joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e130
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x46e15e
mov eax, ebx
call fcn.0046ebd4
cmp dword [ebx + 0x3c], 0
je 0x46e157
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46e1cf
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x46e1c1
cmp dword [ebx + 8], 0
je 0x46e180
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x46e192
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46e1c1
cmp dword [ebx + 8], 0
je 0x46e173
cmp eax, 3
je 0x46e1a5
dec eax
jne 0x46e173
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46e173
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x46e173
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x46e1ed
cmp dword [ebx + 0x10], 0xcc
je 0x46e1ed
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046e1f8
pop ebx
ret

Function at 0x487ec4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x487ef2
mov eax, ebx
call fcn.00488968
cmp dword [ebx + 0x3c], 0
je 0x487eeb
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x487f63
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x487f55
cmp dword [ebx + 8], 0
je 0x487f14
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x487f26
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x487f55
cmp dword [ebx + 8], 0
je 0x487f07
cmp eax, 3
je 0x487f39
dec eax
jne 0x487f07
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x487f07
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x487f07
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x487f81
cmp dword [ebx + 0x10], 0xcc
je 0x487f81
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00487f8c
pop ebx
ret
Function at 0x492388
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x732a90
test esi, esi
jne 0x4923a2
xor eax, eax
jmp 0x4924a4
cmp dword [ebp], 0
jne 0x4923ad
call fcn.00492318
xor ebx, 0xffffffff
cmp edi, 8
jb 0x49247d
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4923b9
test edi, edi
jbe 0x49249f
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x492481
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bbe30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bbf08
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x733be0], 0
jne 0x4bbeec
lea eax, [ebp - 4]
mov edx, 0x4bbf20
call fcn.00403f5c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404308
mov esi, eax
push esi
call fcn.0040811c
mov ebx, eax
test ebx, ebx
je 0x4bbeec
mov eax, ebx
call fcn.00402810
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bbee5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call fcn.00408114
test eax, eax
je 0x4bbecf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4bbf30
mov eax, dword [ebp - 0xc]
push eax
call fcn.00408124
test eax, eax
je 0x4bbecf
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x733be0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbeec
mov eax, dword [ebp - 0xc]
call fcn.00402828
ret
mov ebx, dword [0x733be0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbf0f
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x4db388
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4db5e7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4db3ea
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004dae50
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e5ac
cmp al, 1
jne 0x4db3ea
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004db168
test al, al
je 0x4db576
cmp dword [ebp - 8], 0
jge 0x4db408
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004dae50
mov eax, dword [ebp - 0x210]
call fcn.00404144
cmp ebx, eax
jge 0x4db452
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004dae50
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x731754]
and eax, 0xff
bt dword [edx], eax
jae 0x4db452
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 8]
jg 0x4db466
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004db364
cmp ebx, dword [ebp - 8]
je 0x4db568
lea eax, [ebp - 0x108]
push eax
call fcn.00408754
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4db492
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.00403300
and eax, 0x7f
movzx eax, word [eax*2 + 0x71801c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call fcn.00408a4c
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 1
xor eax, eax
push ebp
push 0x4db555
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.00403300
and eax, 0x7f
movzx eax, word [eax*2 + 0x71801c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0043f298
push eax
call fcn.00408a04
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.00403300
and eax, 0x7f
movzx eax, word [eax*2 + 0x71801c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0043f298
push eax
call fcn.00408a04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db55c
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x218], edx
jmp 0x4db5c9
cmp dword [ebp - 8], 0
jge 0x4db581
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004dae50
mov eax, dword [ebp - 0x218]
call fcn.00404144
cmp eax, dword [ebp - 8]
jg 0x4db5bb
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004dae50
mov eax, dword [ebp - 0x21c]
call fcn.00404144
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004db364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db5ee
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403ee8
ret
Function at 0x507934
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x507952
and ecx, ecx
jle 0x507952
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x50793d
pop ebx
ret
Function at 0x50a210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0040296c
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x50a2ef
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x71a4e0]
mov edx, 8
call fcn.00507444
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0x71a4e0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x71a4e0]
mov edx, 0x10
call fcn.00507444
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0x71a4e0]
mov edx, 0x18
call fcn.00507444
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x50a272
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50bb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
and eax, 0xff
imul eax, eax, 0x1010101
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
xor eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
jne 0x50bb25
mov esp, ebp
pop ebp
ret

Function at 0x50bb48
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x71c190
lea eax, [ebp - 0x108]
call fcn.0050bb00
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x18]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x71c190]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x71c390]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x50bb7b
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x71c290
lea eax, [ebp - 0x108]
call fcn.0050bb00
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x17]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x71c190]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x71c790]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x400], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x50bbdc
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x71c190
lea eax, [ebp - 0x108]
call fcn.0050bb00
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x16]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x71c290]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x71cb90]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x800], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x50bc41
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x71c290
lea eax, [ebp - 0x108]
call fcn.0050bb00
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x15]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x71c290]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x71cf90]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0xc00], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x50bca6
mov esp, ebp
pop ebp
ret
Function at 0x50bce4
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x71c290
lea eax, [ebp - 0x10c]
call fcn.0050bb00
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x14]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x71c190]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x71c190]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x71c390]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x50bd21
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x71c290
lea eax, [ebp - 0x10c]
call fcn.0050bb00
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x17]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x13]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x71c290]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x71c190]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x71c790]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x400], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x50bd96
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x71c190
lea eax, [ebp - 0x10c]
call fcn.0050bb00
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x16]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x12]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x71c190]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x71c290]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x71cb90]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x800], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x50be0f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x71c190
lea eax, [ebp - 0x10c]
call fcn.0050bb00
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x15]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x11]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x71c290]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x71c290]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x71cf90]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0xc00], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x50be88
mov esp, ebp
pop ebp
ret
Function at 0x5127bc
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00407fc4
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x5127eb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
jmp 0x5127ff
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0042767c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x520f2c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004161e0
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004161f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call fcn.0040805c
call fcn.0040f018
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jne 0x520f74
cmp eax, dword [ebp + 8]
jbe 0x520f85
jmp 0x520f76
jle 0x520f85
mov eax, dword [ebp + 8]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004161f0
jmp 0x520f92
mov eax, dword [ebp - 0x10]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004161f0
mov esp, ebp
pop ebp
ret 8

Function at 0x523cd4
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x523cf6
and ecx, ecx
jle 0x523cf6
push ebx
push edi
xor ebx, ebx
lea edi, [0x523cfc]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x523ce6
pop edi
pop ebx
ret

Function at 0x524130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10f]
mov edx, 0x524198
call fcn.0040ad74
lea eax, [ebp - 0x104]
push eax
push 0xff
call fcn.00407f44
lea eax, [ebp - 0x214]
push eax
push 0
lea eax, [ebp - 0x10f]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00407f3c
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x214]
mov ecx, 0x105
call fcn.004040f4
mov esp, ebp
pop ebp
ret
Function at 0x540e94
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x540f52
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x540f68
mov eax, dword [ebp - 4]
call fcn.00540a54
push dword [ebp + 0xc]
push dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00540c24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call fcn.0040805c
test eax, eax
jne 0x540f3c
call fcn.00407ecc
mov dword [ebp - 8], eax
push 0x540f78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x10
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040d424
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x28]
push eax
push 3
mov ecx, 0x76a2
mov dl, 1
mov eax, dword [0x511cb0]
call fcn.00511e14
call fcn.004038bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540f59
lea eax, [ebp - 0x2c]
call fcn.00403ec4
ret

Function at 0x540fc0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x541073
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x54108c
mov eax, dword [ebp - 0xc]
call fcn.00540a54
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push eax
call fcn.00407ec4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x541057
call fcn.00407ecc
mov dword [ebp - 0x14], eax
push 0x54109c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040d424
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x2c]
push eax
push 2
mov ecx, 0x76a3
mov dl, 1
mov eax, dword [0x511cb0]
call fcn.00511e14
call fcn.004038bc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54107a
lea eax, [ebp - 0x30]
call fcn.00403ec4
ret

Function at 0x54184c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edx, 0x5418b0
mov eax, dword [ebp - 4]
call fcn.00540a54
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00540bbc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x54189f
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call fcn.0040803c
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5418bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5419cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5419e4
mov eax, dword [ebp - 4]
call fcn.00540a54
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00540c24
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call fcn.004080e4
test eax, eax
jne 0x5419b6
call fcn.00407ecc
mov dword [ebp - 0x14], eax
push 0x5419f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
lea eax, [ebp + 8]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0x10
lea eax, [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0x10
mov eax, dword [ebp - 4]
call fcn.00540d5c
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x54]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x10
mov eax, dword [ebp - 4]
call fcn.00540fc0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x10
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x14]
call fcn.0040d424
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x4c]
push eax
push 6
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x511cb0]
call fcn.00511e14
call fcn.004038bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5419d3
lea eax, [ebp - 0x60]
call fcn.00403ec4
ret