joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1546df7
Capabilities:
Encode data using xor

Disassembly:
inc edi
mov cl, byte [edx + ecx - 0xf9]
movsx ebp, dx
inc cx
rol edi, 0x46
inc ebp
or dh, cl
dec edx
mov dword [esp - 0xfb], eax
inc esp
movzx ecx, dx
cdq
inc dword [edi + ecx - 0x49]
retf 0x4599
inc ebp
xor dh, bh
inc ebp
movzx eax, sp
dec ebp
xadd eax, edi
inc cx
mov ebp, esi
inc esi
movzx esi, word [esp + edi*4 - 0x3e2]
cwd
dec edx
sub dword [esp + edi - 0xf3], 0xc3142687
inc ax
movzx ebp, ch
cdq
call fcn.01526f56
lea edx, [eax]
mov ch, 0x98
inc ebx
test ah, 0x39
dec edi
dec edx
xor dword [edi - 0x70], 0xfffffff5
arpl word [edx - 0x7d], cx
ja 0x1546e17
mov ecx, 0x77834a57
mov bl, dl
je 0x1546ec6
sbb ebp, dword [ebp - 0x79]
test eax, 0x874727fb
xlatb
wait
test byte [ebx], ch
adc eax, dword [esi - 0x7d]
les eax, [edi + 0x4474da64]
movsd dword es:[edi], dword [esi]
test ecx, ebx
push esp
sbb esi, eax
jne 0x1546e11
les eax, [ecx - 0x63]
cli
scasb al, byte es:[edi]
inc ebx
fcmovnu st(0), st(4)
mov ch, 0xb9
add eax, 0x69b60af3
aaa
div dword [ebp - 0x3c]
sub dh, dl
adc dword [0x77c4407], eax
lds ebx, [edi + 0x3f]
in al, dx
movsd dword es:[edi], dword [esi]
rcl byte [ecx + 0x56c1ac3e]
xchg ebx, eax
push 0x5420511c
push esi
salc
fiadd dword [ebx - 0x1a8fd8e9]
fnstcw word [ebp - 0x1f]
jl 0x1546f26
cmpsb byte [esi], byte es:[edi]
adc al, 0xe3
mov esp, 0xd0ea80f2
mov esi, 0x1cb0a53e
mov al, 0x1c
sar dword [ebx - 0xb], cl
add bh, byte [ebp + 0x2d]
iretd
call 0x266fc7fd
in eax, 0x78
and ecx, ebx
xor dword [esi - 0x4c], edx
ljmp 0x91e7

Function at 0x154e068
Capabilities:
Authenticate hmac

Disassembly:
dec esi
mov ebp, dword [esp + 0xf]
inc cx
xchg esp, esi
call fcn.0150ad7f
push 0x5d90b029
push 0x3f862316
sub edi, 2
neg word [esp + 4]
movzx edx, word [edi]
jno 0xcea147
Function at 0x1556b27
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp + ecx - 0x4b8413d0], edx
push ecx
mov ecx, dword [ecx + edi - 0x4b8413d0]
mov edx, 0x1b3a8b0c
dec edx
mov eax, 0x3c1e729e
xor ecx, ebx
not ecx
bts dx, 0x86
sal dl, 0xe1
mov dword [esp + edx - 0x1b3a8b92], 0x9c0019bb
bswap ecx
not eax
dec ecx
ror dl, 0x44
bswap edx
bts dx, dx
ror ecx, 1
cwde
xor ebx, ecx
shl byte [esp + edx - 0x698b3a17], 0xc2
adc esi, ecx
and dword [esp + edx - 0x698b3a19], edx
neg word [esp + edx - 0x698b3a1b]
mov ecx, dword [edx + edi - 0x698b3a23]
not dl
cbw
lea eax, [edx + eax + 0x2e291c95]
lea edi, [edi + edx - 0x698b3aec]
and dword [esp + edx - 0x698b3ae2], eax
sar ax, 0x8e
sar ax, 0x4d
xor ecx, ebx
shl edx, 0x6c
sal edx, 0x38
or byte [esp + edx + 3], dl
lea ecx, [ecx + edx*2 - 0x22b30caa]
bts eax, 0xa4
sub edx, dword [esp + edx*2 + 4]
mul dword [esp + edx - 0x63fffe80]
dec esp
fisttp qword [edi]
mov edx, 0x542ba4e8
push esp
add al, 0xf7
movsb byte es:[edi], byte [esi]
adc al, 0x80
add dword [eax], eax
pushfd
neg ecx
call fcn.00cc9fe2
test al, 0xb5
add al, 0x76
mov ebp, 0xf3dfd38a
scasb al, byte es:[edi]
mov ch, dl
xchg edx, eax
lahf
repe scasb al, byte es:[edi]
mov bh, byte [ebx - 0x510cc8f6]
mov bh, byte [edx + 2]
outsd dx, dword [esi]
repe scasb al, byte es:[edi]
mov ah, byte [ebx + 0x5a]
mov bh, 0xf3
scasb al, byte es:[edi]
mov bl, byte [edx + 0x7b]
pop es
repe scasb al, byte es:[edi]
mov cl, byte [edx - 0x510c802e]
mov ah, byte [ebx]
add bh, byte [edi - 0x2c75510d]
movsd dword es:[edi], dword [esi]
cwde
pop edi
cdq
sub eax, 0x4e6fa306
inc esi
xor ebx, ebp
mov ch, 0xd6
shr edx, 0xa
imul ecx, edi, 0x461228ec
jl 0x1556bbc
lodsb al, byte [esi]
push esp
dec ecx
xor byte [ebx + 0x5304bd50], dh
je 0x1556cad
mov edx, 0xa9177e75
pop esi
in eax, 0x7e
pop ss
test eax, 0x7e9d32fe
pop ss
test eax, 0x7e056a76
pop ss
test eax, 0x7e75c24e
pop ss
test eax, 0x7ec57af2
pop ss
jp 0x1556c14
jle 0x1556c68
test eax, 0x7e053aba
pop ss
test eax, 0x9d02a112
pushfd
cwde
test dword [esi - 0x70], esp
add al, 0x32
wait
xchg edi, eax
xchg ecx, eax
dec eax
xor esi, dword [edx]
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
xchg ecx, eax
dec eax
xor eax, dword [ebx + 0x4891f73b]
xor bl, byte [ebx + 0x33489197]
xor ch, byte [edx + 0x334891a7]
cmp dword [ebx], 0xfffffff7
xchg ecx, eax
dec eax
xor ecx, ebx
mov ebx, 0x334891e7
or dl, byte [edx]
mov edi, 0xfb334891
or byte [edi - 0x6f], 0x48
xor eax, edx
loop 0x1556ca8
xchg ecx, eax
dec eax
xor eax, dword [ebx + 0x62]
fist word [ecx - 0x3a4cccb8]
clc
cmp eax, 0xc166947f
mov edi, esi
push ecx
cmp ecx, dword [esi + ecx*4]
jae 0x23fbda95
jo 0x1556c62
mov ecx, 0x443f56e4
in al, 0x56
aas
inc esp
push esp
dec ecx
xor byte [ebx - 0x48], bl
push ebp
add al, 0x53
je 0x1556c4d
bound esi, qword [ebp - 0x6156e882]
and bh, ch
jle 0x1556cd8
test eax, 0x7e3df22a
pop ss
test eax, 0x7e9d9a26
pop ss
test eax, 0x7ec59a6e
pop ss
test eax, 0x7e75ca42
pop ss
test eax, 0x7ec5fa32
pop ss
test eax, 0x9d02198e
pushfd
xchg ecx, eax
mov al, 0x53
test byte [ebx - 0x42], al
jb 0x1556d34
push eax
hlt
daa
jmp 0x24205e22
Function at 0x1557361
Capabilities:
Encode data using xor

Disassembly:
neg word [esp + ecx - 0x2003fe06]
shl dx, cl
xor ebx, eax
shr edx, 0xed
add esi, eax
sal cx, 0x45
pop ecx
jb fcn.01508028
inc bp
mov dword [edx + esi*4 - 0x2b2be], esp
movzx esi, byte [edi + esi - 0xacb1]
dec eax
shl dword [esp + ebp*8 + 0x6b0504e0], cl
inc ecx
pop esp
inc ecx
xor dh, ch
not ebp
ror dl, 0xe2
call fcn.0154be96
call fcn.00d0cd1e
adc dword [ecx], 0xd20bc118
invalid
inc ecx
jmp ebx
dec eax
mov dword [esp + ebx - 0xfd6a210], 0x2f0d7134
inc edx
xchg dword [esp + esi - 0x451e0c7e], ebx
inc ecx
xor edx, ebp
dec edi
lea ecx, [esi + ecx*8 + 0x66287326]
dec eax
dec ebx
not edx
dec edx
lea ebp, [ecx*8 - 0x4f63a5f7]
inc esi
movsx eax, byte [esp + esi - 0x451e0c81]
dec edx
inc sp
xadd ebx, esp
dec ebp
adc esp, esp
not edx
inc sp
xadd dword [esp + ebx*8 - 0x63a4d], ecx
xor edx, 0x9597083a
dec esp
imul esp, dword [esp + ebx*2 - 0x18e94]
inc ecx
and bl, al
dec esp
xchg ebp, eax
bswap edx
dec esi
mov dword [esp + esi - 0x451e0c81], ebp
dec ebp
inc ecx
sal eax, 0x3b
inc edx
xor dword [esp + esi - 0x451e0c81], edx
inc ecx
bt esp, 0x24
inc ecx
bts ecx, 0x88
mov esi, 0x634a220
inc ecx
pop ebp
inc cx
inc ecx
dec eax
arpl dx, dx
dec eax
bt ebx, 0xae
inc ecx
neg dh
dec esp
add ebx, edx
dec eax
lea eax, [esi*2 + 0x1f18e98e]
dec eax
lea edx, [ebx*2 + 0x608cea9c]
inc bx
mov edx, dword [esi + edx - 0x451e0c7f]
dec ecx
rol eax, 0xc3
inc ecx
shr ah, 0xa5
inc bp
mov esp, dword [edx + ebx - 0xc6fe]
add ax, bp
dec edi
lea edx, [edx + esi - 0x451e0c7d]
inc cx
adc edx, esp
and ebx, 0x30148116
inc ecx
mov ecx, esi
dec eax
lea esi, [ebp*2 - 0x7845834d]
inc bx
mov dword [esi + edx - 0x451e0c7f], edx
jne 0x15222c5
not edx
not eax
neg eax
dec dl
neg ecx
not eax
bswap eax
xor eax, 0xdfa663b7
ror dword [esp + ecx], 0x17
xchg dword [esp + ecx], ecx
sub byte [esp + ecx - 0x2003fe08], dl
dec eax
jmp 0x14f1ddc

Function at 0x1559a33
Capabilities:
Authenticate hmac

Disassembly:
ror al, cl
sub al, cl
not ecx
xor al, 0x23
ror cl, 0xa4
sar word [esp], cl
sbb word [esp + 1], 0xd010
xor bl, al
lea eax, [esp + eax + 8]
btr cx, cx
add dword [esp], ecx
mov word [eax], dx
pop edx
pop edx
jg fcn.01508028
movzx edx, cx
mov dword [ebp + ecx - 0x11b084], eax
mov dx, word [ecx + ebp - 0x11b084]
lea ebp, [ebp + ecx*2 - 0x236102]
and dword [esp + ecx - 0x11b080], 0xdb8e121a
movzx eax, byte [edi + ecx - 0x11b086]
lea edi, [edi + ecx*8 - 0x8d8406]
shr cx, 0xc9
xor al, bl
push ecx
lea ecx, [ecx*4 + 0x42ad221b]
shr word [esp + ecx - 0x42f12378], 0xca
neg al
dec dword [esp + ecx - 0x42f12377]
and ecx, 0xa1b7c901
jg 0xc9bddd
salc
dec ebp
inc esi
inc edx
push ecx
sbb eax, dword [ebx]
cmpsb byte [esi], byte es:[edi]
jecxz 0x15327e4
xor eax, dword [ebx - 0x7b]
fisub word [esi - 0x3f]
ljmp 0xca2b
not eax
rol dl, 1
shl eax, 0xe7
mov dword [esp + eax*2 - 0x236100], eax
adc al, 0x35
sbb dl, 6
rol dl, 1
xor dl, 0x11
ror dl, 1
ror cx, 0xe7
cwde
xor bl, dl
pop ecx
lea edx, [esp + edx + 4]
mov eax, dword [ecx + edx - 0x11b080]
jmp 0x1532763
Function at 0xca6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ca61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xca607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca606a
add dl, dl
jne 0xca6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca60dc
xor eax, eax
add dl, dl
jne 0xca6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca617d
add dl, dl
jne 0xca60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xca60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xca6075
mov eax, 1
add dl, dl
jne 0xca60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca60e1
sub eax, ebx
mov ebx, 1
jne 0xca6128
mov ecx, 1
add dl, dl
jne 0xca610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xca6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xca613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xca614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca6136
cmp eax, 0x7d00
jae 0xca616d
cmp eax, 0x500
jb 0xca6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca6075
cmp eax, 0x7f
ja 0xca6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xca619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xca6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402b4e
Capabilities:
Check for time delay via queryperformancecounter
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
push 0x40bac0
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
and dword [ebp - 0x14], 0
jmp 0x402ba7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
jge 0x402d34
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
mov eax, dword [0x405014]
sub eax, 4
mov dword [0x405018], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x402cc4
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp - 4], 0
jle 0x402cbf
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
push 4
push 0x1000
push dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call fcn.004019cb
add esp, 0xc
jmp 0x402b97
push 0x40bac0
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
push 4
push 0x1000
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0xc], eax
push 0x40bac0
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0xc]
call fcn.0040198d
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x405018]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x405018], eax
jmp 0x402b97
mov eax, dword [0x405018]
shl eax, 3
mov dword [0x405018], eax
leave
ret
Function at 0x4016e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4016ef
pop dword [ebp - 0x1c]
mov eax, 0x12b1c8b2
sub eax, 0x1271b1c3
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x8ca85c13
add dword [ebp - 0x2c], 0xc1a9e938
mov dword [ebp - 0x28], 0xa635a2f2
sub dword [ebp - 0x28], 0x740256ad
mov dword [ebp - 0x24], 0xdab05bd1
sub dword [ebp - 0x24], 0x8e6417a3
mov dword [ebp - 0x20], 0xc71bc983
sub dword [ebp - 0x20], 0xc71bc983
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xa36263ee
add eax, 0x5cdedca2
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x5f9a0eb8
add dword [ebp - 0x2c], 0x14d85a9e
mov dword [ebp - 0x28], 0x7c679be6
add dword [ebp - 0x28], 0xc504c58f
mov dword [ebp - 0x24], 0x5ab381d6
add dword [ebp - 0x24], 0x8bbea96
mov dword [ebp - 0x20], 0x7c32451c
add dword [ebp - 0x20], 0x83cdbae4
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x2b1b81ca
add eax, 0xd525be72
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39add
push 0
call eax
mov ecx, 0x43b2
mov edi, eax
mov ebx, 0x2362a12f
add ebx, 0xdcdf1ed1
add ebx, dword [ebp - 0x1c]
mov edx, 0x5aff2c52
add edx, 0x631948ee
add dword [ebp - 8], ebx
mov esi, dword [ebx]
add dword [ebp - 0x10], 0xdd55826d
xor esi, edx
xor dword [ebp - 0xc], ebx
mov dword [edi], esi
xor dword [ebp - 4], ecx
add edi, 0xe23cd9ab
sub edi, 0xe23cd9a7
add ebx, 0x612614eb
sub ebx, 0x612614e7
loop 0x40180b
add eax, 0xb71055ff
add eax, 0x48f0ab9c
xor ebx, ebx
add ebx, eax
add eax, 0x4664392c
sub eax, 0x46643927
mov ecx, 0x3e7a8699
sub ecx, 0x3e3a8699
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401f20
Capabilities:
Encode data using xor

Disassembly:
push 0x40291c
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x1c1bfcfe], ah
sti
test dword [edx - 0x58], 0xf1ba09b3
mov edi, 0x4410
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
cmp eax, 0x6378456d
push edi
dec eax
dec edx
inc ebx
pop edi
dec ebx
push ebx
pop eax
push esp
add byte [ebp + 0x6c], ah
pop edi
push eax
dec edx
add byte cs:[eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
or dword [edi + edx*2 + 0x6294c003], ecx
sbb al, 0x4c
and dword [edi], 0xffffffe1
mov ds, word ss:[edi]
rcr byte [ebx - 0x6df017f9], 1
jo 0x401f72
rol byte [edx - 0x77], cl
aad 0xad
jne 0x401fe9
mov dword [0x3ae5], eax
dec edi
lodsd eax, dword [esi]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and cl, byte [eax]
add byte [eax], al
cmpsb byte [esi], byte es:[edi]
add al, 0
add byte [eax], al
add eax, 0x6d726600
dec ebx
push ebx
add byte [0xb4002201], cl
shl dword [edi - 0x1c343944], 1
mov ebx, 0xb4f9bbfa
mov eax, dword [0xb5caa8a3]
shr ecx, 1
mov dword [0xd4a5b5a9], eax
stosb byte es:[edi], al
mov dl, 0xe2
retf 0xcfd4
stc
mov ah, 0xa1
mov dword [0xd1b5caa8], eax
jmp 0xa5f5c999
Function at 0x40bfd0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
mov ecx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__lseek]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40c001
push eax
mov eax, dword [esi]
push 0x452
push eax
call fcn.00431660
add esp, 0xc
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [ecx + 4]
sub eax, edi
mov edi, 0x1000
cmp eax, 0x1000
jg 0x40c01b
mov edi, eax
add ecx, 0x18
push edi
push ecx
mov ecx, dword [esi + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
cmp eax, edi
pop edi
je 0x40c04d
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll__tell]
push eax
mov eax, dword [esi]
push 0x453
push eax
call fcn.00431660
add esp, 0x10
mov esi, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
and al, 0xf7
mov dword [esi + 0x14], eax
pop esi
ret 4

Function at 0x40c5b0
Capabilities:
Get file size

Disassembly:
mov al, byte [esp + 0xc]
push ebx
push ebp
push esi
test al, al
je 0x40c71c
mov eax, dword [esp + 0x14]
test al, 3
mov ebx, eax
setne cl
shr ebx, 8
and al, 0x40
and bl, 1
neg al
sbb eax, eax
mov byte [esp + 0x18], cl
and eax, 0x4000080
add eax, 0x80
test cl, cl
je 0x40c628
xor edx, edx
mov ecx, 0x469558
cmp dword [ecx], 0
mov esi, dword [esp + 0x10]
je 0x40c606
add ecx, 4
inc edx
cmp ecx, 0x469598
jl 0x40c5ef
jmp 0x40c60d
mov dword [edx*4 + 0x469558], esi
push 0
push eax
mov al, bl
mov ecx, dword [esi]
neg al
sbb eax, eax
add eax, 3
push eax
push 0
push 0
push 0xc0000000
push ecx
jmp 0x40c63e
mov esi, dword [esp + 0x10]
push 0
push 0
push 3
mov edx, dword [esi]
push 0
push 1
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
mov ebp, dword [esp + 0x1c]
jne 0x40c6a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
mov al, byte [esp + 0x18]
test al, al
mov dword [esi + 0x10], 0
jne 0x40c703
mov eax, dword [ebp]
cmp eax, 3
je 0x40c67d
cmp eax, 2
jne 0x40c703
push 0
push 0
push 0x469534
push 0
push 0x469530
push esi
call fcn.0040c510
mov eax, dword [esi]
push eax
push 0x49d
push 0
call fcn.00431660
add esp, 0xc
test bl, bl
push edi
je 0x40c6ae
xor edi, edi
jmp 0x40c6d3
mov ecx, dword [esi + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40c6d3
mov edx, dword [esi]
push edx
push 0x450
push 0
call fcn.00431660
add esp, 0xc
mov al, byte [esp + 0x1c]
mov dword [esi + 0xc], edi
test al, al
je 0x40c6f2
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x40c6f5
cmp edi, 0x80000
jge 0x40c6f2
mov edi, 0x80000
mov dword [esi + 0x18], edi
push ebp
push 0
push esi
call fcn.0040ca30
test al, al
pop edi
jne 0x40c70c
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0x10
mov eax, dword [esi + 4]
or al, 8
mov dword [esi + 4], eax
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push eax
push 0
push 0
push ecx
call fcn.0040c740
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x40cbc0
Capabilities:
Check if file exists
Delete file
Terminate process

Disassembly:
mov al, byte [0x481160]
test al, al
je 0x40cbf3
call fcn.004516e0
mov eax, dword [0x481154]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x40cbf3
mov ecx, dword [0x481154]
push ecx
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 4
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, 0x469558
mov eax, dword [esi]
test eax, eax
je 0x40ccc3
push eax
call fcn.0040cb30
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push eax
call edi
test eax, eax
jne 0x40cc36
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
push 0x451
push eax
call fcn.00431660
add esp, 0xc
mov eax, dword [esi]
test byte [eax + 4], 2
je 0x40cc72
mov eax, dword [eax + 0x10]
push 0
push 0
push 0
push eax
call ebp
test eax, eax
jne 0x40cc5e
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40cc72
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
push 0x451
push 0
call fcn.00431660
add esp, 0xc
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40cc95
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
push 0x451
push eax
call fcn.00431660
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40ccc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40ccc3
mov edx, dword [esi]
mov eax, dword [edx]
push eax
push 0x455
push 0
call fcn.00431660
add esp, 0xc
add esi, 4
cmp esi, 0x469598
jl 0x40cc07
call fcn.0040bbb0
call fcn.004104e0
mov al, byte [0x4690c4]
pop edi
pop esi
pop ebp
test al, al
je 0x40cced
call fcn.00415270
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x410450
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
push edi
mov ecx, dword [eax + 8]
mov edi, dword [eax]
test ecx, ecx
jbe 0x4104d2
push ebp
push esi
mov ebp, dword [edi + 4]
mov eax, dword [edi]
mov esi, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41048e
test cl, cl
je 0x41048a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41048e
add eax, 2
add esi, 2
test cl, cl
jne 0x41046a
xor eax, eax
jmp 0x410493
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4104b9
push ebp
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
cmp eax, 0xffffffff
jne 0x4104b9
mov eax, dword [edi + 4]
push eax
push 0x455
push 0
call fcn.00431660
add esp, 0xc
mov edx, dword [esp + 0x14]
mov edi, dword [edi + 0x14]
inc ebx
mov eax, dword [edx + 8]
mov ecx, ebx
and ecx, 0xffff
cmp ecx, eax
jb 0x410463
pop esi
pop ebp
pop edi
pop ebx
ret 4
Function at 0x411bd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x480ec4]
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push eax
push esi
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x411bfd
push 0x4018f0
call fcn.00411b30
add esp, 4
sub word [0x480e70], si
pop esi
ret 8
Function at 0x414f70
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
jne 0x414f93
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x415025
mov al, byte [esi]
mov edi, dword [sym.imp.MSVCRT.dll_isdigit]
test al, al
je 0x414fb4
movsx ecx, al
push ecx
call edi
add esp, 4
test eax, eax
jne 0x414fb4
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x414f9f
mov ebp, dword [sym.imp.MSVCRT.dll_sscanf]
lea edx, [esp + 0x10]
push edx
push 0x401f88
push esi
call ebp
add esp, 0xc
cmp eax, 1
jne 0x415025
mov eax, dword [esp + 0x10]
mov byte [eax + 0x4811a0], 1
mov al, byte [esi]
test al, al
je 0x414ff5
movsx ecx, al
push ecx
call edi
add esp, 4
test eax, eax
je 0x414ff5
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x414fe0
mov al, byte [esi]
test al, al
je 0x415010
movsx edx, al
push edx
call edi
add esp, 4
test eax, eax
jne 0x415010
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x414ffb
lea eax, [esp + 0x10]
push eax
push 0x401f88
push esi
call ebp
add esp, 0xc
cmp eax, 1
je 0x414fcf
pop edi
pop esi
pop ebp
ret 8