joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424652
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x4246a9
in al, 0x94
dec eax
cli
sahf
or ebx, ebp
leave
sal dword [ebp + 0x36a56637], 0x51
insb byte es:[edi], dx
pop edx
call 0x20187ea2
loopne 0x4246d2
mov eax, 0xe5a3fbba
sbb edi, ebx
fbstp tbyte [ebx + 0x63ff227a]
cmp al, 0x6a
fstp dword [edx - 0x1ec10677]
mov esp, 0x5b7f313f
vmptrst qword [edi]
cmp eax, 0xbea6ff66
sti
dec ebx
jle 0x42469b
sbb al, 0x64
sbb eax, 0xdf643f57
add dword [esi + 0x4ac090e4], ebx
pushal
pop edx
inc eax
add dword [0xf995f7af], ecx
stc
call 0x902f281
invalid
inc ebx
xchg edi, eax
jne 0x424736
addps xmm6, xmmword [ebp + 0x2f]
out dx, eax
imul esi, dword [ebx - 0x3c], 0xffffff9a
cmpsd dword [esi], dword es:[edi]
int3
mov dl, 0x7b
dec ebp
adc ax, 0x404b
inc ebp
sbb ebx, dword [ebp - 0x1f]
and al, byte gs:[ecx + 0x1b9b51f3]
mov esi, 0x5529240c
dec ecx
push edi
or byte [ecx - 0x2d957ba4], 0xd
mov esi, gs
mov ch, 0x70
dec ebx
invalid
dec ebp
and cl, ch
push esp
aas
xor ebx, 0xffffffcb
nop
shr byte [ecx + 0x4d], cl
dec edx
push ecx
jno 0x4246f8
jle 0x42478a
dec edi
jnp 0x4246cf
sub eax, 0xad8975fb
int 0x61
ret 0x4d62
imul ebx, esi, 0x6d6f3f01
add eax, 0x3b49d0bf
enter 0x4baa, 0x31
mov esi, 0x6a53a1af
xchg edx, eax
dec ebx
clc
cmp dword [ebx - 0x56], edi
push edx
in eax, dx
stosd dword es:[edi], eax
sub byte [esi], 0x8c
xchg dh, al
xor bl, cl
wait
push 0x30
inc eax
mov cl, byte [edi]
mov esi, 0xde9afbb4
mov ebp, ss
mov dword [0x77247f30], eax
xchg al, dh
jle 0x4247f1
push eax
lcall 0x968b, 0x20ecfedb
cmp byte [ecx], dl
jmp 0x4247f7
xchg esi, eax
and al, 0xbd
fistp qword [ebx]
popfd
sal dword [edi + 0x62], 0x95
xchg edi, eax
cmc
adc al, 0x2f
clc
arpl word [ebp - 0x59], si
mov cs, word [edi - 0x725dafd5]
push ecx
adc eax, 0xd0261d7d
jo 0x4247f2
js 0x424862
enter 0xffffffffffffdd30, 0x52
jle 0x4247b1
mov bl, 0xb
out dx, al
enter 0xffffffffffff8e55, 0xffffffffffffffe8
push es
push ebx
xor eax, 0x52ff9787
test eax, 0xa1cd76df
or dh, dl
aas
lea eax, [eax]
mov edx, 0x10448d4f
mov edi, 0x8d7c390b
dec esp
sub eax, dword [edx - 0x20]
adc eax, 0xfc27440b
lea ebp, [ebx]
dec esi
out dx, eax
jl 0x42481d
inc edx
xor dword [edx - 0x286295da], ecx
add dword [eax], esp
mov ecx, 0xb1037fb
adc byte [ebx], cl
fdiv st(4), st(0)
cmpsd dword [esi], dword es:[edi]
jp 0x424825
invalid

Function at 0x424819
Capabilities:
Encode data using xor

Disassembly:
or al, 0x25
aam 0xa2
rcr byte cs:[ebx + 0x78], 1
sahf
in eax, dx
popal
invalid
Function at 0x44e15c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
jne 0x44e18e
movzx ecx, word [ebp + 8]
sar ecx, 8
push ecx
mov ecx, dword [ebp - 4]
call fcn.0044e05c
movzx edx, byte [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0044e05c
jmp 0x44e25d
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 1
jne 0x44e1b9
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0044e05c
movzx edx, word [ebp + 8]
sar edx, 8
push edx
mov ecx, dword [ebp - 4]
call fcn.0044e05c
jmp 0x44e25d
movzx eax, word [ebp + 8]
cmp eax, 0x7f
jg 0x44e1d4
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0044e05c
jmp 0x44e25d
movzx edx, word [ebp + 8]
cmp edx, 0x7ff
jg 0x44e20d
movzx eax, word [ebp + 8]
sar eax, 6
or eax, 0xc0
push eax
mov ecx, dword [ebp - 4]
call fcn.0044e05c
movzx ecx, word [ebp + 8]
and ecx, 0x3f
or ecx, 0x80
push ecx
mov ecx, dword [ebp - 4]
call fcn.0044e05c
jmp 0x44e25d
movzx edx, word [ebp + 0x16]
sub eax, 0x2c2ed90e
dec ecx
jp 0x44e258
dec ebp
popal
jg 0x44e292
dec ebp
and dword [ebp + 0x63], 0xb7bf84bc
popfd
pushfd
outsb dx, byte [esi]
invalid
or al, 0x6e
cmp eax, 0x617c60bc
jl 0x44e2c0
sbb bl, byte [edi + 0x13]
mov eax, dword [0x2a7e70bd]
adc al, 1
adc bh, byte [esi]
mov word [eax + 5], ss
add eax, 0x5017629a
inc edx
mov bp, 0x1c47
sahf
nop
mov esp, 0x5b70bc86
mov dh, 0x88
push es
jns 0x44e296
daa
int1
adc dl, byte [edi - 0x371465b0]
jecxz 0x44e30f
inc ecx
fcom qword [ebp - 0x4b]
std
xchg esi, eax
mov al, byte [0x50e88501]

Function at 0x44e34c
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xd00d707d
fistp qword [edi]
push 0x72
lea esi, [edx - 0x5b]
invalid
push cs
mov ah, byte [ecx + 0x260d49ed]
mov bl, 0x61
or eax, 0x69571d4b
xor al, 0x7c
xchg ebp, eax
jg 0x44e2fc
pop ebp
xchg ecx, eax
mov ah, 0x59
sal cl, 0xe5
imul ebx, ebx, 0xea72fd2c
scasb al, byte es:[edi]
pop ebp
in eax, dx
test al, 0x8e
push es
or edx, eax
pop ebp
pop es
inc ebp
xor bh, ch
fmul dword [ecx - 6]
jp 0x44e36b
ljmp 0x68e:0xa8ed5dae
adc eax, 0xb94abd57
mov al, bh
int 0x5e
mov word [eax + 0x413afe75], gs
fisttp qword [ecx + 0x4d]
jne 0x44e38b
cmp al, byte [ecx - 0x23]
dec ecx
dec ebp
mov cl, 0xb6
mov dl, 0xf5
pushal
insd dword es:[edi], dx
inc ecx
pop ebp
inc ecx
xchg edx, esi
jb 0x44e38b
jge 0x44e40f
dec esp
xor dword [edx + 0x1e9d0ca1], 0x42ddff1b
imul ecx, dword [ebp + 0x4f65dd11], 0xcc648c13
xor dword [eax + 0x4db81d8a], ebx
xor al, 0xc5
in eax, 0x1d
push esi
add eax, 0xacb3d874
inc eax
fstp qword [ebp - 0x4bd2c013]
or dword [edx], esi
adc bl, byte [0x7c3ded4c]
stosb byte es:[edi], al
sar byte cs:[ecx + edx*2 + 0x67495aa5], 0x58
popal
lodsb al, byte [esi]
rcl byte [ecx - 0x25b0325]
sar byte [0xcb19ecab], cl
mov cl, 0x8d
int3
fsubp st(1)
sub eax, 0x9c53f591
sub edx, dword [ecx + ebx*8]
xor edi, dword [ebp + 0x16e0557f]
pop ebx
ret 0x88a4
Function at 0x451343
Capabilities:
Encode data using xor

Disassembly:
pop ss
add dword [edi - 0x1b], ebp
push cs
and dl, byte [edx + esi]
cmp al, byte [edi - 0x4b]
mov ebx, 0xab941a07
or eax, 0xb1fb43dd
insd dword es:[edi], dx
popal
salc
add byte [ebx + 0x2f], cl
jle 0x4513d7
push cs
pop esp
test eax, 0xd0241b0c
adc byte [ebx + 0x3e], cl
inc esi
adc al, 0xf8
invalid
inc eax
pop es
shr dword gs:[ecx + 0x109b2462], cl
sahf
xor dword [ebx - 0x57], ebx
bound esp, qword [esi + ebx*2 - 0x746e7c27]
out 0xc, al
invalid

Function at 0x49375c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
jne 0x49378e
movzx ecx, word [ebp + 8]
sar ecx, 8
push ecx
mov ecx, dword [ebp - 4]
call fcn.0049365c
movzx edx, byte [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0049365c
jmp 0x49385d
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 1
jne 0x4937b9
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0049365c
movzx edx, word [ebp + 8]
sar edx, 8
push edx
mov ecx, dword [ebp - 4]
call fcn.0049365c
jmp 0x49385d
movzx eax, word [ebp + 8]
cmp eax, 0x7f
jg 0x4937d4
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0049365c
jmp 0x49385d
movzx edx, word [ebp + 8]
cmp edx, 0x7ff
jg 0x49380d
movzx eax, word [ebp + 8]
sar eax, 6
or eax, 0xc0
push eax
mov ecx, dword [ebp - 4]
call fcn.0049365c
movzx ecx, word [ebp + 8]
and ecx, 0x3f
or ecx, 0x80
push ecx
mov ecx, dword [ebp - 4]
call fcn.0049365c
jmp 0x49385d
movzx edx, word [ebp + 8]
cmp edx, 0xffff
jg 0x49385d
movzx eax, word [ebp + 8]
sar eax, 0xc
or eax, 0xe0
push eax
mov ecx, dword [ebp - 4]
call fcn.0049365c
movzx ebx, ax
dec eax
add eax, 0xd669b558
sbb dword [edx - 0x5ac97583], edi
ljmp 0x115a
push ecx
aam 0x8c
jo 0x4938b2
pop ebp
call 0xa0a48da2
mov si, dx

Function at 0x493cfc
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x98
cmc
and al, 0xed
rol bh, cl
lodsd eax, dword [esi]
imul esp, dword [eax], 0xe319d6a7
arpl cx, bp
sub bh, bh
inc esi
jp 0x493d83
dec eax
les edx, [esi + ebx*4 + 0x6b]
sbb eax, 0xe5082605
aaa
cmp dword [eax], edi
test eax, 0xcbf5d8af
or edi, edi
in eax, 0x78
lds ecx, [eax - 0x4f0a120b]
xor eax, 0x54e4581f
cmp eax, 0xeb87c479
cmp al, 0xdd
inc eax
int1
pop ebx
clc
imul eax, dword [ebx + esi*8 - 0x2b], 0xffffffdf
push edx
mov esp, 0x8065f974
scasb al, byte es:[edi]
fstp qword [esi - 0x801975e]
imul esi, dword [edi - 0x47], 0xd6752da6
mov bl, ah
inc esi
sbb al, cl
adc al, 0xe8
xchg dword [eax], eax
rcl byte [ecx]
ficom word [ecx]
or al, al
jle 0x493db9
push 0xffffffffffffffce
xor esi, 0x2e
out dx, al
mov al, 3
ret
jnp 0x493d5a
out dx, al
movsd dword es:[edi], dword [esi]
scasb al, byte es:[edi]
xchg ebp, eax
sti
dec ecx
invalid

Function at 0x4b5fcd
Capabilities:
Check for software breakpoints

Disassembly:
lodsb al, byte [esi]
insd dword es:[edi], dx
scasd eax, dword es:[edi]
dec ecx
mov byte [0x661d5c2c], al
cmp dword [esi - 0x7c], 0xffffffc1
int 0x94
pop ecx
push es
push ss
retf
clc
and al, 0x21
cmp al, 0xcc
loope 0x4b5f83
movsb byte es:[edi], byte [esi]
jbe 0x4b5f72
dec ebp
invalid
Function at 0x5d70e8
Capabilities:
Encode data using xor

Disassembly:
lock and byte [eax + 0x6a], cl
jp 0x5d7151
inc ebx
scasd eax, dword es:[edi]
push edx
popfd
xor eax, 0x7cf5dba0
popal
std
adc bh, dl
pop ecx
mov ebp, 0x80f7b9bb
fbstp tbyte [eax]
sbb bh, 0x30
and eax, 0xcb2d0748
mov eax, 0x6d232ca1
invalid
je 0x5d70ee
and dword [edi], edi
mov eax, dword [0x92d288f]
adc al, 0x5e
mov dword [esi - 0x6e], 0x72a8de43
pop edi
add ebp, esi
xlatb
shr esi, 1
fdivr dword [edx - 0x7d]
das
daa
mov al, byte [0x3c86375e]
jge fcn.005d70e8
add byte [edx - 0xc], 0xd
sbb dword [edx + 0x116b695b], esi
add edx, edi
cwde
jb 0x5d7101
mov eax, 0x31e09874
add al, 0x5a
sahf
dec eax
jecxz 0x5d711e
sahf
in eax, dx
out dx, al
sub al, 0x39
imul ecx, dword [ebx + 0x65be4e20], 0xe506f538
dec ebx
wait
jae 0x5d71a7
mov dl, 0xdc
rcl byte [edi], 0x59
jb 0x5d71a0
xor al, 0xf
std
int3
pop ebx
bound esi, qword [esi]
or dword es:[ecx + 0x45], 0x39
or dword [ecx + 0x45], 0x39
cmp dword [0x2a751582], edx
adc eax, 0x2a751582
xchg edi, eax
xlatb
xor bh, byte [edx + 0x42]
add ebx, dword [edi]
lea ecx, [edi - 0x179220f6]
leave
xchg edi, eax
cmp ah, ah
sub al, 0x8d
fisub word [edx - 0x61]
cmc
shl dword [esi + edx - 0x38], cl
dec edi
mov bl, 0x29
jge 0x5d71fd
wait
int3
jnp 0x5d71eb
pop ebp
aas
cwde
or byte [esi - 0x21], ch
push 0xa0abd4ed
mov ah, 0x1e
xor eax, 0x83a509f5
push edx
or dword [eax - 0x52fd0856], 0x69a30d20
sub byte [ebx + 0x3a97396e], 0x86
jbe 0x5d71a4
stosd dword es:[edi], eax
mov al, byte [0xf5351eb4]
or dword [ebp - 0x777ead7d], esp
stosb byte es:[edi], al
test dword [edx], 0xa30d20ad
imul eax, dword [edx - 0x68c69155], 0x9c76863a
mov dword [0x6eab8269], eax
cmp dword [edi - 0x638979c6], edx
push cs
salc
cld
and al, 0xd0
lcall 0xa9b5, 0x3331f7bc
add byte [edi - 0x4011ea4c], bl
pop ss
test dh, dh
cmp dh, byte [ebp + 0xe7db92e]
push cs
xchg esp, eax
insb byte es:[edi], dx
lcall 0x206e, 0x1f409fe2
test eax, 0xe9747650
push esi
mov edx, 0x2d6a858e
mov bh, 0x2e
movsb byte es:[edi], byte [esi]
stc
mov dh, 0x85
push 0xd389d306
mov dh, 0x22
fadd qword [edi + edx*8]
mov eax, 0xc08b0e3f
add dword [esi], edi
les ebx, [edx + ebx*2 - 0x6590619]
xor esi, dword [edx + 0x47cab622]
salc
jge 0x5d7222
jp 0x5d71e0
sub ch, bh
pop edi
sbb ebx, dword [edi]
invalid
Function at 0x5d7ab6
Capabilities:
Encode data using xor

Disassembly:
rcl byte [ebp - 0x1df514a7], 0x8c
cmp al, 0x72
mov dword [eax - 0x3a], esi
or byte [eax + 0x67], 0x9f
xchg byte [esi], ch
add cl, bh
mov ch, 0x79
sub byte [esi - 0x2b1db6fa], dh
and bl, byte [0x2d5e0fb]
rcr byte [eax + ecx*4], cl
dec edi
out 0x34, eax
push ebx
cmpsd dword [esi], dword es:[edi]
fbstp tbyte [ebp - 0x77]
cmp ah, cl
push ebx
xchg byte [ecx - 0x3c8db7ca], cl
mov eax, eax
loop 0x5d7ae1
int 0x9b
dec ebp
xchg edx, eax
rcl byte [esi - 0x7a]
mov esi, 0x76d9e35e
xchg ebx, eax
mov dl, 0xec
push ecx
xlatb
push edi
insb byte es:[edi], dx
or dword [esi + 0x31], esi
js 0x5d7af4
dec edi
push 0xffffffffffffffc6
push eax
cmp cl, byte [ecx - 0x547764c0]
mov eax, dword [eax]
push eax
pop ds
jne 0x5d7a55
add dword [eax], ebp
push edi
pop ds
popal
imul dword [esi - 0x293fbf57]
xchg ecx, eax
pop edx
mov byte [0x28d702a2], al
pop ss
jo 0x5d7a88
push cs
sub al, 0x72
xor eax, 0xe139dedc
push esp
loope 0x5d7b37
int3
xchg esi, eax
dec esp
mov eax, 0x10479c46
pop edx
or byte [eax - 0x63e0199f], al
invalid
pop ss
sub dl, byte [ebx]
in eax, dx
jg 0x5d7b34
mov ah, 0x82
mov bh, 0xa4
adc al, 0x68
cmovg edx, dword [ecx + 0x5900a638]
mov ebx, 0xdfaacee8
add byte [ecx + 0x67], bl
mov ebx, 0xdfaacee8
test dword [ebp*8 - 0x3ea5acf3], eax
popfd
mov byte [0x16e42067], al
pop ss
or dl, byte [edi + edi]
and eax, 0x83c02c69
mov ss, word fs:[ebp - 0x8e82c0f]
sbb eax, eax
cmc
stosd dword es:[edi], eax
mov esp, 0xcd67c960
int 0x31
rcl dword [0x5c07b73e], 0xaa
jns 0x5d7b45
xchg byte [eax - 0x5bb694bf], al
xchg esi, eax
cmp al, bl
cld
dec ebp
cmpsb byte [esi], byte es:[edi]
sbb dword [ebx + 0x13], ecx
or eax, 0xc5918f9b
mov ebx, 0xa8f00625
sti
dec ebx
test byte [edx - 0x3a1c1fb0], al
sbb al, 0xa1
ja 0x5d7bc8
mov dword [0xd98dbb20], eax
stc
or ah, bl
stosd dword es:[edi], eax
out dx, al
lds eax, [ebx]
xor eax, dword [edi]
out 0xba, eax
jp 0x5d7c03
mov word [edx + 0x7d], fs
cmp byte [eax + 0xce1b7d1], 0x23
dec edi
loope 0x5d7bfe
and al, 0x54
push esp
xor eax, 0x287654a1
push esp
jbe 0x5d7bf3
pushfd
test al, 0xe6
xchg edi, eax
adc al, 0xae
jae 0x5d7bfe
int1
pop esi
sbb ebx, ebp
jae 0x5d7bb0
mov ah, 0xf0
pop edi
inc edi
arpl word [ecx + 0x66], si
loopne 0x5d7c30
cdq
jg 0x5d7c1a
cmpsd dword [esi], dword es:[edi]
enter 0x601, 0x3e
push 0x4702dcdc
sbb eax, 0x8bc6600c
pop esp
call 0x6a33b754
mov ebx, fs
pop eax
or dword [eax - 0x13], ebp
pushal
push ebp
push esp
mov ebx, dword [eax + ebp*8 + 0x5a]
cmp edx, esi
imul ecx, dword [ebx - 0x1297f6a8], 0xab545560
push 0x545560ed
stosd dword es:[edi], eax
dec esi
hlt
invalid
aad 0xbb
inc ebx
dec ebx
into
xchg byte fs:[ebx + 0x3e], ah
sbb dh, 0xba
pushfd
ror dword [esi - 0x28], cl
xchg edi, eax
sub edx, esi
cmp dword [ebp + 0x6763e19], 0x1e
xor esp, ebx
add byte [ebp - 0x2a3d3eaa], dh
sbb edi, dword [edx]
nop
aas
int1
sbb esi, ebp
invalid
Function at 0x401850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], str.mkisofs
mov dword [esp + 4], str.Usage:__s__options__file..._n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0042c789
mov dword [esp + 8], str.mkisofs
mov dword [esp + 4], str._nUse__s__help_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0042c789
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
mov dword [esp], str.to_get_a_list_of_valid_options._n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_exit
Function at 0x40913f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov esi, eax
mov dword [esp + 4], 0x2f
mov dword [esp], eax
call sub.msvcrt.dll_strchr
cmp eax, esi
jne 0x4091f4
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x3a
mov dword [esp + 4], 1
mov dword [esp], str.call_to_search_tree_file_with_an_absolute_path__stripping_n
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x32
mov dword [esp + 4], 1
mov dword [esp], str.initial_path_separator._Hope_this_was_intended..._n
call sub.msvcrt.dll_fwrite
mov edi, esi
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
sub ecx, 2
mov dword [esp + 8], ecx
lea eax, [esi + 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_memmove
mov dword [esp + 4], 0x2f
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x409237
mov byte [eax], 0
lea edi, [eax + 1]
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x40921e
mov eax, dword [ebx + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x409225
mov ebx, dword [ebx]
test ebx, ebx
jne 0x409205
mov eax, 0
jmp 0x409262
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0040913f
jmp 0x409262
mov eax, ebx
jmp 0x409262
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x40925d
mov eax, dword [ebx + 0x10c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x409233
mov ebx, dword [ebx]
test ebx, ebx
jne 0x40923e
mov eax, 0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409408
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x22c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
cmp dword [0x4550d8], 0
je 0x4094b4
cmp dword [0x455368], 0
je 0x40944b
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_ftell
cmp eax, 0x3fffffff
jle 0x4094b4
cmp dword [0x455368], 0
jne 0x409458
mov eax, dword [0x466d70]
mov dword [esp], eax
call sub.msvcrt.dll__unlink
mov eax, dword [0x455368]
mov dword [esp + 0xc], eax
inc eax
mov dword [0x455368], eax
mov eax, dword [0x466d70]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__02d
lea ebx, [ebp - 0x218]
mov dword [esp], ebx
call fcn.0042c971
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x450de8
mov dword [esp], ebx
call sub.msvcrt.dll_freopen
mov dword [ebp + 0x14], eax
test eax, eax
jne 0x4094b4
mov dword [esp + 4], ebx
mov dword [esp], 0x450deb
call fcn.0042c45d
test esi, esi
je 0x409531
cmp dword [0x455094], 0
je 0x4094ed
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0040953c
mov ebx, eax
jmp 0x409509
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_fwrite
mov ebx, eax
test ebx, ebx
jg 0x409524
mov dword [esp + 8], esi
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.cannot_fwrite__d_d_n
call fcn.0042c45d
mov eax, dword [ebp + 0xc]
imul eax, ebx
lea edi, [eax + edi]
sub esi, ebx
jne 0x4094b8
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40953c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, edx
imul ebx, eax
cmp dword [0x455094], 0x800
jne 0x40957b
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], edi
call sub.msvcrt.dll_fwrite
jmp 0x40963e
test ebx, 0x7ff
je 0x40959b
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Trying_to_write__d_bytes__not_a_multiple_of_2048_._n
mov dword [esp], 0xffffffff
call fcn.0042c48d
lea eax, [ebp - 0x18]
mov byte [eax + 4], 0
mov byte [ebp - 0x18], 0
mov byte [eax + 5], 0
mov byte [eax + 1], 0
mov byte [eax + 7], 0
mov byte [eax + 3], 0
test ebx, ebx
jle 0x409639
mov esi, eax
mov byte [esi + 6], 8
mov byte [esi + 2], 8
cmp ebx, 0x800
setle al
cmp dword [ebp + 0x1c], 0
setne dl
movzx eax, al
test edx, eax
je 0x4095e3
mov byte [esi + 6], 0x89
mov byte [esi + 2], 0x89
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 8
mov dword [esp], esi
call sub.msvcrt.dll_fwrite
test eax, eax
jle 0x40963e
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x800
mov dword [esp], edi
call sub.msvcrt.dll_fwrite
test eax, eax
jle 0x40963e
add edi, 0x800
sub ebx, 0x800
test ebx, ebx
jg 0x4095bc
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d317
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x807c
call fcn.0042ee60
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x78]
mov dword [esp], eax
call fcn.00421090
mov dword [esp + 4], 0x451501
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x40d3e3
jmp 0x40d368
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, 0
jmp 0x40d3e3
test esi, esi
je 0x40d3bc
mov ebx, esi
cmp esi, 0x8000
jbe 0x40d37b
mov ebx, 0x8000
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
lea eax, [ebp - 0x8078]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ebx, eax
test eax, eax
je 0x40d359
mov dword [esp + 8], eax
lea eax, [ebp - 0x8078]
mov dword [esp + 4], eax
lea eax, [ebp - 0x78]
mov dword [esp], eax
call fcn.004210c1
sub esi, ebx
jne 0x40d36c
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp], 0x10
call fcn.00405785
mov ebx, eax
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00421189
mov eax, ebx
add esp, 0x807c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ead6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, dword [ebp + 0xc]
cmp word [0x464772], 0
jne 0x40eb23
mov ebx, 0
mov esi, 0x464770
mov edx, ebx
shl edx, 8
mov ecx, 0
mov eax, edx
and eax, 0x8000
add edx, edx
test eax, eax
je 0x40eb10
xor edx, 0x11021
inc ecx
cmp ecx, 7
jbe 0x40eafd
mov word [esi + ebx*2], dx
inc ebx
cmp ebx, 0xff
jbe 0x40eaf3
mov eax, 0
mov ebx, 0
cmp eax, edi
jae 0x40eb51
mov ecx, eax
shl ecx, 8
mov esi, dword [ebp + 8]
movzx edx, byte [ebx + esi]
movzx eax, ah
xor eax, edx
movzx eax, word [eax + eax + 0x464770]
xor eax, ecx
inc ebx
cmp ebx, edi
jb 0x40eb31
and eax, 0xffff
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41077b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov eax, dword [0x464a00]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp], eax
mov dword [ebp - 0x3c], 0
mov ecx, 0x800
mov eax, dword [ebp + 8]
imul ecx
mov ebx, eax
mov esi, edx
lea edi, [ebp - 0x38]
cld
mov ecx, 5
mov edx, 0
mov eax, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
lea edx, [ebp - 0x38]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x3c]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
shl edx, 0xb
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
jne 0x410829
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x19
mov dword [esp + 4], 1
mov dword [esp], str._Error_reading_old_image_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xa
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x417d45
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [ebp + 8]
mov dword [0x466314], 1
mov dword [0x466348], 1
mov dword [0x466338], 1
mov dword [0x466318], 0
cmp byte [ebx], 0x2d
jne 0x417d89
mov dword [0x466328], 2
inc ebx
jmp 0x417db4
cmp byte [ebx], 0x2b
jne 0x417d9b
mov dword [0x466328], 0
inc ebx
jmp 0x417db4
mov dword [esp], str.POSIXLY_CORRECT
call sub.msvcrt.dll_getenv
test eax, eax
sete al
movzx eax, al
mov dword [0x466328], eax
mov eax, ebx
add esp, 4
pop ebx
pop ebp
ret

Function at 0x418d42
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.msvcrt.dll_memset
mov dword [esp + 4], 0x452992
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
mov eax, 0xffffffff
test esi, esi
je 0x418dad
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret