joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x528890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbf000]
push edi
jmp 0x5288aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5288b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5288a0
mov eax, 1
add ebx, ebx
jne 0x5288c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5288d4
jne 0x5288f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5288f3
dec eax
add ebx, ebx
jne 0x5288e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5288b8
add ebx, ebx
jne 0x5288ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x528945
xor ecx, ecx
sub eax, 3
jb 0x52890b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52897a
sar eax, 1
mov ebp, eax
jmp 0x528916
add ebx, ebx
jne 0x528916
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5288e4
inc ecx
add ebx, ebx
jne 0x528924
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5288e4
add ebx, ebx
jne 0x528931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x528926
jne 0x528942
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x528926
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x528964
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x528956
jmp 0x5288a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x528964
add edi, ecx
jmp 0x5288a6
pop esi
mov edi, esi
mov ecx, 0x9335
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x528982
cmp byte [edi], 0x2a
jne 0x528982
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x528987
lea edi, [esi + 0x124000]
mov eax, dword [edi]
or eax, eax
je 0x5289ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12f2e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12f44c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5289b4
mov ecx, edi
jns 0x5289e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12f450]
or eax, eax
je 0x5289f9
mov dword [ebx], eax
add ebx, 4
jmp 0x5289d1
call dword [esi + 0x12f460]
mov ebp, dword [esi + 0x12f454]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x528a33
sub esp, 0xffffff80
jmp 0x4a8396
Function at 0x10001127
Capabilities:
Create thread

Disassembly:
jmp 0x100020ac
push 4
mov eax, 0x10006814
call fcn.1000111d
push 0xc
call fcn.100010cd
pop ecx
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 4], edi
test eax, eax
je 0x100020dc
push 0x14f
push 0xa
mov ecx, eax
call fcn.10001212
jmp 0x100020de
mov eax, edi
mov ebx, 0x114
mov dword [0x1000b4bc], eax
or esi, 0xffffffff
push ebx
mov dword [ebp - 4], esi
call fcn.100010cd
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x10002115
push 2
push 0x14
push 0xd2
mov ecx, eax
call fcn.1000128a
jmp 0x10002117
mov eax, edi
mov ecx, eax
mov dword [ebp - 4], esi
mov dword [0x1000b4ac], eax
call fcn.10001145
push ebx
call fcn.100010cd
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
push 3
pop ebx
test eax, eax
je 0x1000214c
push ebx
push 0x50
push 0xa
mov ecx, eax
call fcn.1000128a
jmp 0x1000214e
mov eax, edi
push 0x114
mov dword [ebp - 4], esi
mov dword [0x1000b4b0], eax
call fcn.100010cd
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x10002184
push str.Next_level:_N_A
push ebx
push 0x15e
push 0x10e
mov ecx, eax
call fcn.1000113b
jmp 0x10002186
mov eax, edi
mov ebx, 0xcc
mov dword [ebp - 4], esi
push ebx
mov dword [0x1000b4a8], eax
call fcn.100010cd
mov esi, eax
pop ecx
test esi, esi
je 0x100021ad
push ebx
push edi
push esi
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
jmp 0x100021af
mov esi, edi
push ebx
mov dword [0x1000b4b4], esi
call fcn.100010cd
mov esi, eax
pop ecx
test esi, esi
je 0x100021cf
push ebx
push edi
push esi
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
jmp 0x100021d1
mov esi, edi
push dword [0x1000b4ac]
mov ecx, esi
mov dword [0x1000b4b8], esi
call fcn.100012b7
push dword [0x1000b4b0]
mov ecx, dword [0x1000b4b8]
call fcn.100012b7
push dword [0x1000b4a8]
mov ecx, dword [0x1000b4b8]
call fcn.100012b7
call fcn.1000122b
mov eax, 0x100022c3
sub eax, 0x43d32c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push 4
push eax
push 0x43d328
call fcn.1000114f
push 1
push edi
push 0x10001136
push 0x42a880
call fcn.100011a4
add esp, 0x1c
push edi
push edi
push edi
push 0x100012bc
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1000b4a4], eax
call fcn.1000100f
ret
Function at 0x411ef0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x411f0e
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x7c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x64
jb 0x411eff
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x4123ab
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x4123c9
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x15
jb 0x4123ba
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x4123d1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x4123ef
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x4123e0
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x4123f7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x412415
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x80]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x412406
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x41241d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x41243b
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x80]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x41242c
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x412443
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x412461
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x80]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x412452
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x412469
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x412487
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x14
jb 0x412478
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x41248f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x4124ad
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x41249e
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x4124b5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x4124d3
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x4124c4
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret
Function at 0x4124db
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x4124f9
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x4124ea
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x412501
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x41251f
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7d]
xor byte [ecx], al
inc ebx
cmp ebx, 0xf
jb 0x412510
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x412527
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x412545
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7c]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x412536
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x41254d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x41256b
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7c]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x41255c
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x412573
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x412591
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x18
jb 0x412582
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x4125ab
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x4125c9
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7b]
xor byte [ecx], al
inc ebx
cmp ebx, 0x39
jb 0x4125ba
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x4125d1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x4125ef
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7b]
xor byte [ecx], al
inc ebx
cmp ebx, 0x3a
jb 0x4125e0
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret

Function at 0x4125f7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
lea edx, [esi + 0xa]
jne 0x412615
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x7a]
xor byte [ecx], al
inc ebx
cmp ebx, 0x39
jb 0x412606
pop ebx
mov byte [esi + 9], 1
mov eax, edx
pop esi
ret
Function at 0x4134ed
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x433efe
call fcn.00433c08
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
call fcn.00417e8e
mov esi, eax
push 1
mov dword [ebp - 4], ebx
call fcn.0041601d
pop ecx
pop ecx
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00413736
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x414aac
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x414af4
lea edx, [esi + 8]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x414abc
jmp 0x414b01
cmp dword [esi], 0x4e0
jb 0x414b01
call fcn.00414b3b
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret

Function at 0x414b3b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x414b4e
lea edi, [esi + 0xd50]
mov ebp, 0x18c
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x414b95
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [esi], ebp
and eax, 0x9908b0df
shr ecx, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x415ce3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x415d04
jl 0x415cfb
test edi, edi
jne 0x415d04
xor eax, eax
xor edx, edx
jmp 0x415dc5
cmp dword [ebx + 0x38], 0
je 0x415d19
push eax
push edi
push dword [ebp + 8]
call fcn.00412116
jmp 0x415dc5
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x415d60
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x415d60
cmp eax, edi
jb 0x415d3a
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00419490
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x415d66
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x415dba
mov ecx, ebx
call fcn.0041564e
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x415da5
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0041fa81
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x415dba
jmp 0x415d78
test edx, edx
je 0x415dba
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0041fa81
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x418ac6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x418b05
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x418b05
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x418b05
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x418b05
cmp dword [ecx + 0x74], 0xe
jbe 0x418b05
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x426a31
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438fd0
push 0x438fc8
push str.FlsAlloc
push 0x1f
call fcn.004268f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x426a65
push dword [ebp + 8]
mov ecx, esi
call dword [0x43512c]
call esi
jmp 0x426a6b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x426aaf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438fe0
push 0x438fd8
push str.FlsGetValue
push 0x21
call fcn.004268f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x426ae6
push dword [ebp + 8]
mov ecx, esi
call dword [0x43512c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x426aee
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438fe8
push 0x438fe0
push str.FlsSetValue
push 0x22
call fcn.004268f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x426b28
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43512c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x428dcb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00418de0
mov eax, dword [0x441040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004262ff
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x428e0d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x428f69
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00433760
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x444008]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00429fa1
mov ecx, dword [esi*4 + 0x444008]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x428f62
cmp eax, dword [ecx + edi + 0x24]
jne 0x428f62
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x428f62
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00429fa1
add esp, 0x14
test edx, edx
jl 0x428f62
jg 0x428ed8
test eax, eax
jb 0x428f62
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x428f62
jl 0x428ef2
cmp dword [ebp - 0x1008], eax
ja 0x428f62
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x428f10
test ebx, ebx
je 0x428f49
cmp ecx, edi
jae 0x428f49
mov al, byte [ecx]
cmp al, 0xd
jne 0x428f2a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x428f36
cmp byte [ecx + 1], 0xa
jne 0x428f36
inc ecx
jmp 0x428f36
movzx eax, al
movsx eax, byte [eax + 0x441300]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x428f10
cmp edx, ebx
jne 0x428f10
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x428f67
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004184a5
leave
ret
Function at 0x429439
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x444008]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x429479
cmp byte [ebx], 0xa
jne 0x429479
or byte [edi + eax + 0x28], 4
jmp 0x42947e
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x42957d
mov dl, byte [eax]
cmp dl, 0x1a
je 0x429560
inc eax
cmp dl, 0xd
je 0x4294aa
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4294d0
cmp eax, ecx
jae 0x4294de
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x429492
jmp 0x42957d
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42955b
cmp dword [ebp - 0x10], 0
je 0x42955b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x444008]
test byte [eax + edi + 0x28], 0x48
je 0x429535
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x429520
mov byte [esi], dl
jmp 0x429531
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x444008]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x42957d
cmp byte [ebp - 1], 0xa
jne 0x429544
cmp esi, ebx
jne 0x429544
mov byte [esi], 0xa
jmp 0x42957c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00429fbf
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x42957d
mov byte [esi], 0xd
jmp 0x42957c
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x444008]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42957a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42957d
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret