joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dbff
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x40dc11
mov eax, dword [eax]
push 0x4be7ac
push eax
call fcn.0044e1fb
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x40dc91
push ebx
push edi
mov ecx, eax
call fcn.0040cf84
mov ebx, eax
push ebx
call fcn.00427769
push ebx
mov edi, eax
push 0
push edi
call fcn.004416c0
push dword [ebp - 4]
push 1
push ebx
push edi
call fcn.0044e863
push dword [ebp - 4]
call fcn.0044dad4
add esp, 0x24
cmp dword [esi + 0x2c], 0
je 0x40dc79
lea ecx, [esi + 0x1c]
cmp dword [ecx + 0x14], 0x10
jb 0x40dc69
mov ecx, dword [ecx]
mov esi, dword [ebp + 8]
mov edx, edi
push esi
push ebx
call fcn.0040e33f
pop ecx
pop ecx
jmp 0x40dc85
mov esi, dword [ebp + 8]
mov ecx, esi
push ebx
push edi
call fcn.00407412
push edi
call fcn.00427764
mov eax, dword [esi + 0x10]
pop ecx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4128b9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f5b7
mov eax, dword fs:[0]
push eax
mov eax, 0x1040
call fcn.00428770
mov eax, dword [0x4d3094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00412712
mov ebx, 0x800
mov esi, eax
push ebx
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.004416c0
xor eax, eax
push ebx
push eax
mov dword [ebp - 0x1044], eax
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x810]
push eax
call fcn.004416c0
add esp, 0x18
lea ecx, [ebp - 0x1040]
mov edx, str.3eoB
call fcn.0040df73
xor ebx, ebx
lea ecx, [ebp - 0x1028]
mov edx, eax
mov dword [ebp - 4], ebx
call fcn.0040b051
push ebx
push 1
lea ecx, [ebp - 0x1040]
call fcn.00405e63
cmp dword [ebp - 0x1014], 8
lea ecx, [ebp - 0x810]
mov edx, 0x400
lea eax, [ebp - 0x1028]
cmovae eax, dword [ebp - 0x1028]
push edx
push ecx
lea ecx, [ebp - 0x1048]
push ecx
lea ecx, [ebp - 0x104c]
push ecx
lea ecx, [ebp - 0x1044]
push ecx
push edx
lea ecx, [ebp - 0x1010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1044]
mov edx, esi
push edi
call fcn.0041280c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1028]
call fcn.00401656
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042746a
mov esp, ebp
pop ebp
ret
Function at 0x4129dd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f5f5
mov eax, dword fs:[0]
push eax
mov eax, 0x1054
call fcn.00428770
mov eax, dword [0x4d3094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00412712
mov edi, 0x800
mov esi, eax
push edi
lea eax, [ebp - 0x1020]
push 0
push eax
call fcn.004416c0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1058], eax
push edi
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.004416c0
add esp, 0xc
lea ecx, [ebp - 0x1050]
mov edx, str.3eoB
call fcn.0040df73
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1038]
mov edx, eax
call fcn.0040b051
push 0
push 1
lea ecx, [ebp - 0x1050]
mov byte [ebp - 4], 2
call fcn.00405e63
cmp dword [ebp - 0x1024], 8
lea ecx, [ebp - 0x820]
mov edx, 0x400
lea eax, [ebp - 0x1038]
cmovae eax, dword [ebp - 0x1038]
push edx
push ecx
lea ecx, [ebp - 0x1058]
push ecx
lea ecx, [ebp - 0x105c]
push ecx
lea ecx, [ebp - 0x1054]
push ecx
push edx
lea ecx, [ebp - 0x1020]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1054]
lea edi, [ebp - 0x1b]
xor eax, eax
mov byte [ebp - 0x1c], 0
stosd dword es:[edi], eax
mov edx, esi
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push eax
call fcn.0041280c
pop ecx
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040e690
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1038]
call fcn.00401656
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042746a
mov esp, ebp
pop ebp
ret

Function at 0x415fd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49fc57
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4d3094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 1
mov dword [ebp - 0x14], esi
call fcn.00466eb0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 2
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 9
call fcn.00469930
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xa
call fcn.00469930
mov byte [esi + 0x5c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419d90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a026e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4d3094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi + 0xc], 0
call fcn.00469930
mov dword [ebp - 4], 0
mov eax, dword [edi + 8]
mov dword [edi], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.0
mov dword [edi + 4], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 8], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.2.0
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
mov dword [eax + edi + 4], 0
mov dword [edi + 0x24], vtable.CryptoPP::ModExpPrecomputation.0
mov dword [edi + 0x28], 0
lea esi, [edi + 0x2c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
call fcn.00469930
mov byte [ebp - 4], 2
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], 0
call fcn.00469930
mov dword [esi + 0x30], 0
mov eax, edi
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f79b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x41f83a
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.0043f910
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x41f7ef
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x41f816
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x41f8f5
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x41f867
xor eax, eax
jmp 0x41f8b8
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x41f884
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00420142
jmp 0x41f89c
cmp eax, 2
jne 0x41f8a0
mov edx, dword [esi]
test edx, edx
jne 0x41f893
xor eax, eax
jmp 0x41f89d
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0041d34d
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.0043f910
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x41f8e0
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x41f8f5
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x41f7ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42326b
Capabilities:
Write file on windows

Disassembly:
push 0x38
mov eax, 0x4a0886
call fcn.00427fe8
mov ebx, ecx
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x423287
cmp word [eax], si
jne 0x423292
lea eax, [ebx + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x423292
mov eax, dword [eax]
push 0x4be770
push eax
call fcn.0044e1fb
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x423356
mov esi, dword [ebx + 0x4c]
xor eax, eax
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x40], al
mov dword [ebp - 4], eax
cmp esi, dword [ebx + 0x50]
je 0x4232e6
mov ecx, dword [esi]
cmp dword [ebx + 0x44], eax
jne 0x4232d2
push edi
call fcn.00422726
jmp 0x4232db
lea eax, [ebp - 0x40]
push eax
call fcn.0042276c
add esi, 4
push 0
pop eax
cmp esi, dword [ebx + 0x50]
jne 0x4232c3
cmp dword [ebx + 0x44], eax
je 0x423342
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.004091a3
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.00423541
test eax, eax
je 0x423333
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.0044de57
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push 1
call fcn.00407543
jmp 0x423344
xor esi, esi
push edi
call fcn.0044dad4
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.00405e63
call fcn.00427f91
ret 4

Function at 0x4235de
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x14
push esi
call fcn.0040cf84
push 0x14
pop esi
cmp eax, esi
jae 0x4235f8
xor al, al
jmp 0x423653
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.0044fd61
push dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x10], si
inc eax
mov byte [ebp - 0xc], bl
push eax
mov word [ebp - 0xe], ax
mov edi, 0x58453144
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push esi
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0044e863
add esp, 0x1c
test eax, eax
je 0x42363c
cmp dword [ebp - 0x14], edi
je 0x423640
xor al, al
jmp 0x423651
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x42364f
push 5
pop ecx
lea esi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov al, 1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x423e1a
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d3094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
test edi, edi
je 0x423e8c
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x423e40
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
cmp eax, 0x3fffffff
jg 0x423e8c
add eax, eax
call fcn.00427f50
mov esi, esp
test esi, esi
je 0x423e89
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
mov byte [esi], bl
lea eax, [ecx + ecx]
push eax
push esi
push 0xffffffffffffffff
push edi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, esi
mov esi, dword [ebp - 0x18]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 0x7b
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push ebx
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x423ecc
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x423ef5
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
inc eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042746a
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x423edf

Function at 0x423ef9
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4d3094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push esi
push edi
mov edi, 0x3e8
mov esi, dword [ebp + 8]
div edi
xor edi, edi
mov dword [ebp - 0x110], eax
inc edi
mov eax, dword [ecx]
xor ecx, ecx
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x110]
push eax
push ecx
push ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], edx
push eax
push ecx
mov dword [ebp - 0x108], edi
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x423f5c
xor eax, eax
jmp 0x423f67
xor ecx, ecx
test eax, eax
mov eax, edi
setne cl
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042746a
mov esp, ebp
pop ebp
ret 8
Function at 0x42420c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4a0938
call fcn.0042801f
mov ebx, edx
push 0x801
call fcn.00427769
xor edi, edi
mov esi, eax
mov dword [ebp - 4], edi
mov dword [esp], 0x801
push edi
push esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0x800
call fcn.004416c0
add esp, 0xc
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x14], edi
je 0x42429e
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x18], 1
jne 0x424295
push esi
call fcn.00405e00
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push esi
call fcn.00405d87
inc edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4242a9
push esi
call fcn.00427764
pop ecx
mov eax, edi
call fcn.00427f7c
ret

Function at 0x42a23c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x459d07
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00459b7d

Function at 0x4600ae
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045fc00

Function at 0x468620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1c38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d3094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push esi
call dword [eax + 0x28]
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x30]
call eax
mov edx, dword [esi]
mov ecx, esi
push 1
mov bl, al
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4842a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
shr ecx, 2
push edi
test ecx, ecx
je 0x484365
mov edi, dword [esp + 0x20]
cmp ecx, 8
jb 0x484340
mov ebx, ecx
lea eax, [edi + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edi
xorps xmm3, xmm3
mov dword [esp + 0x10], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edx*4]
add edx, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x4842f0
mov edi, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, ecx
jae 0x484365
mov esi, ebp
lea edi, [edi + edx*4]
sub esi, dword [esp + 0x20]
sub ecx, edx
add edx, ecx
mov eax, dword [edi + esi]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
or ebx, eax
sub ecx, 1
jne 0x484351
mov esi, dword [esp + 0x24]
shl edx, 2
sub esi, edx
jne 0x48437b
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x20]
add ebp, edx
add ecx, edx
mov eax, ebx
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov dword [esp + 0x20], ecx
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x10], edx
test esi, esi
je 0x484455
cmp esi, 0x20
jb 0x484439
mov ebx, esi
mov edx, ebp
and ebx, 0xffffffe0
xorps xmm3, xmm3
sub edx, ecx
mov eax, ecx
mov dword [esp + 0x14], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ecx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x4843d0
por xmm2, xmm3
mov ecx, dword [esp + 0x20]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
cmp edi, esi
jae 0x484455
sub ebp, dword [esp + 0x20]
add ecx, edi
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x484445
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x484470
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, edx
shr edi, 2
test edi, edi
je 0x484517
cmp edi, 8
jb 0x4844f0
lea eax, [esi - 4]
lea eax, [eax + edi*4]
lea ecx, [ebp - 4]
lea ecx, [ecx + edi*4]
cmp ebp, eax
ja 0x4844a9
cmp ecx, esi
jae 0x4844f0
mov ecx, edi
lea eax, [ebp + 0x10]
mov edx, esi
and ecx, 0xfffffff8
sub edx, ebp
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + ebx*4]
add ebx, 8
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, ecx
jb 0x4844c1
mov ebp, dword [esp + 0x18]
cmp ebx, edi
jae 0x484517
lea ecx, [ebx*4]
mov edx, esi
sub edi, ebx
add ecx, ebp
sub edx, ebp
add ebx, edi
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x484505
mov edx, dword [esp + 0x20]
shl ebx, 2
sub edx, ebx
je 0x484594
add ebp, ebx
add esi, ebx
xor edi, edi
test edx, edx
je 0x484594
cmp edx, 0x20
jb 0x48457b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, edx
add ecx, edx
cmp ebp, eax
ja 0x48453f
cmp ecx, esi
jae 0x48457b
mov ecx, edx
mov ebx, esi
and ecx, 0xffffffe0
mov eax, ebp
sub ebx, ebp
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [esi + edi + 0x10]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x484550
cmp edi, edx
jae 0x484594
sub esi, ebp
lea ecx, [edi + ebp]
sub edx, edi
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x484586
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x48fd63
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push 0x98
mov eax, 0x4a4b7c
call fcn.00427fe8
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x88]
call fcn.00402861
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
call fcn.00491752
push eax
lea ecx, [ebp - 0x70]
call fcn.0040814e
push 0x37
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x4d7148
call fcn.00409266
mov esi, eax
push 0x4be750
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00401adc
push esi
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
call fcn.00403f95
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040197a
xor edi, edi
lea ecx, [ebp - 0x58]
push edi
push ebx
call fcn.00401656
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.00401656
push edi
push ebx
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.00401656
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x4be770
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0044e1fb
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x48feb6
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x58]
call fcn.0040af7c
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
cmp dword [ebp - 0x44], 0x10
push esi
push dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
push ebx
push ecx
call fcn.0044de57
push esi
push ebx
push ebx
push 0x4be7b4
call fcn.0044de57
add esp, 0x20
lea ecx, [ebp - 0x40]
mov edx, 0x4fed88
call fcn.0040af7c
cmp dword [ebp - 0x30], edi
je 0x48fe9b
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push esi
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
push ebx
push eax
call fcn.0044de57
add esp, 0x10
push esi
call fcn.0044dad4
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.00405e63
push edi
push ebx
lea ecx, [ebp - 0x58]
call fcn.00405e63
push edi
push ebx
lea ecx, [ebp - 0x70]
call fcn.00401656
push 0
push ebx
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0
call fcn.00401656
call fcn.0049157d
push 8
pop edi
cmp dword [0x4fede4], edi
mov esi, 0x4fedd0
push ecx
mov eax, esi
mov ecx, esp
cmovae eax, dword [0x4fedd0]
push eax
call fcn.00407603
mov ecx, dword [0x4ff088]
call fcn.00493c1b
pop ecx
test eax, eax
je 0x48ff0d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4fede4], edi
cmovae esi, dword [0x4fedd0]
push esi
call fcn.0044da35
cmp dword [ebp - 0x18], 0
pop ecx
je 0x48ff53
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
call fcn.0040cecf
test al, al
je 0x48ff53
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0044da35
pop ecx
xor edi, edi
lea ecx, [ebp - 0x28]
push edi
push ebx
call fcn.00401656
call fcn.00427f91
ret