joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
sub esp, 0x1c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov ecx, dword [0x5b12f0]
mov byte [esp], 0x14
mov dword [esp + 1], 0x746f6c73
mov dword [esp + 5], 0x756f632d
mov word [esp + 9], 0x746e
mov byte [esp + 0xb], 0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
mov esi, esp
push 0
push edx
push esi
call dword [eax + 0x14]
test eax, eax
je 0x403204
test byte [esp], 1
je 0x403200
push dword [esp + 8]
call fcn.00420e70
add esp, 4
xor esi, esi
jmp 0x40324b
test byte [esp + 0x10], 1
je 0x403211
mov eax, dword [esp + 0x18]
jmp 0x403215
lea eax, [esp + 0x11]
lea ecx, [esp + 0xc]
push 0x7fffffff
push 0x80000000
push ecx
push eax
call fcn.004133b0
add esp, 0x10
mov ebx, eax
test byte [esp], 1
je 0x403241
push dword [esp + 8]
call fcn.00420e70
add esp, 4
xor esi, esi
test bl, bl
je 0x40324b
mov esi, dword [esp + 0xc]
test byte [esp + 0x10], 1
je 0x40325e
push dword [esp + 0x18]
call fcn.00420e70
add esp, 4
mov eax, esi
add esp, 0x1c
pop esi
pop ebx
ret

Function at 0x405a80
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
push str.ANDROID_PRODUCT_OUT
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x405b3f
cmp byte [eax], 0
je 0x405b3f
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
push 0x10
call fcn.00420cd0
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x11
mov dword [esp + 0x14], 0xf
mov dword [eax + 0xb], 0x676d692e
mov dword [eax + 8], 0x2e797470
mov dword [eax + 4], 0x6d655f72
mov dword [eax], 0x65707573
mov byte [eax + 0xf], 0
lea edi, [esp + 4]
lea esi, [esp + 0x10]
mov ecx, edi
mov edx, esi
call fcn.00401770
test byte [esp + 0x10], 1
je 0x405b1d
push dword [esp + 0x18]
call fcn.00420e70
add esp, 4
movzx eax, byte [esp + 4]
mov ecx, eax
and cl, 1
je 0x405b43
mov eax, dword [esp + 8]
test eax, eax
je 0x405b49
test cl, cl
mov byte [esp + 3], cl
je 0x405b64
mov eax, dword [esp + 0xc]
jmp 0x405b68
xor ebx, ebx
jmp 0x405b5b
shr eax, 1
test eax, eax
jne 0x405b31
xor ebx, ebx
test cl, cl
je 0x405b5b
push dword [esp + 0xc]
call fcn.00420e70
add esp, 4
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
ret
lea eax, [esp + 5]
push 4
push eax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__access
add esp, 8
test eax, eax
je 0x405b84
xor ebx, ebx
movzx ecx, byte [esp + 3]
test cl, cl
jne 0x405b4f
jmp 0x405b5b
mov dword [esp + 0x10], 0
push edi
push esi
call fcn.00484b90
add esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405baf
push dword [esp + 0x2c]
push eax
call fcn.004292c0
add esp, 8
mov ebx, eax
jmp 0x405bb1
xor ebx, ebx
lea ecx, [esp + 0x10]
push 0
call fcn.004149c0
movzx ecx, byte [esp + 4]
and cl, 1
test cl, cl
jne 0x405b4f
jmp 0x405b5b
Function at 0x40d9f0
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, esp
push edx
call fcn.00424040
movzx eax, byte [esp]
test al, 1
je 0x40da2a
mov eax, dword [esp + 4]
cmp eax, 3
je 0x40da31
jmp 0x40da4b
shr eax, 1
cmp eax, 3
jne 0x40da4b
mov ecx, esp
push 3
push 0x5807b1
push 0xffffffffffffffff
push 0
call fcn.00425f30
test eax, eax
je 0x40db0e
call fcn.00403190
test eax, eax
je 0x40dbd1
mov edi, eax
movzx eax, byte [esp]
mov ecx, eax
shr ecx, 1
and al, 1
mov edx, dword [esp + 4]
mov ebx, edx
cmove ebx, ecx
cmp ebx, 5
jne 0x40da9a
mov ecx, esp
push 5
push str.other
push 0xffffffffffffffff
push 0
call fcn.00425f30
test eax, eax
je 0x40db32
movzx ecx, byte [esp]
mov edx, dword [esp + 4]
mov eax, ecx
and al, 1
shr ecx, 1
test al, al
cmovne ecx, edx
cmp ecx, 1
jne 0x40dbba
test al, al
je 0x40dab2
mov eax, dword [esp + 8]
jmp 0x40dab6
lea eax, [esp + 1]
movzx eax, byte [eax]
cmp al, 0x61
jl 0x40dbba
add eax, 0xffffff9f
cmp eax, edi
jge 0x40dbba
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [esp]
movsd qword [esi], xmm0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
test byte [esp], 1
je 0x40db05
push dword [esp + 8]
call fcn.00420e70
add esp, 4
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
cmp byte [esp + 0x28], 0
je 0x40db8f
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov byte [esi], 6
mov word [esi + 1], 0x6c61
mov byte [esi + 3], 0x6c
jmp 0x40daf3
lea eax, [esp + 0xc]
push eax
call fcn.00403090
add esp, 4
movzx ebx, byte [esp + 0xc]
test bl, 1
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xd]
cmovne eax, ecx
movsx eax, byte [eax]
add eax, 0xffffffa0
cdq
idiv edi
add dl, 0x61
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 1], dl
mov byte [esi], 2
test bl, 1
je 0x40daf3
push ecx
call fcn.00420e70
add esp, 4
jmp 0x40daf3
call fcn.00403190
test eax, eax
jle 0x40dc2b
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov word [esi], 0x6102
jmp 0x40daf3
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
test byte [esp], 1
je 0x40dbdb
mov ecx, dword [esp + 8]
jmp 0x40dbdf
push str.Device_does_not_support_slots
call fcn.004291c0
lea ecx, [esp + 1]
push ecx
push str.Slot__s_does_not_exist._supported_slots_are:_n
push eax
call fcn.004018d0
add esp, 0xc
test edi, edi
jle 0x40dc24
mov esi, 0x61000000
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop dword [eax]
push 2
call ebx
add esp, 4
mov ecx, esi
sar ecx, 0x18
push ecx
push 0x583386
push eax
call fcn.004018d0
add esp, 0xc
add esi, 0x1000000
dec edi
jne 0x40dc00
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push str.No_known_slots
call fcn.004291c0
nop word cs:[eax + eax]
Function at 0x40ed00
Capabilities:
Get common file path

Disassembly:
push edi
push esi
sub esp, 0x208
lea esi, [esp + 0x104]
push 0x104
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
add eax, 0xfffffefc
cmp eax, 0xfffffefc
jbe 0x40ed79
mov edi, esp
push 0x104
push 0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push edi
push 0
push 0x580839
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40ed8a
push str.wbTD
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
add esp, 8
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno_1
add esp, 0x20c
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempPath_failed__error__ld
call fcn.004291c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempFileName_failed__error__ld
call fcn.004291c0
nop dword [eax + eax]
Function at 0x413aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
cmp dword [ecx + 0x40], 0
je 0x413c47
mov esi, ecx
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x413c59
mov dword [esp], 0
mov eax, dword [esi + 0x54]
test al, 0x10
jne 0x413af7
test al, 8
je 0x413c4e
mov eax, dword [esi + 0x4c]
mov dword [esp + 4], eax
cmp byte [esi + 0x5a], 0
je 0x413b88
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, ecx
sar eax, 0x1f
xor ebx, ebx
jmp 0x413bf4
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x14]
je 0x413b11
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0x34]
cmp eax, 0xffffffff
je 0x413c0e
lea ebp, [esi + 0x48]
nop word cs:[eax + eax]
mov dword [esp + 8], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x34]
add edx, eax
mov edi, dword [ecx]
lea ebx, [esp + 8]
push ebx
push edx
push eax
push ebp
call dword [edi + 0x14]
mov ebx, eax
mov edi, dword [esp + 8]
mov eax, dword [esi + 0x20]
sub edi, eax
push dword [esi + 0x40]
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, edi
jne 0x413c0e
cmp ebx, 1
je 0x413b20
cmp ebx, 2
je 0x413c0e
push dword [esi + 0x40]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
test eax, eax
jne 0x413c0e
jmp 0x413c4e
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
sub edi, edx
test eax, eax
jle 0x413bb4
mov edx, edi
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
sar edx, 0x1f
imul ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, edi
adc eax, edx
xor ebx, ebx
jmp 0x413bf4
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x413beb
mov ebx, edi
sar ebx, 0x1f
mov ecx, dword [esi + 0x44]
sub eax, dword [esi + 8]
mov ebp, dword [ecx]
push eax
push edx
push dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
call dword [ebp + 0x20]
add eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
sub ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, edi
adc eax, ebx
mov bl, 1
jmp 0x413bf4
mov eax, edi
sar eax, 0x1f
xor ebx, ebx
mov ecx, edi
xor edx, edx
neg ecx
sbb edx, eax
push 1
push edx
push ecx
push dword [esi + 0x40]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
je 0x413c17
mov dword [esp], 0xffffffff
jmp 0x413c4e
test bl, bl
je 0x413c22
mov eax, dword [esp + 4]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x54], 0
mov dword [esp], 0
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00414080
int3
Function at 0x415d30
Capabilities:
Parse credit card information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp esi, ebp
je 0x415e30
mov edi, ecx
movsx eax, byte [esi]
cmp eax, 0x5b
jg 0x415de5
cmp eax, 0x24
je 0x415e0a
cmp eax, 0x28
jne 0x415e30
lea eax, [esi + 1]
cmp eax, ebp
je 0x415e30
cmp byte [eax], 0x3f
jne 0x415e30
lea eax, [esi + 2]
cmp eax, ebp
je 0x415e30
movsx eax, byte [eax]
cmp eax, 0x21
je 0x415ed1
cmp eax, 0x3d
jne 0x415e30
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov ebx, esp
mov ecx, ebx
call fcn.004168c0
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], eax
add esi, 3
mov ecx, ebx
push ebp
push esi
call fcn.004152d0
mov esi, eax
mov ebx, dword [esp + 0x10]
mov ecx, edi
push dword [edi + 0x10]
push 0
jmp 0x415f16
cmp eax, 0x5c
je 0x415e3c
cmp eax, 0x5e
jne 0x415e30
push 8
call fcn.00420cd0
add esp, 4
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [eax], 0x5845a8
jmp 0x415e23
push 8
call fcn.00420cd0
add esp, 4
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [eax], 0x5845e4
mov dword [ecx + 4], eax
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [edi + 0x24], eax
inc esi
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea eax, [esi + 1]
cmp eax, ebp
je 0x415e30
movzx eax, byte [eax]
cmp eax, 0x42
je 0x415e86
cmp eax, 0x62
jne 0x415e30
push 0x18
call fcn.00420cd0
add esp, 4
mov ebx, eax
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0x584620
lea ecx, [ebx + 8]
push edi
call fcn.0043f7e0
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x14], 0
jmp 0x415eba
push 0x18
call fcn.00420cd0
add esp, 4
mov ebx, eax
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0x584620
lea ecx, [ebx + 8]
push edi
call fcn.0043f7e0
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x14], 1
mov eax, dword [edi + 0x24]
mov dword [eax + 4], ebx
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [edi + 0x24], eax
add esi, 2
jmp 0x415e30
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov ebx, esp
mov ecx, ebx
call fcn.004168c0
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], eax
add esi, 3
mov ecx, ebx
push ebp
push esi
call fcn.004152d0
mov esi, eax
mov ebx, dword [esp + 0x10]
mov ecx, edi
push dword [edi + 0x10]
push 1
lea eax, [esp + 8]
push eax
call fcn.00416900
add dword [edi + 0x10], ebx
cmp esi, ebp
je 0x415f39
cmp byte [esi], 0x29
jne 0x415f39
inc esi
mov ecx, esp
call fcn.00411e30
jmp 0x415e30
call fcn.00416990
int3
Function at 0x4289f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0049de40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]

Function at 0x428a50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x5b1d20]
test eax, eax
jle 0x428b60
mov edx, dword [0x5b1d24]
xor ebx, ebx
mov ecx, dword [edx + 0xc]
cmp ecx, esi
ja 0x428a81
mov edi, dword [edx + 0x10]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x428afa
add ebx, 1
add edx, 0x14
cmp ebx, eax
jne 0x428a70
mov dword [esp], esi
call fcn.0049dfa0
test eax, eax
mov edi, eax
je 0x428b87
lea esi, [ebx + ebx*4]
mov ebx, dword [0x5b1d24]
shl esi, 2
add ebx, esi
mov dword [ebx + 0x10], eax
mov dword [ebx], 0
call fcn.0049e090
add eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x5b1d24]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x428b67
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x428b02
add dword [0x5b1d20], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x428af3
cmp eax, 0x80
je 0x428af3
cmp eax, 8
je 0x428af3
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
add esi, dword [0x5b1d24]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x428af3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004289f0
nop
lea esi, [esi]
xor ebx, ebx
jmp 0x428a8b
mov eax, dword [0x5b1d24]
mov eax, dword [eax + esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004289f0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004289f0
mov esi, esi
lea edi, [edi]

Function at 0x4291c0
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push eax
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
mov dword [esp], eax
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push 0x585610
push eax
call fcn.00429890
add esp, 8
push 2
call esi
add esp, 4
push dword [esp]
push edi
push eax
call fcn.004298b0
add esp, 0xc
push 2
call esi
add esp, 4
push 0x585622
push eax
call fcn.00429890
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax]
Function at 0x42a260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1040
call fcn.004a19a0
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
test byte [esi], 1
jne 0x42a285
mov word [esi], 0
jmp 0x42a292
mov ecx, dword [esi + 8]
mov byte [ecx], 0
mov dword [esi + 4], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov edi, dword [eax]
mov eax, esp
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat32i64]
add esp, 8
cmp eax, 0xffffffff
je 0x42a2cf
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp eax, 1
sbb ecx, 0
jl 0x42a2cf
mov ecx, esi
push eax
call fcn.00424670
lea ebx, [esp + 0x3c]
jmp 0x42a2eb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x42a313
push 0x1000
push ebx
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
je 0x42a2e0
test eax, eax
jle 0x42a30e
mov ecx, esi
push eax
push ebx
call fcn.004248f0
jmp 0x42a2eb
sete al
jmp 0x42a315
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42a560
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test esi, esi
sete al
je 0x42a5c7
mov dword [esp], eax
nop word cs:[eax + eax]
push esi
push edi
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
jne 0x42a5b0
call ebx
cmp dword [eax], 4
je 0x42a590
jmp 0x42a5bd
add edi, eax
sub esi, eax
test eax, eax
mov eax, dword [esp]
jg 0x42a577
jmp 0x42a5bf
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x42a5bf

Function at 0x42a5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov dword [esp + 8], ecx
mov ebp, eax
test eax, eax
jne 0x42a615
jmp 0x42a67f
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call esi
mov dword [eax], 5
call esi
cmp dword [eax], 4
jne 0x42a67f
mov dword [esp + 4], 0
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], edi
mov eax, dword [esp]
mov dword [esp + 0x18], eax
push dword [esp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
push ecx
push ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42a600
mov ecx, dword [esp + 4]
cmp ecx, 0xffffffff
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
je 0x42a60e
add ebx, ecx
mov eax, ebp
sub eax, ecx
add edi, ecx
adc dword [esp], 0
test ecx, ecx
jg 0x42a5f2
test ebp, ebp
sete al
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x476f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov byte [esp + 0xc], 8
mov dword [esp + 0xd], 0x746f6f62
mov dword [esp + 8], 0
mov byte [esp], 0xe
mov dword [esp + 1], 0x746f6f42
mov dword [esp + 4], 0x676e6974
mov esi, dword [ecx]
mov edi, esp
lea ebx, [esp + 0xc]
push 0
push edx
push eax
push edi
push ebx
call dword [esi + 0x1c]
mov esi, eax
test byte [esp], 1
je 0x476ffc
push dword [esp + 8]
call fcn.00420e70
add esp, 4
test byte [esp + 0xc], 1
je 0x47700f
push dword [esp + 0x14]
call fcn.00420e70
add esp, 4
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8
Function at 0x484360
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
movzx ebx, byte [ebp]
test bl, 1
mov dword [esp], ecx
je 0x48437f
mov ebx, dword [ebp + 4]
mov ebp, dword [ebp + 8]
jmp 0x484382
inc ebp
shr ebx, 1
mov eax, ebx
mov ecx, ebp
mov edx, ebx
cmp ebx, 4
jb 0x484412
lea edx, [ebx - 4]
test dl, 4
jne 0x4843c1
imul eax, dword [ebp], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
imul eax, ebx, 0x5bd1e995
xor eax, ecx
lea ecx, [ebp + 4]
mov esi, edx
cmp edx, 4
jae 0x4843cc
jmp 0x484412
mov esi, ebx
mov ecx, ebp
mov eax, ebx
cmp edx, 4
jb 0x484412
mov edx, esi
nop
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
imul esi, dword [ecx + 4], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 8
add edx, 0xfffffff8
cmp edx, 3
ja 0x4843d0
cmp edx, 1
je 0x484438
cmp edx, 2
mov edi, dword [esp]
je 0x48442d
cmp edx, 3
jne 0x484446
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
jmp 0x48443b
mov edi, dword [esp]
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x48459b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov eax, ecx
shr eax, 1
and eax, 0x55555555
mov edx, ecx
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [esp + 0xc], eax
cmp eax, 1
mov dword [esp + 4], ecx
ja 0x4844ad
lea edx, [ecx - 1]
and edx, esi
jmp 0x4844bb
mov edx, esi
cmp esi, ecx
jb 0x4844bb
mov eax, esi
xor edx, edx
div dword [esp + 4]
mov eax, dword [edi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x48459b
mov edi, dword [eax]
test edi, edi
mov eax, 0
je 0x48459d
mov dword [esp], edx
mov eax, dword [esp + 4]
dec eax
mov dword [esp + 8], eax
jmp 0x484506
and eax, dword [esp + 8]
cmp eax, edx
jne 0x48459b
mov edi, dword [edi]
test edi, edi
je 0x48459b
mov eax, dword [edi + 4]
cmp esi, eax
jne 0x484560
movzx edx, byte [edi + 8]
mov eax, edx
shr eax, 1
mov ecx, eax
test dl, 1
je 0x48451f
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jne 0x4844fc
lea ecx, [edi + 9]
test dl, 1
je 0x48452e
mov ecx, dword [edi + 0x10]
jne 0x484580
test ebx, ebx
je 0x484597
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [edi + ecx + 9]
cmp dl, byte [ebp + ecx]
jne 0x4844fc
inc ecx
cmp eax, ecx
jne 0x484540
jmp 0x484597
cmp dword [esp + 0xc], 1
mov edx, dword [esp]
jbe 0x4844f0
mov ecx, dword [esp + 4]
cmp eax, ecx
jb 0x4844f4
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [esp]
jmp 0x4844f4
test ebx, ebx
je 0x484597
push ebx
push ebp
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4844fc
mov eax, edi
jmp 0x48459d
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x48e3e0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 1
mov dword [esp + 8], ebx
pop ebx
jmp fcn.0048ddb0
Function at 0x49dec0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x49def8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x49deee
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x49defa
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x49dee0
xor eax, eax
pop ebx
pop esi
ret