joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008095a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100d729c
call fcn.100cece0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10080ade
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10080ade
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
call fcn.10038065
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.10038065
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [esi + 2], al
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.10038065
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10038065
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.10038065
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.10038065
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.10038065
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.10038065
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.100034b3
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10080f88
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d731b
call fcn.100cece0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100851fe
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100d78af
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001da4
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10085281
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100c1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x100c1fcb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x100c200c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x100c1ff1
mov ecx, ebx
call fcn.100c1c50
add ebx, 0x28
dec ebp
jne 0x100c1fe5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x100c2007
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100c1b20
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.100c20b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x20]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x1c]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
push ebp
call fcn.10038065
mov ebx, eax
cmp ebx, edi
je 0x100c2084
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.100c20e0
cmp ebx, edi
jle 0x100c207f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x100c2084
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x100c2096
cmp dword [esi + 0x40], edi
jne 0x100c2096
cmp dword [esi + 0x3c], edi
jne 0x100c2096
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x401800
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x401d28
call fcn.00401b48
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x402364
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x401628
cmp eax, esi
jne 0x40161b
xor esi, esi
inc esi
mov edi, esi
jmp 0x40162b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4015ff
xor esi, esi
inc esi
cmp dword [0x402368], esi
jne 0x40163d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401677
cmp dword [0x402368], ebx
jne 0x401671
mov dword [0x402368], esi
push 0x4010c4
push 0x4010b8
call fcn.0040175c
pop ecx
pop ecx
test eax, eax
je 0x401677
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40174c
mov dword [0x402014], esi
cmp dword [0x402368], esi
jne 0x40169a
push 0x4010b4
push 0x4010ac
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x402368], 2
test edi, edi
jne 0x4016a7
xor eax, eax
mov ecx, 0x402364
xchg dword [ecx], eax
cmp dword [0x40236c], 0
je 0x4016d3
push 0x40236c
call fcn.004019a0
pop ecx
test eax, eax
je 0x4016d3
push ebx
push 2
push ebx
mov esi, dword [0x40236c]
mov ecx, esi
call dword [0x4030a0]
call esi
push dword [0x402020]
push dword [0x40201c]
push dword [0x402018]
call fcn.00401525
add esp, 0xc
mov dword [0x402010], eax
cmp dword [0x402028], 0
jne 0x401731
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x402014], 0
jne 0x401745
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x402010]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call 0x40bf53
jmp 0x4015e3

Function at 0x401884
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x401d48
call fcn.00401b48
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4018e4
cmp eax, 0xffffffff
je 0x4018e4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4018dd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4018dd
cmp edx, 0x10000000
jae 0x4018dd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4018da
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401950
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40198e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x401986
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x401990
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x401976
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401a60
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x401a91
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401a91
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x401a91
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100024f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063c15
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
push dword [esi + 0xc]
mov ecx, dword [0x10099dfc]
lea eax, [ebp - 0x14]
push eax
call fcn.1002f010
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_bool___thiscall_ScCore::String::operator_class_ScCore::String_const__const]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
test bl, bl
je 0x1000261b
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
push 0
push 1
mov esi, dword [edi]
push 0
push eax
push eax
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x10070958]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
je 0x10002605
push 0
push dword [esi + 0x14]
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_char_const___class_ScCore::Encoder_const__]
push 0x2c
mov dword [ebp - 4], 1
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x100025e4
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc]
mov ecx, eax
push dword [esi + 4]
call fcn.1002f010
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
xor esi, esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov ecx, dword [0x10099dfc]
add eax, 0xc
push eax
call fcn.1002f010
mov ecx, dword [esi]
push eax
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x10070958]
mov ecx, dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004300
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006408f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x100043cc
je 0x100043c7
cmp eax, 0x80000000
je 0x100043c7
test eax, eax
jne 0x100043d3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
mov eax, dword [0x10099e0c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000437e
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.1002f010
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setString_unsigned_short_int_const__]
mov eax, dword [0x10099e0c]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x100043ac
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100043ef
xorps xmm0, xmm0
jmp 0x100043ea
cmp eax, 0x40000000
je 0x100043df
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100043e6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002f010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1002f01f
pop dword [ebp - 8]
mov eax, 0x1002f01f
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xd2dae291
add dword [ebp - 0x18], 0x7b7762ba
mov dword [ebp - 0x14], 0x88f71143
sub dword [ebp - 0x14], 0x56c3c4fe
mov dword [ebp - 0x10], 0xee095e36
add dword [ebp - 0x10], 0x5e42e5f8
mov dword [ebp - 0xc], 0x9f3ea2dd
sub dword [ebp - 0xc], 0x9f3ea2dd
lea eax, [ebp - 0x18]
push eax
mov eax, 0x19d2987a
sub eax, 0x9cb9876
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xe396e153
sub dword [ebp - 0x18], 0x6f2477fd
mov dword [ebp - 0x14], 0x429fbc95
sub dword [ebp - 0x14], 0x1335b20
mov dword [ebp - 0x10], 0xa2dfd207
sub dword [ebp - 0x10], 0x3f70659b
mov dword [ebp - 0xc], 0xdb258b73
add dword [ebp - 0xc], 0x24da748d
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x74ee0848
sub eax, 0x64e70840
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x43dbf
push 0
call eax
mov ecx, 0x3da2
xor esi, esi
add esi, eax
mov edi, 0x70a6a120
sub edi, 0x609c0320
add edi, dword [ebp - 8]
mov ebx, 0x778193b4
sub ebx, 0x2dec01c
xor dword [ebp - 4], 0xda795c67
mov edx, dword [edi]
sub edx, ebx
sub dword [ebp - 4], esi
mov dword [esi], edx
xor dword [ebp - 4], 0x4e8f01c
add esi, 0x21641374
add esi, 0xde9bec90
add edi, 4
loop 0x1002f138
add eax, 0xe95b
xor ebx, ebx
add ebx, eax
add eax, 0x89c5e9f2
add eax, 0x763a1613
mov ecx, 0x4dce9a5b
sub ecx, 0x3dce9a5b
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0xaed440
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00a15880
xor eax, eax
push ebp
push 0xaed58e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.00aed260
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00a15890
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0xaed56d
xor eax, eax
push ebp
push 0xaed566
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0xaed54f
xor eax, eax
push ebp
push 0xaed548
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0xaed531
xor eax, eax
push ebp
push 0xaed52a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.00aed298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xaed531
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xaed54f
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xaed56d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.00aed31c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xaed595
lea eax, [ebp - 4]
call fcn.00a153f0
ret
Function at 0xb410b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb410b9
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xb41596
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
lea eax, [ebp - 4]
call fcn.00a153f0
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb10c74]
call fcn.00b12c00
mov dword [ebp - 0x20], eax
xor ecx, ecx
push ebp
push 0xb41569
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b12cec
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb410ac
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb41090
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb41094
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
movzx edx, byte [0xb415a8]
call fcn.00b120a8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.00af0c80
test al, al
je 0xb41191
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b12554
jmp 0xb4119f
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b125d4
mov eax, dword [ebp - 0xc]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b12654
xor eax, eax
push ebp
push 0xb41206
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b12514
jmp 0xb411ee
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0xba9da8]
mov eax, dword [eax]
call fcn.00a86f08
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb411fc
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb411cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb41210
call fcn.018a6018
movzx ax, byte [ebp]
sub dl, 0xf9
and dl, 0x81
mov dl, byte [ebp + 2]
test si, 0x5a6c
lea ebp, [ebp - 2]
not al
stc
cmp cl, bl
not dl
and al, dl
not dx
jmp 0x18b3b23
Function at 0x29a010c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x29a010d6
pop dword [ebp - 0x18]
mov eax, 0xdce1163d
sub eax, 0xb3410567
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xce6bbed
add dword [ebp - 0x28], 0x416b895e
mov dword [ebp - 0x24], 0x9f77c521
add dword [ebp - 0x24], 0x92bb8724
mov dword [ebp - 0x20], 0x67e2662c
sub dword [ebp - 0x20], 0x1b9621fe
mov dword [ebp - 0x1c], 0xa942e8ad
sub dword [ebp - 0x1c], 0xa942e8ad
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x583cf8e1
sub dword [ebp - 0x28], 0xe3ca8f8b
mov dword [ebp - 0x24], 0xf06c2329
add dword [ebp - 0x24], 0x51003e4c
mov dword [ebp - 0x20], 0xeef4f2b
add dword [ebp - 0x20], 0x54801d41
mov dword [ebp - 0x1c], 0xce1600e3
add dword [ebp - 0x1c], 0x31e9ff1d
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x367cf
push 0
call eax
mov ecx, 0x4acc690a
add ecx, 0xb533cfc3
xor edi, edi
add edi, eax
mov edx, 0x29a22000
add edx, dword [ebp - 0x18]
mov esi, 0x83860eb0
add esi, 0x3fbc6e65
add dword [ebp - 4], esi
mov ebx, dword [edx]
xor dword [ebp - 0x14], 0xbfb5194a
sub ebx, esi
add dword [ebp - 0x10], ecx
mov dword [edi], ebx
sub dword [ebp - 4], eax
add edi, 4
add edx, 0x414fef90
add edx, 0xbeb01074
loop 0x29a011ea
add eax, 0xd607
xor ebx, ebx
add ebx, eax
add eax, 0xf963b577
add eax, 0x69c4a8e
mov ecx, 0xbb37d260
sub ecx, 0x9197d260
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40a0d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov dword [esp + 4], 0x485b1c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x40a1cc
lea eax, [ebp - 0x84]
mov dword [esp], eax
call fcn.00418f20
mov dword [esp], 0xc800
call fcn.00475fd0
mov ebx, eax
jmp 0x40a136
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
lea eax, [ebp - 0x84]
mov dword [esp], eax
call fcn.00419744
mov edi, ebx
mov ecx, 0xc800
xor eax, eax
rep stosb byte es:[edi], al
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xc800
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fread
test eax, eax
jg 0x40a120
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [ebp - 0x2a], 0
lea edi, [ebp - 0x26]
mov ecx, 0xc
xor eax, eax
rep stosb byte es:[edi], al
lea eax, [ebp - 0x84]
mov dword [esp + 4], eax
lea esi, [ebp - 0x2a]
mov dword [esp], esi
call fcn.004196c4
test ebx, ebx
je 0x40a19d
mov dword [esp], ebx
call fcn.00475fac
lea eax, [ebp - 0x1a]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00450b40
mov eax, dword [ebp + 8]
add esp, 0x8c
pop ebx
pop esi
pop edi
leave
ret 4
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x485b1f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00450af4
mov eax, dword [ebp + 8]
add esp, 0x8c
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x413454
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41348b
cmp dword [eax + 0x10], ebx
jne 0x4134a5
mov edx, dword [eax + 0x28]
test edx, edx
je 0x413494
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x4134a0
mov dword [ecx + 0x28], edx
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 4]
mov al, 1
add esp, 0x14
pop ebx
leave
ret
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x1c], ecx
test ecx, ecx
jne 0x41347e
nop
mov dword [ebx + 0x18], edx
jmp 0x413481
mov dword [esp + 8], 0x153
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], 0x4864c2
call sub.msvcrt.dll__assert
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x413505
xor ebx, ebx
nop
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.
call sub.msvcrt.dll_fwrite
inc ebx
cmp edi, ebx
jg 0x4134e0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x20]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], str.__s_
mov dword [ebp + 8], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp sub.msvcrt.dll_fprintf