joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460ed2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00460b4f

Function at 0x4679f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x467a1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x467a1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x3fc5008], 0x8088405
inc edx
mov dword [ebx + 0x3fc5008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d254
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d285
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d26d
add dl, dl
jne 0x41d290
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d2e1
xor eax, eax
add dl, dl
jne 0x41d29d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d37e
add dl, dl
jne 0x41d2ac
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d2d7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d27c
mov eax, 1
add dl, dl
jne 0x41d2ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d2e6
sub eax, ebx
mov ebx, 1
jne 0x41d32d
mov ecx, 1
add dl, dl
jne 0x41d313
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d31e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d30a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d33b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d39f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d27c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x3fa889e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f3ff
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
jmp 0x41f41e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f490
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f479
test esi, esi
jbe 0x41f490
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f46b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f490
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f448
jmp 0x41f490
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f490
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3fa88a5
ret
Function at 0x4205fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x3fa9c17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420637
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420650
lea eax, [ebp - 0x10]
mov edx, dword [0x3fc75f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420663
lea eax, [ebp - 0x10]
mov edx, dword [0x3fc75f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42066f
adc edx, 0
mov edx, dword [edx*4 + 0x3fc63fc]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4207e9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4207dc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4207dc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42077a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42077a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42077a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42077a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4207dc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4207dc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420801
inc ebx
cmp ebx, 0x19
jne 0x420629
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3fa9c1e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x736c128e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x6f8f4260
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x18]
push esi
push str.getvar:_s
push 3
call fcn.00401890
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], ebx
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x50], eax
pop eax
pop edx
push esi
push str.checking__s
call fcn.00401e80
add esp, 0x10
mov dword [edi + 0x54], eax
mov eax, 0x402470
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x401f83
mov eax, 0x402490
mov ecx, dword [edi + 0x4c]
mov dword [edi + 0x58], eax
test ecx, ecx
je 0x401f95
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 8], 0x41d112
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00402d60

Function at 0x402a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0x5d2
push 1
push str.usage:_fastboot____option_____command__n_ncommands:_n__update__filename_________________________reflash_device_from_update.zip_n__flashall_________________________________flash_boot__recovery__system_n__flash__partition_____filename____________write_a_file_to_a_flash_partition_n__erase__partition_________________________erase_a_flash_partition_n__format__partition________________________format_a_flash_partition__n__getvar__variable_________________________display_a_bootloader_variable_n__boot__kernel_____ramdisk_________________download_and_boot_kernel_n__flash:raw_boot__kernel_____ramdisk_______create_bootimage_and_flash_it_n__devices__________________________________list_all_connected_devices_n__continue_________________________________continue_with_autoboot_n__reboot___________________________________reboot_device_normally_n__reboot_bootloader________________________reboot_device_into_bootloader_n__help_____________________________________show_this_help_message_n_noptions:_n___w_______________________________________erase_userdata_and_cache_n___s__serial_number________________________specify_device_serial_number_n___p__product______________________________specify_product_name_n___c__cmdline______________________________override_kernel_commandline_n___i__vendor_id____________________________specify_a_custom_USB_vendor_id_n___b__base_addr____________________________specify_a_custom_kernel_base_address_n___n__page_size____________________________specify_the_nand_page_size._default:_2048_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
leave
ret
Function at 0x402ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
test esi, esi
je 0x402c04
push eax
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.00404390
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x402c22
cld
mov edi, str.ANDROID_
mov ecx, 8
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x402bb0
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402bdf
push eax
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00404390
add esp, 0x10
mov esi, eax
test eax, eax
je 0x402c58
mov edi, dword [sym.imp.msvcrt.dll__iob]
add edi, 0x40
push edi
push 0x17
push 1
push str.creating_boot_image..._n
call sub.msvcrt.dll_fwrite
lea eax, [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [0x41c014]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push esi
mov edx, dword [ebp - 0x10]
push edx
push ebx
call fcn.00402520
add esp, 0x30
mov esi, eax
test eax, eax
je 0x402c3f
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x402b85
push eax
push eax
mov eax, dword [ebp + 0x18]
push eax
push esi
call fcn.00402610
add esp, 0x10
push eax
mov ebx, esi
mov eax, dword [ebp - 0x18]
push eax
push str.creating_boot_image____d_bytes_n
push edi
call sub.msvcrt.dll_fprintf
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov dword [edx], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x402bc6
push edi
push edi
mov esi, dword [ebp + 0x18]
push esi
push ebx
call fcn.00402610
add esp, 0x10
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x402be6
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x402b27
mov eax, dword [sym.imp.msvcrt.dll__iob]
xor ebx, ebx
add eax, 0x40
push eax
push 0x25
push 1
push str.cannot_boot_a_boot.img_and_ramdisk_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x402ba2
mov eax, dword [sym.imp.msvcrt.dll__iob]
xor ebx, ebx
add eax, 0x40
push eax
push 0x13
push 1
push str.no_image_specified_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x402ba2
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push esi
push str.cannot_load__s_n
push eax
call sub.msvcrt.dll_fprintf
add esp, 0x10
jmp 0x402ba2
push edi
push 0x1a
push 1
push str.failed_to_create_boot.img_n
call sub.msvcrt.dll_fwrite
xor ebx, ebx
add esp, 0x10
jmp 0x402ba2
push eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push str.cannot_load__s_n
push eax
call sub.msvcrt.dll_fprintf
add esp, 0x10
jmp 0x402ba2
Function at 0x402ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, dword [0x4240f8]
mov ebp, esp
test eax, eax
push esi
push ebx
je 0x402cb5
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov ebx, 1
add esi, 0x40
jmp 0x402cd4
sub esp, 0xc
xor ebx, ebx
push 1
call fcn.00403dc0
add esp, 0x10
sub esp, 0xc
push fcn.00402630
call fcn.00404290
add esp, 0x10
mov dword [0x4240f8], eax
test eax, eax
jne 0x402cae
test ebx, ebx
je 0x402cc5
push esi
push 0x17
push 1
push str.__waiting_for_device___n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x402cc5

Function at 0x402d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ebp + 0xc]
add ebx, 0x40
mov dword [ebp - 8], eax
push ebx
push 7
push 1
push str.error:
call sub.msvcrt.dll_fwrite
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push ebx
call sub.msvcrt.dll_vfprintf
pop ecx
pop eax
push ebx
push 0xa
call sub.msvcrt.dll_fputc
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea esi, [esi]
Function at 0x403240
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ecx, 5
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x19c
mov edi, str.boot
cld
mov esi, dword [ebp + 8]
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov esi, str.boot.img
cmp dl, al
jne 0x4032b4
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x403380
sub esp, 0xc
lea ebx, [ebp - 0x18f]
push ebx
call fcn.00404470
push esi
mov esi, dword [ebp + 0xc]
push esi
push str..._.._.._target_product__s__s
push ebx
call sub.msvcrt.dll_strlen
lea eax, [ebx + eax]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
push ebx
call sub.msvcrt.dll__strdup
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp + 8]
mov edi, str.recovery
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov esi, str.recovery.img
cmp dl, al
je 0x40326b
mov esi, dword [ebp + 8]
mov edi, str.system
mov ecx, 7
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov esi, str.system.img
cmp dl, al
je 0x40326b
mov esi, dword [ebp + 8]
mov edi, str.userdata
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov esi, str.userdata.img
cmp dl, al
je 0x40326b
mov esi, dword [ebp + 8]
mov edi, str.cache
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov esi, str.cache.img
cmp dl, al
je 0x40326b
mov esi, dword [ebp + 8]
mov edi, str.info
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov esi, str.android_info.txt
cmp dl, al
je 0x40326b
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push str.unknown_partition__s_n
push eax
call sub.msvcrt.dll_fprintf
xor eax, eax
add esp, 0x10
jmp 0x4032ac
sub esp, 0xc
push str.ANDROID_PRODUCT_OUT
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x403399
cmp byte [eax], 0
jne 0x4033b3
sub esp, 0xc
push str.neither__p_product_specified_nor_ANDROID_PRODUCT_OUT_set
call fcn.00402d60
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x18f]
push esi
push eax
push str._s__s
push ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call sub.msvcrt.dll__strdup
add esp, 0x10
jmp 0x4032ac
Function at 0x404390
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [ebp + 8]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
pop eax
xor eax, eax
cmp esi, 0xffffffff
je 0x4043e2
push eax
push eax
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
pop ecx
mov ebx, eax
pop edi
xor edi, edi
test eax, eax
jne 0x4043f0
sub esp, 0xc
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [eax], ebx
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov edi, eax
test eax, eax
je 0x404448
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push ebx
push edi
push esi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40441f
cmp ebx, dword [ebp - 0x10]
je 0x4043cf
mov eax, dword [ebp + 8]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push ebx
push str.load_file:_could_not_read__ld_bytes_from__s_n
push eax
call sub.msvcrt.dll_fprintf
mov dword [esp], edi
call sub.msvcrt.dll_free
xor edi, edi
xor ebx, ebx
add esp, 0x10
jmp 0x4043cf
mov eax, dword [sym.imp.msvcrt.dll__iob]
push edx
add eax, 0x40
push ebx
push 0x41e068
push eax
call sub.msvcrt.dll_fprintf
xor ebx, ebx
add esp, 0x10
jmp 0x4043cf
Function at 0x4136a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
xor edx, 0xffffffff
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x4136d0
xor ecx, ecx
mov al, byte [ecx + esi]
inc ecx
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x422ee0]
cmp ecx, ebx
jne 0x4136b7
xor edx, 0xffffffff
pop ebx
mov eax, edx
pop esi
pop ebp
ret

Function at 0x413700
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push str.wipe_block_device
push 0x4232e0
push eax
call fcn.004136e0
mov eax, dword [0x424108]
add esp, 0x10
test eax, eax
je 0x413731
mov eax, 1
leave
ret
push ecx
push ecx
push 1
push 0x424be0
call sub.msvcrt.dll_longjmp
nop

Function at 0x413740
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
pop ebp
ret
Function at 0x415340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea eax, [eax + 0x64]
sub esp, 0x1c
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x74]
xor esi, esi
mov dword [ebp - 0x1c], eax
mov edx, dword [ebx + 0x68]
test edx, edx
je 0x4153cc
push eax
push eax
push 0
mov edi, dword [ebp - 0x18]
push edi
call fcn.004054f0
add esp, 0x10
mov esi, eax
cmp eax, 0xfffffffe
je 0x415460
cmp eax, 2
je 0x415460
cmp eax, 0xfffffffc
je 0x41547c
cmp eax, 0xfffffffd
je 0x415498
mov eax, dword [ebx + 0x74]
test eax, eax
jne 0x4153c0
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebx + 0x74]
sub edx, edi
mov eax, dword [ebx + 0x70]
sub eax, edx
mov dword [ebx], edx
mov dword [ebx + 4], eax
xor eax, eax
dec esi
je 0x4153e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 1
je 0x41539d
mov edx, dword [ebx + 0x68]
test edx, edx
jne 0x415360
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4153ef
cmp eax, 0xfffffffb
je 0x4153ef
or eax, 0xffffffff
jmp 0x4153b4
mov dword [ebx + 0x30], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x40]
test eax, eax
jne 0x415446
mov eax, dword [ebx + 0x1c]
xor edi, edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [ebp - 0x14]
sub eax, edi
push eax
mov eax, dword [ebp - 0x10]
add eax, edi
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.msvcrt.dll__read
add esp, 0x10
cmp eax, 0
jle 0x4154b7
add edi, eax
cmp dword [ebp - 0x14], edi
ja 0x415404
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x24]
add ecx, edi
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], ecx
mov edx, dword [ebx + 0x68]
test edx, edx
jne 0x415360
push eax
push str.unexpected_end_of_file
push 0xfffffffffffffffb
push ebx
call fcn.0040bcd0
add esp, 0x10
jmp 0x41539d
push esi
push str.internal_error:_inflate_stream_corrupt
push 0xfffffffffffffffe
push ebx
call fcn.0040bcd0
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ecx
push str.out_of_memory
push 0xfffffffffffffffc
push ebx
call fcn.0040bcd0
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4154c5
push edx
push eax
push 0xfffffffffffffffd
push ebx
call fcn.0040bcd0
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
jne 0x4154cc
mov dword [ebx + 0x40], 1
jmp 0x41542d
mov eax, str.compressed_data_error
jmp 0x41549f
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push eax
call sub.msvcrt.dll_strerror
add esp, 0xc
push eax
push 0xffffffffffffffff
push ebx
call fcn.0040bcd0
or eax, 0xffffffff
add esp, 0x10
jmp 0x4153b4
Function at 0x4157d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, eax
nop
lea esi, [esi]
mov eax, dword [ebx + 0x30]
cmp eax, 1
je 0x415840
cmp eax, 2
je 0x415820
test eax, eax
jne 0x415802
mov eax, ebx
call fcn.00415500
inc eax
je 0x415838
mov ecx, dword [ebx + 0x30]
test ecx, ecx
je 0x415816
mov eax, dword [ebx]
test eax, eax
jne 0x415816
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x4157e0
mov eax, dword [ebx + 0x68]
test eax, eax
jne 0x4157e0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x1c]
add eax, eax
mov dword [ebx + 0x74], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x70], eax
mov eax, ebx
call fcn.00415340
inc eax
jne 0x415802
or eax, 0xffffffff
jmp 0x415818
mov eax, dword [ebx + 0x1c]
mov edi, dword [ebx + 0x28]
mov dword [ebx], 0
lea esi, [eax + eax]
nop
mov eax, dword [ebx]
push edx
mov edx, esi
mov ecx, dword [ebx + 0x14]
sub edx, eax
lea eax, [edi + eax]
push edx
push eax
push ecx
call sub.msvcrt.dll__read
add esp, 0x10
cmp eax, 0
jle 0x41587f
mov edx, dword [ebx]
add eax, edx
mov dword [ebx], eax
cmp esi, eax
ja 0x415850
mov eax, dword [ebx + 0x28]
mov dword [ebx + 4], eax
jmp 0x415816
jne 0x415890
mov dword [ebx + 0x40], 1
jmp 0x415877
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push eax
call sub.msvcrt.dll_strerror
add esp, 0xc
push eax
push 0xffffffffffffffff
push ebx
call fcn.0040bcd0
or eax, 0xffffffff
add esp, 0x10
jmp 0x415818