joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ba8
Capabilities:
Enumerate files on windows

Disassembly:
push 0x294
mov eax, 0x410cd4
call fcn.004078e6
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x268], ecx
jb 0x401bcb
mov eax, dword [eax + 4]
jmp 0x401bce
add eax, 4
lea ecx, [ebp - 0x264]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ebx, ebx
mov edi, eax
inc ebx
cmp edi, 0xffffffff
je 0x401c97
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x412d38
lea eax, [ebp - 0x238]
push eax
call esi
test eax, eax
je 0x401c81
push 0x412d3c
lea eax, [ebp - 0x238]
push eax
call esi
test eax, eax
je 0x401c81
cmp byte [ebp + 0xc], 0
je 0x401c49
test byte [ebp - 0x264], 0x10
je 0x401c81
lea eax, [ebp - 0x238]
push eax
lea esi, [ebp - 0x284]
call fcn.00401245
and dword [ebp - 4], 0
mov eax, esi
push eax
mov eax, dword [ebp - 0x268]
call fcn.00401f35
jmp 0x401c75
test byte [ebp - 0x264], 0x10
jne 0x401c81
lea eax, [ebp - 0x238]
push eax
lea esi, [ebp - 0x2a0]
call fcn.00401245
mov eax, esi
push eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 4], ebx
call fcn.00401f35
or dword [ebp - 4], 0xffffffff
push 0
push ebx
call fcn.004012e9
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
je 0x401bea
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
call fcn.00407969
ret

Function at 0x4032b7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x417030]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x4033a7
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jl 0x4033a7
push edi
xor eax, eax
push 0x4e
push eax
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push eax
call fcn.00407150
movzx eax, byte [ebp - 0x25d]
push eax
movzx eax, byte [ebp - 0x25e]
push eax
movzx eax, byte [ebp - 0x25f]
push eax
movzx eax, byte [ebp - 0x260]
push eax
movzx eax, byte [ebp - 0x261]
push eax
movzx eax, byte [ebp - 0x262]
push eax
movzx eax, byte [ebp - 0x263]
push eax
movzx eax, byte [ebp - 0x264]
push eax
movzx eax, word [ebp - 0x266]
push eax
movzx eax, word [ebp - 0x268]
push eax
push dword [ebp - 0x26c]
lea edi, [ebp - 0x54]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push 0x28
pop ecx
call fcn.00403268
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x25c], ax
lea eax, [ebp - 0x25a]
push eax
call fcn.00407150
add esp, 0x48
lea eax, [ebp - 0x25c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, edi
push eax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor eax, eax
inc eax
pop edi
jmp 0x4033a9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b6c
leave
ret
Function at 0x4054a3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, eax
test edx, edx
jne 0x4054ae
xor eax, eax
pop edi
ret
or eax, 0xffffffff
push esi
mov ecx, 0xff
cmp edi, 8
jb 0x405561
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e8]
inc edx
sub edi, 8
dec esi
jne 0x4054c6
pop ebx
test edi, edi
je 0x40557a
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4142e8]
inc edx
dec edi
jne 0x405565
pop esi
not eax
pop edi
ret

Function at 0x405b6c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417030]
jne 0x405b76
repz ret
jmp fcn.00407987
Function at 0x432003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..wixburn
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x5be216a0
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..pdata
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x31f211d9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4b4cf9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004aaf11
and dword [ebp - 4], 0
cmp dword [0x4f4350], 0
mov ebx, eax
jne 0x4b4daa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4b4e5b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4c9b28
push edi
call esi
test eax, eax
je 0x4b4e5b
push eax
call fcn.004aae9f
mov dword [esp], 0x4c9b18
push edi
mov dword [0x4f4350], eax
call esi
push eax
call fcn.004aae9f
mov dword [esp], 0x4c9b04
push edi
mov dword [0x4f4354], eax
call esi
push eax
call fcn.004aae9f
mov dword [esp], 0x4c9ae8
push edi
mov dword [0x4f4358], eax
call esi
push eax
call fcn.004aae9f
pop ecx
mov dword [0x4f4360], eax
test eax, eax
je 0x4b4daa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004aae9f
pop ecx
mov dword [0x4f435c], eax
mov eax, dword [0x4f435c]
cmp eax, ebx
je 0x4b4e02
cmp dword [0x4f4360], ebx
je 0x4b4e02
push eax
call fcn.004aaf1a
push dword [0x4f4360]
mov esi, eax
call fcn.004aaf1a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4b4e02
test edi, edi
je 0x4b4e02
call esi
test eax, eax
je 0x4b4df9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b4df9
test byte [ebp - 0xc], 1
jne 0x4b4e02
or dword [ebp + 0x10], 0x200000
jmp 0x4b4e3b
mov eax, dword [0x4f4354]
cmp eax, ebx
je 0x4b4e3b
push eax
call fcn.004aaf1a
pop ecx
test eax, eax
je 0x4b4e3b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4b4e3b
mov eax, dword [0x4f4358]
cmp eax, ebx
je 0x4b4e3b
push eax
call fcn.004aaf1a
pop ecx
test eax, eax
je 0x4b4e3b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f4350]
call fcn.004aaf1a
pop ecx
test eax, eax
je 0x4b4e5b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b4e5d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor eax, eax
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x4010d3
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4010d5
shr ecx, 1
dec edx
jne 0x4010c4
mov dword [ebp + eax*4 - 0x400], ecx
inc eax
cmp eax, 0x100
jl 0x4010bf
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jbe 0x401114
push esi
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [ebp + edx*4 - 0x400]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x4010f2
pop esi
not eax
leave
ret

Function at 0x40124c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x405018]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp dword [esi + 0x468], ebx
mov dword [ebp - 0x7c], ebx
mov eax, str.AppLaunch.prf
jne 0x401292
add esi, 0x480
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
jmp 0x401379
cmp dword [esi + 4], ebx
je 0x4012a9
push eax
lea eax, [esi + 0x152]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
jne 0x4012d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401347
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x401340
push ebx
push edi
push ebx
push 2
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, ebx
mov dword [ebp - 0x7c], eax
je 0x401340
push edi
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea ecx, [edi - 4]
push ecx
push eax
mov dword [ebp - 0x80], eax
mov dword [esi + 0x470], eax
call fcn.004010b4
pop ecx
pop ecx
mov ecx, dword [ebp - 0x80]
cmp eax, dword [ecx + edi - 4]
je 0x40132a
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x401346
mov ecx, esi
call fcn.00401980
test eax, eax
je 0x401340
mov eax, esi
call fcn.00401390
test eax, eax
jne 0x401346
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
add esi, 0x470
mov eax, dword [esi]
cmp eax, ebx
je 0x40135c
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi], ebx
cmp dword [ebp - 0x7c], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40136c
push dword [ebp - 0x7c]
call esi
cmp dword [ebp - 0x78], 0xffffffff
je 0x401377
push dword [ebp - 0x78]
call esi
xor eax, eax
mov ecx, dword [ebp + 0x194]
pop esi
xor ecx, ebp
pop ebx
call fcn.004025f2
add ebp, 0x198
leave
ret
Function at 0x4013e6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
push 0x50000080
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4014cf
mov eax, dword [ebx + 0x290]
push dword [esi + 0x464]
mov dword [esi + 0x460], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [ebx + 0x290], edi
mov dword [ebp + 8], edi
jbe 0x4014be
lea edi, [ebx + 0x29c]
push 0x14
push 9
push dword [esi + 0x468]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40148b
mov ecx, dword [edi - 4]
push 0x401a87
mov dword [eax + 8], ecx
inc dword [esi]
push eax
mov dword [eax + 0x10], esi
push dword [edi]
push dword [esi + 0x47c]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x40148b
dec dword [esi]
jne 0x401485
call fcn.00401ac1
dec dword [esi + 0x460]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add edi, 0xc
cmp eax, dword [ebx + 0x290]
jb 0x401442
xor edi, edi
jmp 0x4014be
push 1
push 0x1388
push dword [esi + 0x464]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, edi
je 0x4014c6
cmp eax, 0x102
je 0x4014c6
cmp dword [esi + 0x460], edi
jg 0x4014a0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret 4

Function at 0x4014d5
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
cmp dword [esi + 4], edi
mov ebx, eax
je 0x4014fb
lea eax, [esi + 0x35a]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 1
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x40159d
mov esi, dword [esi + 0x478]
mov eax, esi
imul eax, eax, 0x64
push eax
lea eax, [esi + esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
je 0x401594
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10c], edi
mov dword [ebp - 4], edi
jbe 0x401594
lea ecx, [eax + 0x120]
mov dword [ebp + 0xc], ecx
mov ebx, dword [ecx - 4]
cmp ebx, dword [ecx]
ja 0x401580
mov ecx, ebx
imul ecx, ecx, 0xc
lea esi, [ecx + eax + 0x29c]
mov edi, dword [esi - 8]
push dword [esi]
add edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov eax, dword [ebp + 0xc]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jbe 0x401557
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
add ecx, 0x18
cmp edx, dword [eax + 0x10c]
mov dword [ebp + 0xc], ecx
jb 0x401544
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401df4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x405018]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0xa8]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x401e58
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
test eax, eax
jne 0x401e58
mov al, 1
jmp 0x401ede
xor edx, edx
inc edx
cmp dword [ebp - 0x98], 2
jne 0x401edc
mov ecx, dword [ebp - 0xa4]
push 4
pop eax
cmp ecx, eax
jbe 0x401edc
cmp ecx, 6
jne 0x401eae
cmp dword [ebp - 0xa0], 0
jne 0x401e89
cmp byte [ebp + 0x72], dl
setne al
add al, 5
jmp 0x401ede
cmp dword [ebp - 0xa0], edx
jne 0x401e9b
cmp byte [ebp + 0x72], dl
setne al
add al, 7
jmp 0x401ede
cmp dword [ebp - 0xa0], 2
jne 0x401edc
cmp byte [ebp + 0x72], dl
setne al
add al, 9
jmp 0x401ede
cmp ecx, 5
jne 0x401ed5
cmp dword [ebp - 0xa0], 2
je 0x401ede
cmp dword [ebp - 0xa0], edx
jne 0x401ec8
mov al, 3
jmp 0x401ede
cmp dword [ebp - 0xa0], 0
jne 0x401edc
mov al, 2
jmp 0x401ede
cmp ecx, 6
mov al, 0xb
ja 0x401ede
mov al, dl
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.004025f2
add ebp, 0x78
leave
ret

Function at 0x4025f2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x405018]
jne 0x4025fc
repz ret
jmp fcn.00402a19
Function at 0x41a140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x41a15a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41a161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41a150
mov eax, 1
add ebx, ebx
jne 0x41a173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41a184
jne 0x41a1a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41a1a3
dec eax
add ebx, ebx
jne 0x41a190
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x41a168
add ebx, ebx
jne 0x41a19f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x41a1f5
xor ecx, ecx
sub eax, 3
jb 0x41a1bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41a22a
sar eax, 1
mov ebp, eax
jmp 0x41a1c6
add ebx, ebx
jne 0x41a1c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41a194
inc ecx
add ebx, ebx
jne 0x41a1d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41a194
add ebx, ebx
jne 0x41a1e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41a1d6
jne 0x41a1f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41a1d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41a214
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41a206
jmp 0x41a156
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41a214
add edi, ecx
jmp 0x41a156
pop esi
mov edi, esi
mov ecx, 0xb400
jmp 0x41a266
mov al, byte [edi]
add edi, 1
cmp al, 0x80
jb 0x41a247
cmp al, 0x8f
ja 0x41a247
cmp byte [edi - 2], 0xf
je 0x41a24d
sub al, 0xe8
cmp al, 1
ja 0x41a270
cmp byte [edi], 5
jne 0x41a270
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
mov dword [edi], eax
add edi, 4
sub ecx, 4
mov al, byte [edi]
add edi, 1
loop 0x41a247
sub ecx, 1
jg 0x41a234
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41a2c6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b088]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b13c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41a27b
mov ecx, edi
jns 0x41a2aa
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b140]
or eax, eax
je 0x41a2c0
mov dword [ebx], eax
add ebx, 4
jmp 0x41a298
call dword [esi + 0x1b150]
mov ebp, dword [esi + 0x1b144]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41a2fa
sub esp, 0xffffff80
jmp 0x40bfde
Function at 0x404a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, 0x10
mov dword [eax + 0x10], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], edx
add eax, 0x48
mov dword [ebp + 8], eax
pop ebp
jmp 0x40efc0
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
div edi
mov eax, dword [ebp - 0x10]
lea edx, [eax + edx*4]
mov eax, dword [edx]
test eax, eax
jne 0x40eff8
jmp 0x40f061
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x40f061
cmp esi, eax
jne 0x40eff0
mov eax, dword [esi]
xor ebx, ebx
mov dword [edx], eax
mov edx, dword [ebp + 0xc]
mov dword [esi + 4], edx
mov ecx, edx
mov al, byte [edx]
inc ecx
test al, al
je 0x40f02f
xor edx, edx
mov dl, al
lea eax, [edx + ebx]
shl edx, 0x11
add eax, edx
xor edx, edx
mov ebx, eax
shr ebx, 2
xor ebx, eax
mov al, byte [ecx]
mov dl, al
inc ecx
test al, al
jne 0x40f015
mov eax, dword [ebp + 0xc]
sub ecx, eax
lea eax, [ecx - 1]
lea edx, [eax + ebx]
shl eax, 0x11
add edx, eax
mov eax, edx
shr eax, 2
xor eax, edx
xor edx, edx
mov dword [esi + 8], eax
div edi
mov eax, dword [ebp - 0x10]
lea edx, [eax + edx*4]
mov eax, dword [edx]
mov dword [esi], eax
mov dword [edx], esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push str.bfd_hash_rename
push 0x243
push str._usr_local_google_buildbot_src_android_gcc_toolchain_build_.._binutils_binutils_2.27_bfd_hash.c
call fcn.00405b30
lea esi, [esi]
lea edi, [edi]

Function at 0x409ca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, ecx
mov edx, dword [ebp + 8]
add ebx, eax
xor edx, 0xffffffff
cmp ecx, ebx
jae 0x409cd0
mov al, byte [ecx]
inc ecx
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x486ee0]
cmp ecx, ebx
jne 0x409cb8
xor edx, 0xffffffff
pop ebx
mov eax, edx
pop ebp
ret

Function at 0x40d400
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d444
cld
mov edi, str.default
mov ecx, 8
mov esi, dword [ebp - 0x14]
repe cmpsb byte [esi], byte es:[edi]
jne 0x40d469
mov eax, dword [0x484510]
test eax, eax
je 0x40d460
test ebx, ebx
je 0x40d43c
or byte [ebx + 0x2b], 4
mov dword [ebx + 4], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push str.GNUTARGET
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40d416
jmp 0x40d428
mov eax, dword [0x48450c]
mov eax, dword [eax]
jmp 0x40d431
test ebx, ebx
je 0x40d471
and byte [ebx + 0x2b], 0xfb
mov eax, dword [ebp - 0x14]
call fcn.0040d350
test eax, eax
je 0x40d43c
test ebx, ebx
je 0x40d43c
mov dword [ebx + 4], eax
jmp 0x40d43c
Function at 0x40f420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
xor ebx, ebx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
lea edx, [edi + 1]
mov al, byte [edi]
test al, al
je 0x40f46a
xor ecx, ecx
mov cl, al
lea esi, [esi]
lea eax, [ecx + ebx]
shl ecx, 0x11
add eax, ecx
xor ecx, ecx
mov ebx, eax
shr ebx, 2
xor ebx, eax
mov al, byte [edx]
mov cl, al
inc edx
test al, al
jne 0x40f450
sub edx, edi
mov ecx, dword [ebp - 0x18]
dec edx
mov eax, edx
mov dword [ebp - 0x14], edx
shl edx, 0x11
add eax, ebx
add eax, edx
xor edx, edx
mov esi, eax
shr esi, 2
xor esi, eax
mov eax, esi
div dword [ecx + 0xc]
mov eax, dword [ecx]
mov ebx, dword [eax + edx*4]
test ebx, ebx
jne 0x40f49b
jmp 0x40f4bd
mov ebx, dword [ebx]
test ebx, ebx
je 0x40f4bd
cmp esi, dword [ebx + 8]
jne 0x40f495
push eax
push eax
push edi
mov eax, dword [ebx + 4]
push eax
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
jne 0x40f495
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
test eax, eax
je 0x40f4b3
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40f509
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x10], eax
jne 0x40f521
mov eax, 8
cmp dword [ecx + 4], eax
jae 0x40f531
push ebx
push ebx
push eax
push ecx
call fcn.00471680
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x40f545
push edx
mov eax, dword [ebp - 0x10]
push eax
push edi
push ebx
mov edi, ebx
call sub.msvcrt.dll_memcpy
add esp, 0x10
mov ecx, dword [ebp - 0x18]
mov dword [ebp + 0x10], esi
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0040f080
mov eax, dword [ebp - 0x14]
add eax, 8
and eax, 0xfffffff8
je 0x40f4e6
cmp dword [ecx + 4], eax
jb 0x40f4e6
mov ebx, dword [ecx]
mov edx, dword [ecx + 4]
add ebx, eax
sub edx, eax
mov dword [ecx], ebx
mov dword [ecx + 4], edx
mov ebx, dword [ecx]
sub ebx, eax
jmp 0x40f4f4
sub esp, 0xc
push 6
call fcn.00405d50
add esp, 0x10
jmp 0x40f4b3