joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101d45a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], edx
mov esi, 1
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
sar eax, 4
sub eax, 1
je 0x101d466f
mov ebx, dword [ebp + 8]
nop dword [eax]
dec eax
mov edx, ebx
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.101c75f0
cmp eax, 0x100aab20
je 0x101d46a3
cmp dword [eax + 8], 3
jne 0x101d46a3
test esi, esi
je 0x101d4660
mov edx, ebx
mov ecx, edi
call fcn.101c75f0
mov ecx, dword [eax + 8]
cmp ecx, 3
je 0x101d463b
cmp ecx, 4
jne 0x101d469e
mov ecx, dword [eax]
lea edx, [esp + 0x28]
add ecx, 0x10
call fcn.101d8ed0
test eax, eax
je 0x101d469e
movsd xmm0, qword [esp + 0x28]
lea eax, [esp + 0x30]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 0x38], 3
movsd xmm0, qword [eax]
sub esp, 8
movsd qword [esp], xmm0
push 0x100ab2f4
push dword [esp + 0x24]
call fcn.101c82d0
add esp, 0x10
test eax, eax
jg 0x101d4729
xor esi, esi
mov eax, dword [esp + 0x24]
inc ebx
test eax, eax
jne 0x101d45d0
call fcn.1021e92c
mov ebx, dword [eax]
mov eax, dword [edi + 8]
test esi, esi
je 0x101d4733
mov dword [eax], 1
mov dword [eax + 8], 1
mov eax, 1
add dword [edi + 8], 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
jmp 0x101d463f
lea eax, [esp + 0x20]
mov edx, ebx
push eax
mov ecx, edi
call fcn.101c7860
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x101d4705
mov edx, ebx
mov ecx, edi
call fcn.101c75f0
cmp eax, 0x100aab20
je 0x101d46dd
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x101d46dd
mov eax, dword [eax*4 + 0x100aac0c]
jmp 0x101d46e2
mov eax, 0x100a9fc8
push eax
push dword [0x100aac1c]
push 0x100aa03c
push edi
call fcn.101c79f0
push eax
mov edx, ebx
mov ecx, edi
call fcn.101c8300
mov eax, dword [esp + 0x30]
add esp, 0x14
test esi, esi
je 0x101d4660
push dword [esp + 0x18]
mov esi, dword [esp + 0x24]
push esi
push 1
push eax
call fcn.102213e1
add esp, 0x10
cmp eax, esi
jne 0x101d4660
mov esi, 1
jmp 0x101d4662
mov dword [eax + 8], 0
add dword [edi + 8], 0x10
push ebx
call fcn.1021ee41
add esp, 4
push eax
push 0x100aa300
push edi
call fcn.101c79f0
mov eax, dword [edi + 8]
add esp, 0xc
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mov dword [eax + 8], 3
movsd qword [eax], xmm0
mov eax, 3
add dword [edi + 8], 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101de1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 8]
mov ebx, edx
mov edi, edx
mov dword [esp + 0xc], ecx
shr edi, 5
mov esi, edx
inc edi
cmp edx, edi
jb 0x101de23e
mov edx, dword [esp + 0x10]
nop dword [eax]
movzx ecx, byte [edx + esi - 1]
mov eax, ebx
shl eax, 5
sub esi, edi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, edi
jae 0x101de220
mov edx, dword [ebp + 8]
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x101de2d4
cmp dword [edi + 0xc], edx
jne 0x101de2ca
mov esi, dword [ebp + 8]
lea eax, [edi + 0x10]
mov edx, dword [esp + 0x10]
sub esi, 4
jb 0x101de281
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x101de28a
add edx, 4
add eax, 4
sub esi, 4
jae 0x101de270
cmp esi, 0xfffffffc
je 0x101de37a
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x101de2c7
cmp esi, 0xfffffffd
je 0x101de37a
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x101de2c7
cmp esi, 0xfffffffe
je 0x101de37a
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x101de2c7
cmp esi, 0xffffffff
je 0x101de37a
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x101de37a
mov edx, dword [ebp + 8]
mov edi, dword [edi]
test edi, edi
jne 0x101de258
mov esi, dword [esp + 0xc]
lea eax, [edx + 1]
cmp eax, 0xffffffed
jbe 0x101de2ed
push 0x100ab618
push esi
call fcn.101d09b0
mov edx, dword [ebp + 8]
add esp, 8
lea eax, [edx + 0x11]
mov ecx, esi
push eax
push 0
xor edx, edx
call fcn.101d70f0
mov ecx, dword [esp + 0x14]
mov edi, eax
mov esi, dword [ebp + 8]
push esi
push dword [esp + 0x1c]
mov dword [edi + 0xc], esi
lea eax, [edi + 0x10]
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x10]
push eax
mov cl, byte [ecx + 0x14]
and cl, 3
mov byte [edi + 4], 4
mov byte [edi + 5], cl
mov byte [edi + 6], 0
call fcn.10217740
mov byte [edi + esi + 0x10], 0
add esp, 0x14
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
dec eax
and eax, ebx
lea ecx, [eax*4]
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi], eax
mov eax, dword [edx]
mov dword [ecx + eax], edi
inc dword [edx + 4]
mov eax, dword [edx + 8]
cmp dword [edx + 4], eax
jbe 0x101de371
cmp eax, 0x3ffffffe
jg 0x101de371
lea edx, [eax + eax]
mov ecx, esi
call fcn.101de110
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov al, byte [edi + 5]
movzx edx, byte [ecx + 0x14]
not edx
movzx ecx, al
and edx, ecx
test dl, 3
je 0x101de371
xor al, 3
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101eb050
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
lea ebx, [edi + 0x58c]
push 0x4000
push ebx
call fcn.101f2cd0
mov eax, dword [edi + 0x120]
add esp, 0x10
test eax, eax
je 0x101eb0a1
cmp byte [edi + 0x85bc], 0
jne 0x101eb0a1
push ebx
push 0x100aa300
push 0x100
push eax
call fcn.101f2be0
add esp, 0x10
mov byte [edi + 0x85bc], 1
cmp byte [edi + 0x2d8], 0
je 0x101eb116
push esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x101eb0b0
sub esi, ecx
cmp esi, 0x3fff
jae 0x101eb0d1
mov byte [edi + esi + 0x58c], 0xa
inc esi
mov byte [edi + esi + 0x58c], al
mov eax, dword [edi + 0x190]
test eax, eax
je 0x101eb0ef
push dword [edi + 0x11c]
push esi
push ebx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
push dword [edi + 0x118]
push 1
push 2
push 0x1009375c
call fcn.102213e1
push dword [edi + 0x118]
push 1
push esi
push ebx
call fcn.102213e1
add esp, 0x20
pop esi
pop edi
pop ebx
ret

Function at 0x101eb0f7
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
lea ebx, [edi + 0x58c]
push 0x4000
push ebx
call fcn.101f2cd0
mov eax, dword [edi + 0x120]
add esp, 0x10
test eax, eax
je 0x101eb0a1
cmp byte [edi + 0x85bc], 0
jne 0x101eb0a1
push ebx
push 0x100aa300
push 0x100
push eax
call fcn.101f2be0
add esp, 0x10
mov byte [edi + 0x85bc], 1
cmp byte [edi + 0x2d8], 0
je 0x101eb116
push esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x101eb0b0
sub esi, ecx
cmp esi, 0x3fff
jae 0x101eb0d1
mov byte [edi + esi + 0x58c], 0xa
inc esi
mov byte [edi + esi + 0x58c], al
mov eax, dword [edi + 0x190]
test eax, eax
je 0x101eb0ef
push dword [edi + 0x11c]
push esi
push ebx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
push dword [edi + 0x118]
push 1
push 2
push 0x1009375c
call fcn.102213e1
push dword [edi + 0x118]
push 1
push esi
push ebx
call fcn.102213e1
add esp, 0x20
pop esi
pop edi
pop ebx
ret

Function at 0x101eb1c6
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x100b80c0]
xor eax, esp
mov dword [esp + 0x804], eax
push edi
mov edi, dword [esp + 0x810]
test edi, edi
je 0x101eb1e9
cmp byte [edi + 0x2d8], 0
je 0x101eb1e9
push esi
lea eax, [esp + 0x81c]
push eax
push dword [esp + 0x81c]
lea eax, [esp + 0x10]
push 0x801
push eax
call fcn.101f2cd0
lea esi, [esp + 0x18]
add esp, 0x10
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x101eb180
mov eax, dword [edi + 0x190]
sub esi, ecx
test eax, eax
je 0x101eb1be
push dword [edi + 0x11c]
lea ecx, [esp + 0xc]
push esi
push ecx
push 0
push edi
call eax
add esp, 0x14
pop esi
pop edi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.10214eee
add esp, 0x808
ret
push dword [edi + 0x118]
push 1
push 2
push 0x1009375c
call fcn.102213e1
push dword [edi + 0x118]
lea eax, [esp + 0x1c]
push 1
push esi
push eax
call fcn.102213e1
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.10214eee
add esp, 0x808
ret
Function at 0x1021336c
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x1009214d
call fcn.10215fbd
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x10213496
cmp byte [edi + 0x3d], bl
je 0x10213496
mov eax, dword [edi]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.10215f5d
mov ecx, edi
call esi
cmp eax, 0xffffffff
jne 0x102133af
xor al, al
jmp 0x10213498
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.101c5bd0
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x102133e4
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x102133ee
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call fcn.10215f5d
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x1021341d
sub eax, 1
jne 0x1021347b
mov edi, dword [ebp - 0x30]
jmp 0x10213423
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3d], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x10213433
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x1021345d
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x10213444
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.102213e1
add esp, 0x10
cmp esi, eax
jne 0x10213486
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3d], 0
je 0x10213484
test esi, esi
jne 0x102133d6
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.101c5d10
jmp 0x102133d0
dec eax
sub eax, 1
jne 0x1021348a
inc eax
jmp 0x10213488
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.101be580
mov al, bl
jmp 0x10213498
mov al, 1
call fcn.10215f78
ret

Function at 0x102346cd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1023454a

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x28b417d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x53260b5c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x47b760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x52000]
push edi
or ebp, 0xffffffff
jmp 0x47b782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47b789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47b778
mov eax, 1
add ebx, ebx
jne 0x47b79b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47b7ac
jne 0x47b7bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47b7bc
dec eax
add ebx, ebx
jne 0x47b7b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47b790
xor ecx, ecx
sub eax, 3
jb 0x47b7d4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47b846
sar eax, 1
mov ebp, eax
jmp 0x47b7df
add ebx, ebx
jne 0x47b7df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x47b7ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x47b810
inc ecx
add ebx, ebx
jne 0x47b7fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47b7f1
jne 0x47b80d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47b7f1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47b830
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47b821
jmp 0x47b77e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47b830
add edi, ecx
jmp 0x47b77e
pop esi
mov edi, esi
mov ecx, 0x191
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47b84e
cmp byte [edi], 5
jne 0x47b84e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x47b853
lea edi, [esi + 0x79000]
mov eax, dword [edi]
or eax, eax
je 0x47b8c2
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7cc9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7cda0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47b880
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7cda4]
or eax, eax
je 0x47b8bc
mov dword [ebx], eax
add ebx, 4
jmp 0x47b89d
call dword [esi + 0x7cda8]
popal
jmp 0x407c61
Function at 0x402680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor ebx, ebx
cmp eax, ebx
je 0x402c87
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.0040248e
stosd dword es:[edi], eax
adc eax, 0xb70feb9d
inc edi
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0040248e
invalid

Function at 0x4028b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040249e
push eax
push esi
push dword [ebp + 8]
call fcn.00402453
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040248e
sub dword [ecx + 0x71], edx
ror dword [eax - 0x8363], cl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi

Function at 0x4029b0
Capabilities:
Inspect section memory permissions

Disassembly:
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.004023ff
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x4029fe
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.004023ff
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x4029cb
call fcn.0040248e
mov ds, word [esi]
test ah, bl
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x402c7d
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x402a33
cmp dword [eax + 0xc], ebx
je 0x402ad6
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0040248e
sbb eax, 0x39fc8983
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
call fcn.0040248e
pop ds
invalid
Function at 0x402b40
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x402b42
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x402b3d
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x402b27
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x402b2f
cmp edx, ebx
jne 0x402c7d
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x402afe
add eax, dword [eax + 4]
jmp 0x402aeb
mov dword [ebp + 0xc], ebx
jmp 0x402b4d
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402b65
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x402b83
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x402be1
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x402bc8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x402bd1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x402bdb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402bbd
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x402b47
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x402c2e
dec eax
je 0x402c25
sub eax, 3
je 0x402c1c
mov dword [ebp - 4], 0x40
jmp 0x402c4b
mov dword [ebp - 4], 4
jmp 0x402c31
mov dword [ebp - 4], 0x20
jmp 0x402c31
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402c7d
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x402bfd
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040248e
adc ch, dl
outsb dx, byte [esi]
mov ebp, 0x6a1475ff
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x402c89
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a9f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x41f5a8]
push ebx
push ebp
push esi
test eax, eax
push edi
je 0x40ab11
mov ecx, dword [0x41f5ac]
test ecx, ecx
je 0x40ab11
mov edi, dword [0x4130dc]
xor ebx, ebx
test edi, edi
jle 0x40aa97
xor ecx, ecx
mov edx, dword [ecx + eax + 4]
mov esi, dword [ecx + eax]
mov ebp, edx
shr ebp, 0x1d
je 0x40aa8f
mov edi, dword [ecx + eax + 8]
lea eax, [ecx + eax + 8]
xor edi, esi
mov dword [eax], edi
mov esi, dword [eax + 4]
xor esi, edx
mov dword [eax + 4], esi
mov eax, dword [0x41f5a8]
mov ebp, dword [0x425010]
mov edi, dword [0x425014]
mov edx, dword [eax + ecx]
mov esi, dword [eax + ecx + 4]
add eax, ecx
and edx, ebp
or edx, 0x10000
and esi, edi
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [0x41f5a8]
add eax, ecx
mov edx, dword [eax]
mov edi, dword [eax + 8]
xor edi, edx
mov dword [eax + 8], edi
mov edx, dword [eax + 4]
mov esi, dword [eax + 0xc]
xor esi, edx
mov dword [eax + 0xc], esi
mov eax, dword [0x41f5a8]
mov edi, dword [0x4130dc]
inc ebx
add ecx, 0x10
cmp ebx, edi
jl 0x40aa1d
lea eax, [edi + edi]
xor edx, edx
test eax, eax
jle 0x40ab11
xor ecx, ecx
mov eax, dword [0x41f5ac]
add eax, ecx
mov esi, dword [eax]
mov ebp, dword [eax + 8]
xor ebp, esi
mov dword [eax + 8], ebp
mov esi, dword [eax + 4]
mov ebx, dword [eax + 0xc]
xor ebx, esi
mov dword [eax + 0xc], ebx
mov eax, dword [0x41f5ac]
mov edi, dword [0x425010]
mov ebp, dword [0x425014]
mov esi, dword [eax + ecx]
add eax, ecx
and esi, edi
mov edi, dword [eax + 4]
or esi, 0x10000
and edi, ebp
mov dword [eax], esi
mov dword [eax + 4], edi
mov eax, dword [0x41f5ac]
add eax, ecx
add ecx, 0x10
mov esi, dword [eax]
mov edi, dword [eax + 8]
xor edi, esi
mov dword [eax + 8], edi
mov esi, dword [eax + 4]
mov ebp, dword [eax + 0xc]
xor ebp, esi
inc edx
mov dword [eax + 0xc], ebp
mov eax, dword [0x4130dc]
add eax, eax
cmp edx, eax
jl 0x40aaa2
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40b2e0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x200
push ebx
push ebp
push esi
push edi
push 0xa
push 0x41a274
mov byte [eax], 0
call fcn.0040be80
add esp, 8
test eax, eax
jne 0x40b4bf
mov eax, dword [esp + 0x214]
test eax, eax
jne 0x40b3f4
call fcn.0040a8d0
test eax, eax
je 0x40b3d1
mov ebx, 4
mov edx, dword [0x418738]
lea ecx, [esp + 0x10]
push 0x200
push ecx
push edx
call fcn.00411436
add esp, 4
push eax
call fcn.0041143e
mov edx, eax
add esp, 0xc
test edx, edx
jge 0x40b35b
cmp dword [0x4649f0], ebx
je 0x40b329
test edx, edx
jne 0x40b380
mov eax, dword [0x418738]
cmp eax, 0x417080
je 0x40b372
push eax
call fcn.0040c645
add esp, 4
mov dword [0x418738], 0x417080
xor ebx, ebx
jmp 0x40b3be
jge 0x40b389
push 1
call fcn.0040bd6c
mov edi, 0x41a274
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
mov ecx, edx
add eax, 0x41a274
mov ebx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + edx], 0
push 0xa
push 0x41a274
call fcn.0040be80
add esp, 8
test eax, eax
jne 0x40b3de
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x200
ret
test bl, bl
jne 0x40b4bf
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x200
ret
push 0xa
push 0x41a274
call fcn.0040be80
add esp, 8
test eax, eax
jne 0x40b4bf
mov ebx, 4
mov ecx, dword [0x418738]
lea eax, [esp + 0x10]
push 0x200
push eax
push ecx
call fcn.00411436
add esp, 4
push eax
call fcn.0041143e
mov edx, eax
add esp, 0xc
test edx, edx
jge 0x40b442
cmp dword [0x4649f0], ebx
je 0x40b410
test edx, edx
je 0x40b48b
jl 0x40b4b8
mov edi, 0x41a274
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0xa
mov eax, ecx
mov ecx, edx
add eax, 0x41a274
mov ebp, ecx
mov edi, eax
push 0x41a274
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + edx], 0
call fcn.0040be80
add esp, 8
test eax, eax
jne 0x40b4bf
jmp 0x40b410
mov eax, dword [0x418738]
cmp eax, 0x417080
je 0x40b4a0
push eax
call fcn.0040c645
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x418738], 0x417080
or eax, 0xffffffff
pop ebx
add esp, 0x200
ret
push 1
call fcn.0040bd6c
push 0xa
push 0x41a274
call fcn.0040be80
mov ebx, eax
push 0xd
push 0x41a274
mov byte [ebx], 0
call fcn.0040be80
add esp, 0x10
test eax, eax
je 0x40b4e6
mov byte [eax], 0x20
mov edi, 0x41a274
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebx + 1]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 0x41a274
call fcn.0040c310
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret