joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x14c
mov edx, dword [esi + 0x3c]
lea eax, [esi + 0x88]
add eax, edx
lea ecx, [esi + 0x78]
add ecx, edx
cmp word [edx + esi + 4], di
cmovne ecx, eax
mov ecx, dword [ecx]
add ecx, esi
mov dword [ebp - 8], ecx
cmp ecx, esi
je 0x10001e35
cmp dword [ebp + 0x10], 0
ja 0x10001d7b
mov eax, dword [ebp + 0xc]
jb 0x10001d4a
cmp eax, 0xffff
ja 0x10001d7b
movzx edx, ax
xor eax, eax
sub edx, dword [ecx + 0x10]
sbb eax, eax
test eax, eax
ja 0x10001e35
jb 0x10001d67
cmp edx, dword [ecx + 0x14]
jae 0x10001e35
mov eax, dword [ecx + 0x1c]
pop edi
lea eax, [eax + edx*4]
mov eax, dword [eax + esi]
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, esi
mov dword [ebp - 0x14], eax
add edx, esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
cmp dword [ecx + 0x18], eax
jbe 0x10001e35
nop dword [eax]
mov ebx, dword [edx + eax*4]
add ebx, esi
mov esi, ebx
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001db0
sub esi, ecx
call fcn.10002730
push 0xeeeeeeee
push 0x7fed7fed
mov edi, eax
push edi
push 1
push esi
push ebx
call fcn.10002660
push 0xeeeeeeee
push 0x7fed7fed
push edi
push 2
push esi
push dword [ebp - 0xc]
mov ebx, eax
call fcn.10002660
xor ecx, ecx
or ecx, ebx
cmp dword [ebp + 0xc], eax
jne 0x10001dfa
cmp dword [ebp + 0x10], ecx
je 0x10001e11
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ecx + 0x18]
jae 0x10001e35
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
jmp 0x10001da0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx ecx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
add eax, ecx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10002660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100026ba
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
nop word [eax + eax]
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0x14]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002680
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x472520
Capabilities:
Authenticate hmac

Disassembly:
pushal
mov esi, section.EVA1
lea edi, [esi - 0x3b000]
mov dword [edi + 0x5a09c], 0x2cd83757
push edi
or ebp, 0xffffffff
jmp 0x47254a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x472551
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x472540
mov eax, 1
add ebx, ebx
jne 0x472563
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x472558
jne 0x472574
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x472558
xor ecx, ecx
sub eax, 3
jb 0x472588
shl eax, 8
mov al, byte [esi]
jmp 0x475000
add ebx, ebx
jne 0x472593
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4725a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4725c4
inc ecx
add ebx, ebx
jne 0x4725b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4725a5
jne 0x4725c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4725a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4725e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4725d5
jmp 0x472546
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4725e4
add edi, ecx
jmp 0x472546
Function at 0x404890
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, edx
mov ebx, ecx
push str.ANDROID_PRODUCT_OUT
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x4049ea
cmp byte [eax], 0
mov esi, eax
je 0x4049ea
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x4049f4
mov ecx, eax
cmp eax, 0xb
mov dword [esp + 0x14], edi
jae 0x404905
mov eax, ecx
lea edi, [esp + 1]
add al, cl
test ecx, ecx
mov byte [esp], al
jne 0x404932
jmp 0x404941
mov dword [esp + 0x10], ebx
mov ebx, ecx
add ebx, 0x10
and ebx, 0xfffffff0
push ebx
mov edi, ecx
call fcn.00416880
mov ecx, edi
add esp, 4
or ebx, 1
mov dword [esp + 8], eax
mov edi, eax
mov dword [esp], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ecx
push ecx
push esi
push edi
mov esi, ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, esi
add esp, 0xc
mov byte [edi + ecx], 0
mov ecx, esp
push 0x50d07c
call fcn.0041cd20
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
movzx eax, byte [edx]
test al, 1
je 0x40498b
mov ecx, dword [edx + 8]
mov eax, dword [edx + 4]
mov edx, ecx
jmp 0x40498e
inc edx
shr eax, 1
lea ecx, [esp + 0x18]
push eax
push edx
call fcn.0041cad0
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
movsd xmm0, qword [eax]
movsd qword [ebx], xmm0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax], 0
test byte [esp + 0x18], 1
je 0x4049ce
push dword [esp + 0x20]
call fcn.00416a20
add esp, 4
test byte [esp], 1
je 0x4049e0
push dword [esp + 8]
call fcn.00416a20
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.ANDROID_PRODUCT_OUT_not_set
call fcn.00422910
mov ecx, esp
call fcn.0041bfb0
nop dword [eax + eax]
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x18]
mov ecx, esp
call fcn.00404890
test byte [esp], 1
jne 0x404a2c
lea eax, [esp + 1]
push 0x8000
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__open
add esp, 8
mov esi, eax
jmp 0x404a49
mov edi, dword [esp + 8]
push 0x8000
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__open
add esp, 8
mov esi, eax
push edi
call fcn.00416a20
add esp, 4
mov eax, esi
add esp, 0xc
pop esi
pop edi
ret 4
Function at 0x407800
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push eax
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push str.fastboot:_usage:
push eax
call fcn.0040c070
add esp, 8
lea eax, [esp + 0x14]
mov dword [esp], eax
push 2
call esi
add esp, 4
push dword [esp]
push edi
push eax
call fcn.0040c310
add esp, 0xc
push 2
call esi
add esp, 4
push 0x50ca90
push eax
call fcn.0040c070
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax]
Function at 0x409c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [0x5364cc]
mov byte [esp + 4], 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 5], 0x746f6c73
mov dword [esp + 9], 0x756f632d
mov word [esp + 0xd], 0x746e
mov byte [esp + 0xf], 0
lea eax, [esp + 0x10]
lea edx, [esp + 4]
push 0
push eax
push edx
call fcn.0045c970
test eax, eax
je 0x409d15
test byte [esp + 4], 1
je 0x409d0a
push dword [esp + 0xc]
call fcn.00416a20
add esp, 4
xor esi, esi
test byte [esp + 0x10], 1
jne 0x409d64
jmp 0x409d70
test byte [esp + 0x10], 1
je 0x409d22
mov eax, dword [esp + 0x18]
jmp 0x409d26
lea eax, [esp + 0x11]
lea ecx, [esp + 0x1c]
push 0x7fffffff
push 0x80000000
push ecx
push eax
call fcn.0040c0b0
add esp, 0x10
test byte [esp + 4], 1
mov ebx, eax
je 0x409d53
push dword [esp + 0xc]
call fcn.00416a20
add esp, 4
xor esi, esi
test bl, bl
je 0x409d5d
mov esi, dword [esp + 0x1c]
test byte [esp + 0x10], 1
je 0x409d70
push dword [esp + 0x18]
call fcn.00416a20
add esp, 4
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x40cf70
Capabilities:
Parse credit card information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp esi, ebp
je 0x40d04c
movsx eax, byte [esi]
mov edi, ecx
cmp eax, 0x5b
jg 0x40d001
cmp eax, 0x24
je 0x40d026
cmp eax, 0x28
jne 0x40d04c
lea eax, [esi + 1]
cmp eax, ebp
je 0x40d04c
cmp byte [eax], 0x3f
jne 0x40d04c
lea eax, [esi + 2]
cmp eax, ebp
je 0x40d04c
movsx eax, byte [eax]
cmp eax, 0x21
je 0x40d0e1
cmp eax, 0x3d
jne 0x40d04c
mov ebx, esp
mov ecx, ebx
call fcn.0040dc60
mov eax, dword [edi + 0xc]
add esi, 3
mov ecx, ebx
mov dword [esp + 0xc], eax
push ebp
push esi
call fcn.0040c650
mov ebx, dword [esp + 0x10]
mov esi, eax
mov ecx, edi
push dword [edi + 0x10]
push 0
jmp 0x40d10a
cmp eax, 0x5c
je 0x40d058
cmp eax, 0x5e
jne 0x40d04c
push 8
call fcn.00416880
add esp, 4
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [eax], 0x50f0cc
jmp 0x40d03f
push 8
call fcn.00416880
add esp, 4
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [eax], 0x50f108
mov dword [ecx + 4], eax
inc esi
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [edi + 0x24], eax
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea eax, [esi + 1]
cmp eax, ebp
je 0x40d04c
mov al, byte [eax]
cmp al, 0x42
je 0x40d09f
cmp al, 0x62
jne 0x40d04c
push 0x18
call fcn.00416880
add esp, 4
mov ebx, eax
mov eax, dword [edi + 0x24]
lea ecx, [ebx + 8]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0x50f144
push edi
call fcn.004277a0
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x14], 0
jmp 0x40d0d3
push 0x18
call fcn.00416880
add esp, 4
mov ebx, eax
mov eax, dword [edi + 0x24]
lea ecx, [ebx + 8]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0x50f144
push edi
call fcn.004277a0
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x14], 1
mov eax, dword [edi + 0x24]
add esi, 2
mov dword [eax + 4], ebx
jmp 0x40d043
mov ebx, esp
mov ecx, ebx
call fcn.0040dc60
mov eax, dword [edi + 0xc]
add esi, 3
mov ecx, ebx
mov dword [esp + 0xc], eax
push ebp
push esi
call fcn.0040c650
mov ebx, dword [esp + 0x10]
mov esi, eax
mov ecx, edi
push dword [edi + 0x10]
push 1
lea eax, [esp + 8]
push eax
call fcn.0040dcc0
add dword [edi + 0x10], ebx
cmp esi, ebp
je 0x40d12d
cmp byte [esi], 0x29
jne 0x40d12d
mov ecx, esp
inc esi
call fcn.0040c040
jmp 0x40d04c
call fcn.0040dd50
int3
Function at 0x4217d0
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20c
mov edi, ecx
lea ebx, [esp + 4]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x42183d
mov esi, eax
cmp eax, 0x104
jae 0x421937
cmp word [esp + esi*2 + 2], 0x5c
jne 0x42180b
mov word [esp + esi*2 + 2], 0
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0
push edi
push ebx
call fcn.00477e40
add esp, 8
test al, al
je 0x421a25
mov eax, edi
add esp, 0x20c
pop esi
pop edi
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, esp
nop word cs:[eax + eax]
nop
mov ecx, esi
push 0xffffffffffffffff
push 0
push 6
push 0
push 0x71
push str.system_core_base_file.cpp
call fcn.00479090
mov ecx, esi
call fcn.00479080
push 0xe
push 0x5100e2
push eax
call fcn.00422660
add esp, 0xc
push 6
push 0x5100f1
push eax
call fcn.00422660
add esp, 0xc
push 1
push 0x5100f8
push eax
call fcn.00422660
add esp, 0xc
push 2
push 0x5100fa
push eax
call fcn.00422660
add esp, 0xc
push 1
push 0x5100f8
push eax
call fcn.00422660
add esp, 0xc
push 3
push 0x5100fd
push eax
call fcn.00422660
add esp, 0xc
push 9
push 0x510101
push eax
call fcn.00422660
add esp, 0xc
mov ecx, eax
push 0
call fcn.00484e10
push 6
push str.__0ul
push eax
call fcn.00422660
add esp, 0xc
mov ecx, eax
push 0
call fcn.00484e10
push 2
push 0x510112
push eax
call fcn.00422660
add esp, 0xc
push 0x1c
push str.GetTempPathW_failed__error:
push eax
call fcn.00422660
add esp, 0xc
mov edi, eax
call ebx
mov ecx, edi
push eax
call fcn.00484e10
mov ecx, esi
call fcn.00479180
jmp 0x421850
mov edi, esp
nop dword [eax]
mov ecx, edi
push 0xffffffffffffffff
push 0
push 6
push 0
push 0x72
push str.system_core_base_file.cpp
call fcn.00479090
mov ecx, edi
call fcn.00479080
push 0xe
push 0x5100e2
push eax
call fcn.00422660
add esp, 0xc
push 6
push 0x5100f1
push eax
call fcn.00422660
add esp, 0xc
push 1
push 0x5100f8
push eax
call fcn.00422660
add esp, 0xc
push 1
push 0x510132
push eax
call fcn.00422660
add esp, 0xc
push 1
push 0x5100f8
push eax
call fcn.00422660
add esp, 0xc
push 0x14
push str.std::size_tmp_dir_w_
push eax
call fcn.00422660
add esp, 0xc
push 9
push 0x510101
push eax
call fcn.00422660
add esp, 0xc
mov ecx, eax
push esi
call fcn.00484e10
push 0x17
push str.__std::size_tmp_dir_w_
push eax
call fcn.00422660
add esp, 0xc
mov ecx, eax
push 0x104
call fcn.00484950
push 2
push 0x510112
push eax
call fcn.00422660
add esp, 0xc
push 0x13
push str.path_truncated_to:
push eax
call fcn.00422660
add esp, 0xc
mov ecx, eax
push esi
call fcn.00484e10
mov ecx, edi
call fcn.00479180
jmp 0x421940
mov esi, esp
mov ecx, esi
push 0xffffffffffffffff
push 0
push 6
push 0
push 0x7b
push str.system_core_base_file.cpp
call fcn.00479090
mov ecx, esi
call fcn.00479080
push 0x3c
push str.Check_failed:_android::base::WideToUTF8_tmp_dir_w__tmp_dir_
push eax
call fcn.00422660
add esp, 0xc
push 1
push 0x5100f8
push eax
call fcn.00422660
add esp, 0xc
push 0x1f
push str.path_cant_be_converted_to_utf8
push eax
call fcn.00422660
add esp, 0xc
mov ecx, esi
call fcn.00479180
jmp 0x421831
Function at 0x421df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x238
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
test byte [esi], 1
jne 0x421e11
mov word [esi], 0
jmp 0x421e1e
mov ecx, dword [esi + 8]
mov byte [ecx], 0
mov dword [esi + 4], 0
mov edi, dword [eax]
mov eax, esp
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat32i64]
add esp, 8
cmp eax, 0xffffffff
je 0x421e4a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp eax, 1
sbb ecx, 0
jl 0x421e4a
mov ecx, esi
push eax
call fcn.0041c830
lea ebx, [esp + 0x34]
jmp 0x421e5b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x421e83
push 0x200
push ebx
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
je 0x421e50
test eax, eax
jle 0x421e7e
mov ecx, esi
push eax
push ebx
call fcn.0041cad0
jmp 0x421e5b
sete al
jmp 0x421e85
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4220d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea ebx, [esp + 0x14]
test esi, esi
je 0x42212c
nop word [eax + eax]
push esi
push edi
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
jne 0x422110
call ebp
cmp dword [eax], 4
je 0x4220f0
jmp 0x422125
mov ecx, eax
add edi, eax
xor eax, eax
test ecx, ecx
mov edx, ecx
cmovle edx, eax
sub esi, edx
test ecx, ecx
jg 0x4220e6
jmp 0x422127
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x422127

Function at 0x422130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], ecx
test ebx, ebx
jne 0x422181
jmp 0x4221fa
mov edi, esi
call esi
mov dword [eax], 5
call edi
cmp dword [eax], 4
jne 0x4221f0
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x20]
push ecx
push ebx
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422170
mov eax, dword [esp + 0x1c]
mov edi, esi
cmp eax, 0xffffffff
je 0x42217a
mov ecx, eax
add dword [esp + 0xc], eax
sub ebx, eax
mov esi, edi
sar ecx, 0x1f
add dword [esp + 0x10], eax
adc dword [esp + 0x14], ecx
test eax, eax
jg 0x422161
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x4221f2
Function at 0x422910
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea eax, [esp + 0x14]
mov dword [esp], eax
push 2
call edi
add esp, 4
push 0x510308
push eax
call fcn.0040c070
add esp, 8
push 2
call edi
add esp, 4
push dword [esp]
push esi
push eax
call fcn.0040c310
add esp, 0xc
push 2
call edi
add esp, 4
push 0x51031a
push eax
call fcn.0040c070
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax]
Function at 0x45c290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 0x10], 8
mov dword [esp + 0x11], 0x746f6f62
mov byte [esp + 0x15], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov byte [esp], 0xe
mov dword [esp + 4], 0x676e6974
mov dword [esp + 1], 0x746f6f42
mov esi, ecx
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x45c360
mov eax, dword [ecx]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edx, esp
push edx
call dword [eax + 0x18]
lea eax, [esp + 0x10]
mov ecx, esi
push 0
push edi
push ebx
push eax
call fcn.0045c9d0
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x45c360
mov edi, eax
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push edx
call dword [eax + 0x18]
test byte [esp], 1
je 0x45c341
push dword [esp + 8]
call fcn.00416a20
add esp, 4
test byte [esp + 0x10], 1
je 0x45c354
push dword [esp + 0x18]
call fcn.00416a20
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.0040c180
nop word cs:[eax + eax]
nop

Function at 0x45cc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 0x14], 0
mov byte [esp + 0xc], 0xc
mov dword [esp], 0
mov dword [esp + 0xd], 0x6f626572
mov word [esp + 0x11], 0x746f
mov byte [esp + 0x13], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov byte [esp], 0x12
mov dword [esp + 1], 0x6f626552
mov dword [esp + 5], 0x6e69746f
mov word [esp + 9], 0x67
mov esi, ecx
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x45ccde
mov eax, dword [ecx]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edx, esp
push edx
call dword [eax + 0x18]
lea eax, [esp + 0xc]
mov ecx, esi
push 0
push edi
push ebx
push eax
call fcn.0045c9d0
mov dword [esp + 0x18], eax
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x45ccde
mov edi, eax
mov eax, dword [ecx]
lea edx, [esp + 0x18]
push edx
call dword [eax + 0x18]
test byte [esp], 1
je 0x45ccbf
push dword [esp + 8]
call fcn.00416a20
add esp, 4
test byte [esp + 0xc], 1
je 0x45ccd2
push dword [esp + 0x14]
call fcn.00416a20
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.0040c180
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x45f9f0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
xor edi, edi
cmp dword [ecx + 0x40], 0
je 0x45fb7c
mov esi, ecx
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x45fb91
mov eax, dword [esi + 0x54]
test al, 0x10
jne 0x45fa41
test al, 8
je 0x45fb7a
mov eax, dword [esi + 0x4c]
mov dword [esp], eax
cmp byte [esi + 0x5a], 0
je 0x45fac5
mov ecx, dword [esi + 0x10]
xor ebx, ebx
sub ecx, dword [esi + 0xc]
mov eax, ecx
sar eax, 0x1f
jmp 0x45fb2a
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x14]
je 0x45fa5b
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0x34]
cmp eax, 0xffffffff
je 0x45fb44
lea ebp, [esi + 0x48]
nop
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x34]
lea ebx, [esp + 4]
mov edi, dword [ecx]
add edx, eax
push ebx
push edx
push eax
push ebp
call dword [edi + 0x14]
mov ebx, eax
mov edi, dword [esp + 4]
mov eax, dword [esi + 0x20]
sub edi, eax
push dword [esi + 0x40]
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, edi
mov edi, 0xffffffff
jne 0x45fb7c
cmp ebx, 1
je 0x45fa60
cmp ebx, 2
je 0x45fb7c
push dword [esi + 0x40]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
test eax, eax
jne 0x45fb7c
jmp 0x45fb7a
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
sub edi, edx
test eax, eax
jle 0x45faf1
mov ecx, dword [esi + 0x10]
mov edx, edi
sar edx, 0x1f
sub ecx, dword [esi + 0xc]
imul ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, edi
adc eax, edx
xor ebx, ebx
jmp 0x45fb2a
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x45fb86
mov ecx, dword [esi + 0x44]
sub eax, dword [esi + 8]
mov ebx, edi
sar ebx, 0x1f
mov ebp, dword [ecx]
push eax
push edx
push dword [esi + 0x20]
lea eax, [esp + 0xc]
push eax
call dword [ebp + 0x20]
mov ecx, dword [esi + 0x24]
sub ecx, eax
sub ecx, dword [esi + 0x20]
mov eax, ecx
sar eax, 0x1f
add ecx, edi
adc eax, ebx
mov bl, 1
xor edx, edx
neg ecx
sbb edx, eax
push 1
push edx
push ecx
push dword [esi + 0x40]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
je 0x45fb4b
mov edi, 0xffffffff
jmp 0x45fb7c
test bl, bl
je 0x45fb55
mov eax, dword [esp]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x54], 0
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
xor ebx, ebx
mov ecx, edi
jmp 0x45fa39
call fcn.0045ffd0
int3