joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e2d0
Capabilities:
Encode data using xor

Disassembly:
or dword [ebx], ecx
xor al, 0x99
mov ah, 0x38
or al, 0xef
lea eax, [edx + 0x212e35c9]
in eax, dx
add byte [ecx - 0x3e], dh
daa
push cs
or dword [esi + edi*2 + 0x7c390540], esi
mov bl, byte [esi]
add edi, eax
sub eax, 0x6047311e
cld
sub dword [ebx + ebp*8], esp
push edi
jo 0x40e31a
inc eax
push esi
test dword [edx + 0x76], ecx
adc al, 0x8f
dec eax
cmp dword [edx + edi*2 - 0x6390f0c9], 0x2533c324
mov ebx, 0xc3e21c1d
cmp bh, 0x35
add dword [0x6bc90504], 0xc7aa591e
sahf
ror byte [edx + ebp + 0x1958c00], cl
dec ebp
jecxz 0x40e315
xor eax, 0x5040581
leave
imul ebx, dword [esi], 0x59
stosb byte es:[edi], al
invalid
mov ah, bh
and eax, 0x48ac4
add byte [ebx], al
dec ebx
inc edx
adc esi, edi
cmp byte [ecx - 0x16ad9917], dh
and al, byte [edi + 0xb]
jl 0x40e3a1
add byte [edx], cl
jb 0x40e355
loopne 0x40e3a0
or eax, 0xa4b504c5
in al, dx
jno 0x40e3bc
xchg ecx, eax
cmp dh, byte [esi]
add dword [ecx + 0x57881229], ecx
mov ah, 0x41
or eax, 0x5d524124
dec esp
or al, byte [eax]
test byte [esi + edx], cl
cwde
test eax, 0x14f35281
mov al, 0xc3
sbb dword [esi], 0x1197414b
or eax, 0x42bf010f
adc dword [edx - 0xd], 0x81c3b014
push ds
dec ebx
inc ecx
xchg edi, eax
adc edx, esi
or eax, 0x42bf010f
cmpsd dword [esi], dword es:[edi]
inc ecx
and eax, 0x592385d6
call [eax + 0x2b08b927]
outsd dx, dword [esi]
je 0x40e36a
invalid
add edx, dword [edx + 0x33]
push ebx
loope 0x40e3b1
push edx
xor edx, dword [ebx - 0x1f]
or esi, dword [edi + 0x58]
ja 0x40e400
push 0x20d410a3
add dword [ebx], esi
sbb ah, ch
xor ebx, dword [edx]
in eax, 0x5c
pop esp
sahf
xor byte [ebx + 0x7c], ah
jno 0x40e3c2
dec ebp
mov al, 0x7a
cwde
invalid
mov edx, 0x122d521b
salc
sub eax, ebp
sub eax, 0xe829d612
fprem
mov ebp, eax
and esp, dword [ecx]
sal byte cs:[eax + 0xd], 0x72
stosd dword es:[edi], eax
out 0x7d, eax
push edx
daa
leave
xor dword [ecx], ecx
cmp dl, byte [ebp*8 + 0x31210a6]
cwde
adc dh, byte [eax]
and esp, dword [ecx - 0x6a]
or eax, edi
sub al, 0x7f
mov dh, 0x9e
mov bl, 0xa
xor eax, 0x6c025061
add edx, ecx
fiadd word [eax]
mov dword [0xc7eb1725], eax
loope 0x40e481
in eax, dx
add eax, 0x72d07763
stosd dword es:[edi], eax
outsd dx, dword [esi]
mov dword [edi], ebx
sar dword [ebx + 0x7e], 0x9e
sahf
jae 0x40e3c5
mov ch, 0x77
jmp 0x40e3ae
aas
and al, 1
add dword [edi + 5], ebx
dec ecx
pop edx
pop edi
add eax, 0xd45a6449
push eax
aam 0x50
add byte [esi + 0x28], dl
jns 0x40e4b5
ja 0x40e486
jno 0x40e47d
clc
or byte [eax], bh
imul ebp, dword [eax + 0x4c], 0xfffffff8
xor al, byte [esi]
or bh, byte [eax - 0x79f40df5]
invalid
invalid
xchg byte [edx + 0x76], dl
push edi
call 0x9301fc19
imul ebx, edx, 0xad2e6b0c
add byte [esi], al
int3

Function at 0x4179f4
Capabilities:
Get common file path

Disassembly:
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
call 0x910e468b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
invalid
nop
Function at 0x438efc
Capabilities:
Encode data using xor

Disassembly:
sbb dword [esi - 0x3b62a440], ecx
sbb ecx, dword [esi - 0x80]
lcall 0x749b, 0xd710547d
test al, 0x44
sti
jno 0x438f52
cmovle eax, dword [edi]
mov ecx, ss
pop eax
push esi
cmp byte [edi], cl
pop esi
adc eax, edx
invalid
sbb eax, 0xb7ce97c8
cmpsd dword [esi], dword es:[edi]
or dword [eax + edi*4 + 0x52], edi
invalid

Function at 0x43c8d1
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
in al, 0x43
adc byte [eax], 0xa7
sub byte [esi + 0x6f], dh
xor al, 0x51
mov al, byte [0xa5a06c93]
lodsd eax, dword [esi]
inc eax
leave
mov ebx, 0xce402855
xchg edx, eax
sub ebp, dword [ebx + ebp]
push edx
cmp byte [edi + edi*8 + 0x54c21822], dh
or bh, byte [ebx - 0x2be1ce41]
mov edi, 0x52d41e31
mov edi, 0x52d41e31
mov word [edx], fs
jo 0x43c8b2
inc ecx
fstp dword [eax + 0x544f087e]
sal ebx, cl
call 0xc0307bab
xchg byte [edi - 0x3efa3dfe], bh
sub ebx, 0x94c1ba7b
ret 0xbaf1
jnp 0x43c86e
rcl dword [edx + eax*8 + 0x5f70baf1], 0x82
ficom word [edx + edi*2]
sbb ch, byte [eax - 0x15]
mov ebx, dword [ebx]
popal
mul ebx
ffree st(3)
dec eax
pop edx
add bh, byte [esi + ebp + 0x70]
mov edx, esp
mov edx, esp
pushal
aaa
push ds
mov byte [ecx + eax*2 + 0x5d], dl
mov al, 0x77
sub dword [ebx + 0x637d181b], 0x62
out dx, al
or edx, dword [ebx - 0x1f]
pushfd
xor eax, 0x34bfc4ea
sub esp, dword [eax + ecx*4 + 0x2a]
inc edx
stosd dword es:[edi], eax
add eax, dword [eax - 0x659d9e24]
xor eax, 0x941a3d33
popal
and esi, esi
aas
and ebx, eax
aas
xchg esp, eax
xor bh, byte [edx + edx*2 + 0x7fd477d8]
pop ss
sbb dword [ebp - 0x4be0c983], esp
jl 0x43c8e2
invalid
push 0xffffffffffffffb4
pop edx
mov ch, 0x47
sub dword [ebp - 0x5b9e0be3], edi
pop ds
jne 0x43c921
sub al, byte [edi + 0x32]
sbb dword [edx + 0x5d], esi
mov dword [ecx - 9], esp
sbb eax, 0x56f6b2bf
movsb byte es:[edi], byte [esi]
outsb dx, byte [esi]
hlt
Function at 0x4526a7
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
scasd eax, dword es:[edi]
mov al, byte [0xcf5e0dbc]
xchg ecx, eax
jmp 0x452684
insd dword es:[edi], dx
and byte [ecx], dl
pop eax
js 0x4526b5
jbe 0x452618
nop
inc esp
pushfd
mov word [edi - 0x3a], ds
cmp esp, dword [0x8e3d8f72]
xor edx, dword [ebx + 2]
imul edi, dword [ecx], 0x10
adc al, 0x35
jecxz 0x452696
adc dword [eax - 0x33ee254c], esi
adc eax, 0xbf1df71c
xor byte [esi], dl
push ebx
call [esi + edx]
mov al, 0xb4
ficom dword [ecx]
int3
inc edx
mov al, byte [0x15b0ffd3]
add eax, 0x8ce00419
pop ss
pop eax
sub eax, 0xbba00950
aam 0x11
sub dword [edi + 0x15], esp
call 0x3a32cdcd
je 0x4526b3
call dword [ebx]
adc ecx, dword [eax - 0xd4b1738]
push ecx
xor byte [eax], cl
jl 0x452666
mov al, cl
call 0x30971970
or byte [edi + 0x2a], bh
mov edx, 0x16e2e219
sub bh, byte [edx + 0x16e2e219]
pop eax
xchg esi, eax
mov esi, 0xa6bf40b9
rcr dword [0x571e67d], 1
wait
invalid

Function at 0x45276e
Capabilities:
Encode data using xor

Disassembly:
hlt
or al, 0x8e
fadd qword fs:[edi + 0xa71acb8]
out dx, eax
adc eax, 0xc7482386
and dl, dh
sal dword [edx], 1
out dx, al
loopne 0x45274d
invalid
Function at 0x45e975
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0045eb68
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004696bd
xor ebx, ebx
cmp eax, ebx
jne 0x45eb23
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0045eb68
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0046639c
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004b7c91
add esp, 0x10
test eax, eax
jne 0x45ea3e
push esi
call fcn.0045c027
mov esi, eax
cmp esi, ebx
pop ecx
je 0x45ea3e
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x45ea29
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x45ea3e
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45ea37
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0046abd0
cmp byte [esp + 0x13], bl
je 0x45ea6e
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0045eba5
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x45eade
push 0x14
call fcn.004b6efe
cmp eax, ebx
pop ecx
je 0x45ea98
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x45ea9a
xor edi, edi
cmp edi, ebx
je 0x45eade
push esi
push edi
call fcn.0045e0cb
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0045e193
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045e2bc
add esp, 0x18
call fcn.0045eb68
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00468d8a
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45eaf5
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x45eb07
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x45eb4a
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x45eb4a
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0045e193
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045e2bc
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a628
Capabilities:
Encode data using xor

Disassembly:
adc ecx, eax
salc
jl 0x46a67d
imul edi, dword [edx + edx*4], 0x5dc2a45b
push es
dec ecx
les edi, [ebx]
invalid
dec esp
mov dl, 0x22
xor esi, dword [edx - 0x614fbada]
invalid
Function at 0x481bd1
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
inc ebx
mov esi, 0xca3c2568
push 0x5ad9bbac
enter 0x3e32, 0xffffffffffffffc1
cmc
cmp eax, 0x64202c3d
adc al, 0x18
sbb byte [ebx - 0x5a765684], bh
lahf
out 0xf6, eax
aaa
pop eax
daa
sti
or edi, dword [ecx]
adc eax, 0x8fd79be1
jl 0x481c5f
xchg dword [esi], ecx
invalid
xchg dword [edi], esp
sbb eax, 0xb3207599
and dh, byte [esi + 0x78]
cmp ebp, eax
inc edi
inc ebp
invalid
Function at 0x498a70
Capabilities:
Encode data using xor

Disassembly:
push esp
imul edx, dword [edi + esi], 0x60
sub byte [ebx - 2], 0x16
adc byte [edx - 0x2781fa39], al
mov ebp, 0x6d30adb2
pop ebp
push edx
movsb byte es:[edi], byte [esi]
add dl, byte [ebx - 0x62a2bc93]
popfd
xor esp, ecx
div dh
and dword [edi], esi
dec esi
daa
xchg ecx, eax
dec ecx
insd dword es:[edi], dx
pop eax
bound ebx, qword [edi + 0x5cc98e47]
pop esp
mov ebx, 0xbe7fd21d
sub dh, byte [eax]
popal
movsd dword es:[edi], dword [esi]
fdiv qword [esi + 0x60d269f2]
pop es
pop esp
pop esi
lea edi, [esp + ecx*8 + 0x238470b]
loopne 0x498a8c
js 0x498af9
adc esp, edi
lodsd eax, dword [esi]
mov ebp, 0xf5e21962
pop ebx
inc dword [eax]
xchg esi, eax
or edi, dword [edi - 0x607befe8]
ljmp 0x63a1
xor eax, 0x4d27329d
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x49fdfa
Capabilities:
Encode data using xor

Disassembly:
fbld tbyte [esi]
mov esp, ebp
dec edx
rcl byte [0x3a63be3e], cl
inc ecx
sub dword [0xa0c34e09], ecx
xchg ebx, eax
mov cl, dl
jbe 0x49fe91
out 0xba, eax
mov esp, 0xd0535ca0
out 0x58, al
imul ecx, dword [ebp - 0x78], 9
push edx
fsubrp st(3)
add al, 0xee
cmp dword [edx + 1], edx
mov bl, 0x30
ret
out dx, eax
mov byte [0x8a1b2dc3], al
invalid

Function at 0x4a0d97
Capabilities:
Check for vm using instruction vpcext

Disassembly:
leave
sub eax, 0x8cf2ec9c
xor edi, dword [ebx]
mov dword [edi], ecx
mov ah, 0x3a
dec ebx
pop edi
shl dword [eax - 0x4c], cl
sbb byte [esi + 0x6c423d7], 0xea
cmp dword [ecx - 0x2e], 0xffffff8d
lodsd eax, dword [esi]
and eax, 0xe38ea74d
sub al, 0x6d
and eax, 0xca37d74e
lahf
mov bh, 0xf
je 0x4a0dc2
pcmpeqb mm0, qword [ecx]
inc ebx
xchg cl, al
lds ecx, [edi + 0x5b]
pop ebx
pop ebx
push edx
or eax, 0xae4aef54
mov ch, 0x43
in eax, 0xc0
dec esi
in al, 2
mov byte [esi - 0xe], ah
sub al, 0x69
mov edi, 0xf13602dd
loope 0x4a0dbe
std
in eax, 0xb1
mov ebp, 0x93037e4a
push ss
scasb al, byte es:[edi]
loope 0x4a0e21
popfd
sub al, 0x4e
or al, 0x83
push esp
pop esi
mov bh, 0x7e
mov dword cs:[0x34e3129c], eax
not byte [ecx]
xchg ebp, eax
jnp 0x4a0d93
nop
outsb dx, byte [esi]
add al, 0x54
out 0x92, al
inc ebx
cmp al, byte [ebx - 0x5e]
popal
add dword [esi + 0x34a321cd], eax
cmp eax, dword [eax + 0x3f24714a]
push ecx
leave
mov ah, 0x1c
xchg esp, eax
mov dword [eax], edi
inc ebx
invalid
pop ds
mov eax, 0xc6d68537
sbb al, 0x19
or edx, dword [esi - 0x1b]
xor ebp, dword [ecx - 0x5268b751]
push es
inc esp
loop 0x4a0e24
test esi, edx
invalid
Function at 0x4a0dc6
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
leave
sub eax, 0x8cf2ec9c
xor edi, dword [ebx]
mov dword [edi], ecx
mov ah, 0x3a
dec ebx
pop edi
shl dword [eax - 0x4c], cl
sbb byte [esi + 0x6c423d7], 0xea
cmp dword [ecx - 0x2e], 0xffffff8d
lodsd eax, dword [esi]
and eax, 0xe38ea74d
sub al, 0x6d
and eax, 0xca37d74e
lahf
mov bh, 0xf
je 0x4a0dc2
pcmpeqb mm0, qword [ecx]
inc ebx
xchg cl, al
lds ecx, [edi + 0x5b]
pop ebx
pop ebx
push edx
or eax, 0xae4aef54
mov ch, 0x43
in eax, 0xc0
dec esi
in al, 2
mov byte [esi - 0xe], ah
sub al, 0x69
mov edi, 0xf13602dd
loope 0x4a0dbe
std
in eax, 0xb1
mov ebp, 0x93037e4a
push ss
scasb al, byte es:[edi]
loope 0x4a0e21
popfd
sub al, 0x4e
or al, 0x83
push esp
pop esi
mov bh, 0x7e
mov dword cs:[0x34e3129c], eax
not byte [ecx]
xchg ebp, eax
jnp 0x4a0d93
nop
outsb dx, byte [esi]
add al, 0x54
out 0x92, al
inc ebx
cmp al, byte [ebx - 0x5e]
popal
add dword [esi + 0x34a321cd], eax
cmp eax, dword [eax + 0x3f24714a]
push ecx
leave
mov ah, 0x1c
xchg esp, eax
mov dword [eax], edi
inc ebx
invalid
pop ds
mov eax, 0xc6d68537
sbb al, 0x19
or edx, dword [esi - 0x1b]
xor ebp, dword [ecx - 0x5268b751]
push es
inc esp
loop 0x4a0e24
test esi, edx
invalid
Function at 0x4af398
Capabilities:
Encode data using xor

Disassembly:
rcl dword [eax], 0x72
daa
invalid
enter 0x614c, 0xffffffffffffffe4
sbb dword [edi - 0x40], eax
rcl bh, cl
loope 0x4af33c
retf

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x405900
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x4684a0
call fcn.004136c5
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x30], 0xe7a59d5e
jmp 0x405970
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0x832e3702
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x30]
cmp eax, 0x7b3f85c4
jg 0x4059a0
cmp eax, 0x87c2ee91
jg 0x4059b0
cmp eax, 0x832e3702
jne 0x405970
mov eax, 0x288b00a5
cmp dword [ebp - 0x24], 0
jne 0x405998
mov eax, 0x390d096e
mov dword [ebp - 0x30], eax
jmp 0x405970
cmp eax, 0x7b3f85c5
jne 0x405970
jmp 0x40595d
cmp eax, 0x8d7b911d
jg 0x4059c7
cmp eax, 0x87c2ee92
jne 0x405970
mov dword [ebp - 0x30], 0x832e3702
jmp 0x405970
cmp eax, 0xb40b7caa
jg 0x405a10
cmp eax, 0x8d7b911e
jne 0x405970
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00413831
mov dword [ebp - 0x28], eax
mov ecx, 0xe7a23eff
cmp eax, dword [ebp - 0x18]
jne 0x405a08
mov ecx, 0x5009b9f1
mov dword [ebp - 0x30], ecx
jmp 0x405970
cmp eax, 0xe7a23efe
jg 0x405a4e
cmp eax, 0xb40b7cab
jne 0x405970
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.004021b0
mov dword [ebp - 0x30], 0x4da8755a
jmp 0x405970
cmp eax, 0x5009b9f0
jg 0x405a89
cmp eax, 0x4da87559
jg 0x405aac
cmp eax, 0x390d096d
jg 0x405acf
cmp eax, 0xe7a23eff
je 0x405adc
cmp eax, 0xe7a59d5e
jne 0x405ae8
mov eax, 0x87c2ee92
cmp dword [ebp - 0xc], 0
je 0x405a81
mov eax, 0xb40b7cab
mov dword [ebp - 0x30], eax
jmp 0x405970
cmp eax, 0x5009b9f1
jne 0x405970
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x30], 0x4da8755a
jmp 0x405970
cmp eax, 0x4da8755a
jne 0x405970
mov eax, 0x8d7b911e
cmp dword [ebp - 0x18], 0
jne 0x405ac7
mov eax, 0x7b3f85c5
mov dword [ebp - 0x30], eax
jmp 0x405970
cmp eax, 0x390d096e
jne 0x405970
jmp 0x405b0a
mov dword [ebp - 0x30], 0x832e3702
jmp 0x405970
cmp eax, 0x288b00a5
jne 0x405970
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.0041391b
mov dword [ebp - 0x30], 0x390d096e
jmp 0x405970
mov eax, dword [ebp - 0x2c]
add esp, 0x38
pop esi
pop edi
pop ebp
ret
Function at 0x4088e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov cx, word [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov word [ebp - 0x12], cx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], 0x13210d75
jmp 0x408950
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x78]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x3b7fb61f
nop
nop
nop
nop
mov eax, dword [ebp - 0x38]
cmp eax, 0x7fff65b7
jg 0x4089b0
cmp eax, 0x5b571332
jg 0x4089c0
cmp eax, 0x3b7fb61e
jg 0x4089f1
cmp eax, 0x2c8b98c3
jg 0x408a1a
cmp eax, 0xa20b5a7b
jg 0x408a31
cmp eax, 0x981b26ed
jne 0x408950
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 0x18]
cmp eax, 0x10b
mov eax, 0xdf43ccca
jne 0x4089a1
mov eax, 0x7fff65b8
mov dword [ebp - 0x38], eax
jmp 0x408950
cmp eax, 0x7fff65b8
jne 0x408950
jmp 0x408939
cmp eax, 0x5b571333
jne 0x408950
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x3c]
lea eax, [ecx + edx]
mov dword [ebp - 0x20], eax
mov eax, 0xdf43ccca
cmp dword [ecx + edx], 0x4550
jne 0x4089e9
mov eax, 0x981b26ed
mov dword [ebp - 0x38], eax
jmp 0x408950
cmp eax, 0x3b7fb61f
jne 0x408950
mov ecx, dword [ebp - 0x28]
movzx edx, word [ebp - 0x12]
mov eax, 0x11d49665
cmp dword [ecx + 0x18], edx
jbe 0x408a12
mov eax, 0xdadb6124
mov dword [ebp - 0x38], eax
jmp 0x408950
cmp eax, 0x2c8b98c4
jne 0x408950
mov dword [ebp - 0x38], 0xa20b5a7c
jmp 0x408950
cmp eax, 0xdadb6123
jg 0x408a56
cmp eax, 0xa20b5a7c
jne 0x408950
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x38], 0x1a83eb01
jmp 0x408950
cmp eax, 0x1a83eb00
jg 0x408aa7
cmp eax, 0xdf43ccc9
jg 0x408ab4
cmp eax, 0xdadb6124
jne 0x408950
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x1c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x34]
movzx edx, word [ebp - 0x12]
mov esi, dword [ebp - 0x30]
movzx edx, word [esi + edx*2]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x38], 0x1a83eb01
jmp 0x408950
cmp eax, 0x1a83eb01
jne 0x408950
jmp 0x408b31
cmp eax, 0x8b0db66
jg 0x408ad2
cmp eax, 0xdf43ccca
jne 0x408950
mov dword [ebp - 0x38], 0xa20b5a7c
jmp 0x408950
cmp eax, 0x8b0db67
je 0x408aec
cmp eax, 0x11d49665
jne 0x408b0e
mov dword [ebp - 0x38], 0xa20b5a7c
jmp 0x408950
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
movzx eax, word [eax]
cmp eax, 0x5a4d
mov eax, 0x2c8b98c4
jne 0x408b06
mov eax, 0x5b571333
mov dword [ebp - 0x38], eax
jmp 0x408950
cmp eax, 0x13210d75
jne 0x408950
mov eax, 0x8b0db67
cmp dword [ebp - 8], 0
je 0x408b29
mov eax, 0x3b7fb61f
mov dword [ebp - 0x38], eax
jmp 0x408950
mov eax, dword [ebp - 0xc]
add esp, 0x34
pop esi
pop ebp
ret
Function at 0x40a370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x40a0b0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00413b13
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x871d3c3e
jmp 0x40a3f0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x10], 0xb8bdf4fb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
cmp eax, 0x408ba06d
jg 0x40a450
cmp eax, 0x3b847544
jg 0x40a460
cmp eax, 0x7c0e50a
jg 0x40a482
cmp eax, 0xfffc33e2
jg 0x40a499
cmp eax, 0xcbe2a5b6
jg 0x40a4b0
cmp eax, 0xb8bdf4fa
jg 0x40a4d6
cmp eax, 0x871d3c3e
je 0x40a4f9
cmp eax, 0x889c6ca6
jne 0x40a511
mov dword [ebp - 0x10], 0xa0311410
jmp 0x40a3f0
cmp eax, 0x408ba06e
jne 0x40a3f0
jmp 0x40a3c4
cmp eax, 0x3b847545
jne 0x40a3f0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x10], 0xcbe2a5b7
jmp 0x40a3f0
cmp eax, 0x7c0e50b
jne 0x40a3f0
mov dword [ebp - 0x10], 0xcbe2a5b7
jmp 0x40a3f0
cmp eax, 0xfffc33e3
jne 0x40a3f0
mov dword [ebp - 0x10], 0xb8bdf4fb
jmp 0x40a3f0
cmp eax, 0xcbe2a5b7
jne 0x40a3f0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x10], 0x889c6ca6
jmp 0x40a3f0
cmp eax, 0xb8bdf4fb
jne 0x40a3f0
mov eax, 0x7c0e50b
cmp dword [ebp - 0xc], 0
jne 0x40a4f1
mov eax, 0xa0311410
mov dword [ebp - 0x10], eax
jmp 0x40a3f0
mov eax, 0xfffc33e3
cmp dword [ebp - 4], 0
je 0x40a509
mov eax, 0x408ba06e
mov dword [ebp - 0x10], eax
jmp 0x40a3f0
cmp eax, 0xa0311410
jne 0x40a3f0
add esp, 0x28
pop ebp
ret