx
push 1
call fcn.00407d80
push ebx
push 1
lea ecx, [ebp - 0x444]
call fcn.00407d80
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00505ae0
add esp, 0xc
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], 8
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
call fcn.00407830
cmp dword [esi + 0x14], 8
mov byte [ebp - 0x45d], 0x5c
mov byte [ebp - 0x45e], 0x2f
jb 0x566b7b
mov ecx, dword [esi]
jmp 0x566b7d
mov ecx, esi
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*2]
jb 0x566b8d
mov ecx, dword [esi]
jmp 0x566b8f
mov ecx, esi
lea edx, [ebp - 0x45d]
push edx
lea edx, [ebp - 0x45e]
push edx
push eax
push ecx
call fcn.004f3c59
add esp, 0x10
lea ecx, [ebp - 0x42c]
push ebx
push 1
call fcn.00407d80
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x566bc8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x22c
push 0
push eax
call fcn.00505ae0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x566c67
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x566c5c
cmp dword [edi + 0x14], 8
jb 0x566c2d
mov eax, dword [edi]
jmp 0x566c2f
mov eax, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x566c4f
lea eax, [ebp - 0x228]
mov ecx, ebx
push eax
call fcn.00567573
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x566c23
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret

Function at 0x566c78
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x260]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.00505ae0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x566cbb
xor al, al
jmp 0x566d2a
lea eax, [ebp - 0x260]
mov dword [ebp - 0x260], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x566d1d
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00407830
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004162d0
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.00423980
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.004081c0
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00407d80
lea eax, [ebp - 0x260]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x566cd4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x567db7
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
push ecx
push str.kernel32.dll
mov dword [ebx], ecx
mov dword [eax], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x567e2c
push esi
push edi
call fcn.004ff84f
pop ecx
mov esi, eax
xor eax, eax
push esi
push edi
push eax
push str.kernel32.dll
mov dword [ebp + 8], eax
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x567e24
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x5a4398
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x567e24
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call fcn.004ff84a
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x567e32
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
je 0x567e54
cmp word [ebp - 0x24], 6
je 0x567e54
xor al, al
jmp 0x567e56
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x5cf6a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x540015
lea edi, [esi - 0x13f015]
mov dword [edi + 0x1ba390], 0x608b6a37
push edi
or ebp, 0xffffffff
jmp 0x5cf6ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5cf6d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5cf6c0
mov eax, 1
add ebx, ebx
jne 0x5cf6e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5cf6f4
jne 0x5cf713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5cf713
dec eax
add ebx, ebx
jne 0x5cf700
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5cf6d8
add ebx, ebx
jne 0x5cf70f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5cf765
xor ecx, ecx
sub eax, 3
jb 0x5cf72b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5cf79a
sar eax, 1
mov ebp, eax
jmp 0x5cf736
add ebx, ebx
jne 0x5cf736
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5cf704
inc ecx
add ebx, ebx
jne 0x5cf744
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5cf704
add ebx, ebx
jne 0x5cf751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5cf746
jne 0x5cf762
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5cf746
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5cf784
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5cf776
jmp 0x5cf6c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5cf784
add edi, ecx
jmp 0x5cf6c6
pop esi
mov edi, esi
mov ecx, 0xead6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5cf7a2
cmp byte [edi], 0x27
jne 0x5cf7a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5cf7a7
lea edi, [esi + 0x1cc000]
mov eax, dword [edi]
or eax, eax
je 0x5cf816
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0664]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d0744]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5cf7d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d074c]
or eax, eax
je 0x5cf810
mov dword [ebx], eax
add ebx, 4
jmp 0x5cf7f1
call dword [esi + 0x1d0748]
mov ebp, dword [esi + 0x1d0750]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x1cf871]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5cf862
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x10002740
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
mov edi, edx
mov esi, ecx
test edx, edx
je 0x10002755
push edi
call sub.msvcrt.dll_strlen
add esp, 4
jmp 0x10002757
xor eax, eax
push esi
push eax
push 1
push edi
call sub.msvcrt.dll_fwrite
add esp, 0x10
push esi
call sub.msvcrt.dll_fflush
add esp, 4
pop esi
pop edi
ret

Function at 0x10006db0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
cmp dword [0x10019140], 0
je 0x10006e0f
mov eax, dword [0x10019328]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + eax*4]
lea edi, [eax + 0x1598]
call fcn.10006ca0
mov esi, edx
push edx
push eax
call dword [0x10019140]
test esi, esi
je 0x10006e06
test byte [esi + 3], 0x40
jne 0x10006e06
mov eax, dword [0x10019328]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 4]
mov edx, esi
call fcn.10004380
cmp byte [edi], 1
je 0x10006e3a
pop esi
pop edi
pop ebx
ret
mov esi, edx
push 2
mov ebx, ecx
call dword [0x100190f4]
add esp, 4
mov edi, eax
push eax
push esi
push 1
push ebx
call sub.msvcrt.dll_fwrite
add esp, 0x10
push edi
call sub.msvcrt.dll_fflush
add esp, 4
pop esi
pop edi
pop ebx
ret
mov byte [edi], 0
mov eax, dword [0x10019328]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0x159c]
mov eax, dword [eax + 0x159c]
mov edx, dword [eax + 0x1c]
push 0
call fcn.10005e10
pop esi
pop edi
pop ebx
ret

Function at 0x100073e0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov ebx, dword [fcn.1000ffc0]
push 2
call ebx
add esp, 4
mov esi, eax
push eax
push 0x10
push 1
push str.could_not_load:
call sub.msvcrt.dll_fwrite
add esp, 0x10
push esi
call sub.msvcrt.dll_fflush
add esp, 4
push 2
call ebx
add esp, 4
add edi, 4
cmp dword [esp + 0x10], 0
mov esi, eax
mov ebx, 0x10016750
cmovne ebx, edi
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
push esi
push eax
push 1
push ebx
call sub.msvcrt.dll_fwrite
add esp, 0x10
push esi
call sub.msvcrt.dll_fflush
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x1000747e
push 2
call dword [0x100190f4]
add esp, 4
mov esi, eax
push eax
push 0x30
push 1
push str._n_bad_format__library_may_be_wrong_architecture_
call sub.msvcrt.dll_fwrite
add esp, 0x10
push esi
call sub.msvcrt.dll_fflush
add esp, 4
push 2
call dword [0x100190f4]
add esp, 4
mov ecx, eax
mov edx, 0x10016626
call fcn.10002740
push 1
call sub.msvcrt.dll_exit
nop dword [eax]
push edi
push esi
mov esi, ecx
mov edi, dword [fcn.1000ffc0]
push 2
call edi
add esp, 4
mov ecx, eax
mov edx, str.could_not_import:
call fcn.10002740
push 2
call edi
add esp, 4
mov ecx, eax
mov edx, esi
call fcn.10002740
push 2
call edi
add esp, 4
mov ecx, eax
mov edx, 0x10016626
call fcn.10002740
push 1
call sub.msvcrt.dll_exit
nop word [eax + eax]
Function at 0x10007c80
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x18]
mov ebx, dword [fcn.1000ffc0]
push 2
call ebx
add esp, 4
add edi, 4
cmp dword [esp + 0x14], 0
mov esi, eax
mov ebp, 0x10016750
cmovne ebp, edi
push ebp
call sub.msvcrt.dll_strlen
add esp, 4
push esi
push eax
push 1
push ebp
call sub.msvcrt.dll_fwrite
add esp, 0x10
push esi
call sub.msvcrt.dll_fflush
add esp, 4
push 2
call ebx
add esp, 4
mov esi, eax
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 8
push esi
call sub.msvcrt.dll_fflush
add esp, 4
push dword [esp + 0x1c]
call sub.msvcrt.dll_exit
nop dword [eax]
test edx, edx
je 0x10007d4c
push ebx
push edi
push esi
mov esi, edx
movzx ebx, byte [edx]
test bl, bl
je 0x10007d49
mov edi, ecx
inc esi
jmp 0x10007d22
mov dword [edi], eax
mov ecx, dword [edi + 4]
mov byte [ecx + eax + 4], 0
movzx ebx, byte [esi]
inc esi
test bl, bl
je 0x10007d49
mov ecx, edi
mov edx, 1
call fcn.10006290
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov byte [ecx + eax + 4], bl
mov eax, dword [edi]
inc eax
jno 0x10007d10
call fcn.10003830
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x10007d22
pop esi
pop edi
pop ebx
ret
Function at 0x1000ae30
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
test ecx, ecx
je 0x1000af7f
push ebp
push ebx
push edi
push esi
sub esp, 0x10
cmp word [ecx], 0x5a4d
jne 0x1000af78
mov edx, dword [0x10019328]
mov esi, dword fs:[0x2c]
mov esi, dword [esi + edx*4]
mov edx, dword [ecx + 0x3c]
add edx, ecx
jno 0x1000ae75
mov edi, ecx
call fcn.10003830
xor eax, eax
test ecx, ecx
jne 0x1000ae95
jmp 0x1000af78
cmp dword [edx], 0x4550
jne 0x1000af78
mov edi, ecx
movzx ecx, word [edx + 0x16]
shr ecx, 0xd
and ecx, 1
test ecx, ecx
je 0x1000af78
lea ecx, [esi + 0x1598]
cmp byte [ecx], 0
jne 0x1000af78
mov edx, dword [edi + 0x3c]
add edx, edi
jno 0x1000aeb7
call fcn.10003830
xor eax, eax
jmp 0x1000af78
mov esi, dword [edx + 0x78]
cmp dword [edx + 0x7c], 0
setne dl
test esi, esi
setne dh
and dh, dl
cmp dh, 1
jne 0x1000af78
mov ecx, edi
add esi, edi
jo 0x1000aeab
mov edx, dword [esp + 0x24]
or edx, dword [esp + 0x28]
je 0x1000af78
mov edx, dword [esi + 0x18]
mov dword [esp + 8], edx
test edx, edx
js 0x1000af78
xor edx, edx
mov eax, dword [esi + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
cmp edx, 0x20000000
je 0x1000aeab
lea eax, [edx*4]
add eax, dword [esp + 0xc]
jo 0x1000aeab
add eax, ecx
jo 0x1000aeab
mov eax, dword [eax]
add eax, ecx
jo 0x1000aeab
mov dword [esp], edx
movzx edx, byte [eax]
mov ebx, 0xc0de1337
mov ebp, 0
test dl, dl
je 0x1000af5e
inc eax
xor ebp, ebp
nop word [eax + eax]
mov edi, ebp
or edi, ebx
shld edi, ebx, 0x18
movzx esi, dl
xor edx, edx
add esi, edi
setb dl
xor ebx, esi
xor ebp, edx
movzx edx, byte [eax]
inc eax
test dl, dl
jne 0x1000af40
xor ebx, dword [esp + 0x24]
xor ebp, dword [esp + 0x28]
or ebp, ebx
je 0x1000af82
mov esi, dword [esp]
lea edx, [esi + 1]
xor eax, eax
cmp esi, dword [esp + 8]
jl 0x1000af01
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, dword [esp]
mov eax, esi
add eax, 0x40000000
mov edx, dword [esp + 4]
js 0x1000aeab
add esi, esi
add esi, dword [edx + 0x24]
jo 0x1000aeab
add esi, ecx
jo 0x1000aeab
movzx eax, word [esi]
shl eax, 2
movzx eax, ax
add eax, dword [edx + 0x1c]
jo 0x1000aeab
add eax, ecx
jo 0x1000aeab
add ecx, dword [eax]
jo 0x1000aeab
mov eax, ecx
jmp 0x1000af78