joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4085a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4085b7
pop dword [ebp - 0x50]
mov eax, 0x8226e5ec
sub eax, 0x81e66035
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x35294
push 0
mov eax, 0xa7aa7504
add eax, 0x58966bd4
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x374e
xor edx, edx
add edx, eax
mov edi, 0xb9526c5d
sub edi, 0xb9113099
add edi, dword [ebp - 0x50]
mov esi, 0x3c683469
sub esi, 0x6babfb98
add dword [ebp - 0x28], 0x9735b51f
mov ebx, dword [edi]
add dword [ebp - 0x48], ecx
xor ebx, esi
add dword [ebp - 0x28], 0x94dc748d
mov dword [edx], ebx
xor dword [ebp - 0x28], eax
add edx, 0x61737a31
add edx, 0x9e8c85d3
add edi, 0xd31681d3
sub edi, 0xd31681cf
loop 0x408612
add eax, 0x2b0e3ae4
add eax, 0xd4f29527
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1000fe90
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
mov esi, ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
movq qword [eax + 0x10], xmm0
call fcn.10003c50
mov ecx, eax
call fcn.1002e8a0
movzx ecx, ax
mov eax, dword [esi]
mov eax, dword [eax + 4]
test byte [eax + esi + 0xc], 6
jne 0x1000ffa0
mov ebx, 0x5a4d
cmp cx, bx
jne 0x1000ffa0
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
mov ecx, esi
mov dword [eax], 0x3c
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
movq qword [eax + 0x10], xmm0
call fcn.10003c50
mov ecx, eax
call fcn.1002e8a0
movzx edx, ax
mov eax, dword [esi]
mov eax, dword [eax + 4]
test byte [eax + esi + 0xc], 6
jne 0x1000ff9a
sub esp, 0x18
mov eax, edx
mov ecx, esp
cdq
xorps xmm0, xmm0
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
movq qword [ecx + 0x10], xmm0
mov ecx, esi
call fcn.10003c50
mov ecx, eax
call fcn.1002e8a0
movzx edi, ax
mov eax, dword [esi]
mov eax, dword [eax + 4]
test byte [eax + esi + 0xc], 6
jne 0x1000ff9a
mov eax, 0x4550
cmp di, ax
jne 0x1000ff94
mov ecx, esi
call fcn.1002e8a0
movzx ecx, ax
mov eax, dword [esi]
mov eax, dword [eax + 4]
test byte [eax + esi + 0xc], 6
jne 0x1000ff9a
test cx, cx
jne 0x1000ff9a
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov eax, ebx
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1002e8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002e8af
pop dword [ebp - 0x28]
mov eax, 0x6170ca9
sub eax, 0xf61423fa
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5adbc4c2
add dword [ebp - 0x38], 0xf3768089
mov dword [ebp - 0x34], 0x950b15e
sub dword [ebp - 0x34], 0xd71d6519
mov dword [ebp - 0x30], 0xd5e1e11b
add dword [ebp - 0x30], 0x766a6313
mov dword [ebp - 0x2c], 0x4be21586
sub dword [ebp - 0x2c], 0x4be21586
lea eax, [ebp - 0x38]
push eax
mov eax, 0x10836432
add eax, 0xff84fc6e
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x532db495
add dword [ebp - 0x38], 0x2144b4c1
mov dword [ebp - 0x34], 0xa9fbc5f5
sub dword [ebp - 0x34], 0x688f6480
mov dword [ebp - 0x30], 0x5224df6c
sub dword [ebp - 0x30], 0xeeb57300
mov dword [ebp - 0x2c], 0x58df0b83
sub dword [ebp - 0x2c], 0x58df0b83
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x13e6ee64
add eax, 0xfc217204
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x5787c
push 0
call eax
mov ecx, 0x5223
xor esi, esi
add esi, eax
mov edi, 0x100b8600
add edi, dword [ebp - 0x28]
mov ebx, 0x216a010a
sub ebx, 0x85b0427e
mov dword [ebp - 0x1c], 0xc6f4fbeb
mov edx, dword [edi]
xor dword [ebp - 0x14], 0x4043e21
xor edx, ebx
mov dword [esi], edx
sub dword [ebp - 0x14], esi
add esi, 0x59a26554
add esi, 0xa65d9ab0
add edi, 0xd1bab813
sub edi, 0xd1bab80f
loop 0x1002e9c7
add eax, 0xb713d8a4
sub eax, 0xb7129d45
mov ebx, eax
add eax, 0x1256e90d
add eax, 0xeda916f8
mov ecx, 0x8c265f1f
add ecx, 0x83d9a0e1
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x403203
pop dword [ebp - 0x20]
mov eax, 0xfe26b4a6
add eax, 0x2197d5d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xcbbcc894
sub dword [ebp - 0x30], 0x7d6a8349
mov dword [ebp - 0x2c], 0x566ac6d5
add dword [ebp - 0x2c], 0xdbc88570
mov dword [ebp - 0x28], 0x588d5c2
sub dword [ebp - 0x28], 0xb93c9194
mov dword [ebp - 0x24], 0xcfab45f
add dword [ebp - 0x24], 0xf3054ba1
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xfc3be24d
sub dword [ebp - 0x30], 0x87c978f7
mov dword [ebp - 0x2c], 0xac2c8a8
add dword [ebp - 0x2c], 0x36a998cd
mov dword [ebp - 0x28], 0x2db0438
add dword [ebp - 0x28], 0x60946834
mov dword [ebp - 0x24], 0x2738ee6e
sub dword [ebp - 0x24], 0x2738ee6e
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xaa313654
sub eax, 0xa9f0b580
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3574d
push 0
call eax
mov ecx, 0x9b7b2710
add ecx, 0x64851c63
mov edx, eax
mov ebx, 0x2234b327
add ebx, 0xde0c5cd9
add ebx, dword [ebp - 0x20]
mov esi, 0x4d241daa
sub esi, 0x2448946b
mov edi, dword [ebx]
mov dword [ebp - 0x18], 0x780cebe3
add edi, esi
mov dword [ebp - 0x10], 0x5fa410dc
mov dword [edx], edi
xor dword [ebp - 4], ecx
add edx, 0x46f63ece
sub edx, 0x46f63eca
add ebx, 0x5c6f58f6
sub ebx, 0x5c6f58f2
loop 0x403320
add eax, 0xd8b5ee2e
add eax, 0x274b1271
xor ebx, ebx
add ebx, eax
add eax, 0x44879902
add eax, 0xbb786703
mov ecx, 0x95020637
add ecx, 0x6b3df9c9
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x40107e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 4]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [0x4545b8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4545bc]
xor esi, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
call fcn.00401077
mov eax, dword [0x4545c0]
add dword [ebp - 0x14], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x4545c4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x1a45114], 0xc
mov dword [ebp - 4], eax
jne 0x401100
push esi
lea eax, [ebp - 0x40]
push eax
push esi
lea eax, [ebp - 0x458]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x1a45114]
cmp eax, 0xfa9
jne 0x40111c
mov dword [0x1a45110], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401134
push esi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x1a45064], esi
mov eax, dword [ebp - 0x14]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1a4510c], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
sub ebx, dword [ebp - 8]
cmp dword [0x1a45114], 0xc
mov dword [ebp - 4], eax
jne 0x4011b8
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x458]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, dword [ebp - 0x18]
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x14], 0x61c88647
sub edi, eax
dec dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
jne 0x4010d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
leave
ret 4
Function at 0x40894f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x453d70]
jne 0x408959
repz ret
jmp fcn.0040c73d

Function at 0x40b490
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406b80
and dword [ebp - 4], 0
cmp dword [0x45d620], 0
mov ebx, eax
jne 0x40b541
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b5f2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b5f2
push eax
call fcn.00406b0e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45d620], eax
call esi
push eax
call fcn.00406b0e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45d624], eax
call esi
push eax
call fcn.00406b0e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45d628], eax
call esi
push eax
call fcn.00406b0e
pop ecx
mov dword [0x45d630], eax
test eax, eax
je 0x40b541
push 0x44feb0
push edi
call esi
push eax
call fcn.00406b0e
pop ecx
mov dword [0x45d62c], eax
mov eax, dword [0x45d62c]
cmp eax, ebx
je 0x40b599
cmp dword [0x45d630], ebx
je 0x40b599
push eax
call fcn.00406b89
push dword [0x45d630]
mov esi, eax
call fcn.00406b89
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b599
test edi, edi
je 0x40b599
call esi
test eax, eax
je 0x40b590
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b590
test byte [ebp - 0xc], 1
jne 0x40b599
or dword [ebp + 0x10], 0x200000
jmp 0x40b5d2
mov eax, dword [0x45d624]
cmp eax, ebx
je 0x40b5d2
push eax
call fcn.00406b89
pop ecx
test eax, eax
je 0x40b5d2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b5d2
mov eax, dword [0x45d628]
cmp eax, ebx
je 0x40b5d2
push eax
call fcn.00406b89
pop ecx
test eax, eax
je 0x40b5d2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45d620]
call fcn.00406b89
pop ecx
test eax, eax
je 0x40b5f2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b5f4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431d10
Capabilities:
Parse credit card information

Disassembly:
cmp dword [ecx + 0x6d], 1
je 0x431d1b
xor al, al
ret 4
push ebx
xor eax, eax
mov al, byte [ecx + 0x1a1]
push esi
mov esi, dword [esp + 0xc]
cmp byte [eax + esi], 0
jne 0x431d41
xor edx, edx
mov dl, byte [ecx + 0x1ad]
cmp byte [edx + esi], 0
jne 0x431d41
xor bl, bl
jmp 0x431d43
mov bl, 1
xor eax, eax
xor edx, edx
mov dl, byte [ecx + eax + 0x17a]
cmp byte [edx + ecx + 0x7a], 0
jne 0x431d74
cmp byte [edx + esi], 0
je 0x431d74
cmp eax, 0xc
je 0x431d7f
cmp eax, 0xd
je 0x431d8b
cmp eax, 0x1a
je 0x431d97
cmp eax, 0x27
je 0x431d74
cmp eax, 0x33
jne 0x431da3
inc eax
cmp eax, 0x40
jl 0x431d45
jmp 0x431e67
mov dword [ecx + 0x72], 0x8008
jmp 0x431e67
mov dword [ecx + 0x72], 0x8009
jmp 0x431e67
mov dword [ecx + 0x72], 0x800d
jmp 0x431e67
cmp eax, 0x35
jne 0x431dbc
mov al, byte [0x8210d0]
test al, al
sete al
mov byte [0x8210d0], al
jmp 0x431e67
cmp eax, 0x36
jne 0x431dcd
mov dword [ecx + 0x72], 0x8024
jmp 0x431e67
cmp eax, 0x37
jne 0x431dde
mov dword [ecx + 0x72], 0x8026
jmp 0x431e67
cmp eax, 0x38
jne 0x431dec
mov dword [ecx + 0x72], 0x8021
jmp 0x431e67
cmp eax, 0x39
jne 0x431dfa
mov dword [ecx + 0x72], 0x8025
jmp 0x431e67
cmp eax, 0x3a
jne 0x431e08
mov dword [ecx + 0x72], 0x8027
jmp 0x431e67
cmp eax, 0x3b
jne 0x431e16
mov dword [ecx + 0x72], 0x8023
jmp 0x431e67
cmp eax, 0x3c
jne 0x431e24
mov dword [ecx + 0x72], 0x8028
jmp 0x431e67
cmp eax, 0x3d
jne 0x431e32
mov dword [ecx + 0x72], 0x8022
jmp 0x431e67
cmp eax, 0x3e
jne 0x431e40
mov dword [ecx + 0x72], 0x802d
jmp 0x431e67
cmp eax, 0x3f
jne 0x431e4e
mov dword [ecx + 0x72], 0x802e
jmp 0x431e67
mov dl, byte [0x8210d0]
test dl, dl
jne 0x431e7f
test bl, bl
je 0x431e83
movsx eax, byte [ecx + eax*2 + 0x27b]
mov dword [ecx + 0x72], eax
xor eax, eax
mov dl, byte [eax + esi]
mov byte [ecx + eax + 0x7a], dl
inc eax
cmp eax, 0x100
jl 0x431e69
pop esi
mov al, 1
pop ebx
ret 4
test bl, bl
je 0x431e5c
movsx edx, byte [ecx + eax*2 + 0x27a]
mov dword [ecx + 0x72], edx
jmp 0x431e67
Function at 0x438ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov al, byte [esp + 0x74]
push ebx
push ebp
push esi
test al, al
push edi
mov ebp, ecx
mov dword [esp + 0x10], 0
je 0x438b01
mov eax, dword [ebp + 0xaa]
jmp 0x438b07
mov eax, dword [ebp + 0xae]
mov ecx, dword [esp + 0x7c]
lea ecx, [ecx + ecx*4]
mov edx, dword [eax + ecx*4]
add edx, 7
mov ecx, edx
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
mov ecx, dword [esp + 0x80]
lea ecx, [ecx + ecx*4]
mov eax, dword [eax + ecx*4]
add eax, 7
dec esi
dec edx
inc edi
mov ecx, dword [eax]
inc ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x1c]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], ebx
call fcn.004011d0
add esp, 0xc
test eax, eax
je 0x438c56
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
cmp esi, eax
jne 0x438c09
mov eax, dword [esp + 0x38]
mov ebx, esi
mov esi, dword [esp + 0x30]
cmp esi, eax
jg 0x438c56
lea ecx, [esp + 0x4c]
mov dword [esp + 0x84], ecx
push 2
push esi
push ebx
mov ecx, ebp
call fcn.00438cd0
test al, 0x88
jne 0x438bda
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x10]
mov ecx, edx
inc edi
add ecx, 4
cmp edi, 0xa
mov dword [edx], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x84], ecx
jge 0x438be7
mov eax, dword [esp + 0x38]
inc esi
cmp esi, eax
jle 0x438ba8
mov edi, dword [esp + 0x10]
test edi, edi
je 0x438c56
push 0x133
push str.D:DevProjectsJMain1SourceBSP.cpp
call fcn.00401130
cdq
add esp, 8
idiv edi
mov edx, dword [esp + edx*4 + 0x4c]
jmp 0x438ca1
mov ecx, dword [esp + 0x30]
cmp esi, eax
mov dword [esp + 0x84], ecx
jg 0x438c56
lea ebx, [esp + 0x4c]
mov edx, dword [esp + 0x84]
push 2
push edx
push esi
mov ecx, ebp
call fcn.00438cd0
test al, 0x88
jne 0x438c45
mov edi, dword [esp + 0x10]
mov dword [ebx], esi
inc edi
add ebx, 4
cmp edi, 0xa
mov dword [esp + 0x10], edi
jge 0x438c52
mov eax, dword [esp + 0x34]
inc esi
cmp esi, eax
jle 0x438c1c
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x438c81
add ebp, 4
push str.GetLeafEntry__:_Error_occurs.
push ebp
mov dword [0x8210d4], 1
call fcn.004331c0
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push 0xffffffffffffffff
push eax
call fcn.0043a100
add esp, 0x14
jmp 0x438cb4
push 0x146
push str.D:DevProjectsJMain1SourceBSP.cpp
call fcn.00401130
cdq
add esp, 8
idiv edi
mov ebx, dword [esp + edx*4 + 0x4c]
mov edx, dword [esp + 0x84]
push 2
push edx
push ebx
mov ecx, ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edx
call fcn.00438cd0
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], ecx
pop ebp
mov dword [eax + 4], edx
pop ebx
add esp, 0x64
ret 0x10
Function at 0x43afc0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 8
test eax, eax
push esi
je 0x43b0b0
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 8]
push eax
push ecx
push edx
call fcn.0043b460
mov ecx, dword [esp + 0x18]
add esp, 0x10
mov eax, ecx
shr eax, 0x1a
mov dl, byte [eax + 0x500348]
mov eax, dword [esp + 0x14]
mov byte [eax + 0xa], dl
mov edx, ecx
shr edx, 0x14
and edx, 0x3f
mov dl, byte [edx + 0x500348]
mov byte [eax + 9], dl
mov edx, ecx
shr edx, 0xe
and edx, 0x3f
mov dl, byte [edx + 0x500348]
mov byte [eax + 8], dl
mov edx, ecx
shr edx, 8
and edx, 0x3f
mov dl, byte [edx + 0x500348]
mov byte [eax + 7], dl
mov edx, ecx
shr edx, 2
and edx, 0x3f
and ecx, 3
shl ecx, 4
mov dl, byte [edx + 0x500348]
mov byte [eax + 6], dl
mov edx, dword [esp + 4]
mov esi, edx
shr esi, 0x1c
or esi, ecx
mov cl, byte [esi + 0x500348]
pop esi
mov byte [eax + 5], cl
mov ecx, edx
shr ecx, 0x16
and ecx, 0x3f
mov cl, byte [ecx + 0x500348]
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
and ecx, 0x3f
mov cl, byte [ecx + 0x500348]
mov byte [eax + 3], cl
mov ecx, edx
shr ecx, 0xa
and ecx, 0x3f
mov cl, byte [ecx + 0x500348]
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 4
and ecx, 0x3f
and edx, 0xf
mov cl, byte [ecx + 0x500348]
mov byte [eax + 1], cl
mov dl, byte [edx + 0x500348]
mov byte [eax], dl
add esp, 8
ret
mov eax, dword [esp + 0x10]
push ebx
xor ebx, ebx
xor edx, edx
mov bl, byte [eax + 9]
mov dl, byte [eax + 0xa]
xor ecx, ecx
push 0
mov esi, dword [ebx*4 + 0x500388]
mov edx, dword [edx*4 + 0x500388]
xor ebx, ebx
mov cl, byte [eax + 5]
mov bl, byte [eax + 8]
shl edx, 6
or edx, esi
mov esi, dword [ebx*4 + 0x500388]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x500388]
mov bl, byte [eax + 7]
shl edx, 6
or edx, esi
mov esi, dword [ebx*4 + 0x500388]
xor ebx, ebx
mov bl, byte [eax + 6]
shl edx, 6
or edx, esi
mov esi, dword [ebx*4 + 0x500388]
shl edx, 6
or edx, esi
mov esi, ecx
shl edx, 2
shr esi, 4
or edx, esi
mov dword [esp + 0x10], edx
xor edx, edx
mov dl, byte [eax + 4]
shl ecx, 6
mov edx, dword [edx*4 + 0x500388]
or edx, ecx
xor ecx, ecx
mov cl, byte [eax + 3]
shl edx, 6
mov esi, dword [ecx*4 + 0x500388]
xor ecx, ecx
mov cl, byte [eax + 2]
or edx, esi
shl edx, 6
mov esi, dword [ecx*4 + 0x500388]
xor ecx, ecx
mov cl, byte [eax + 1]
or edx, esi
shl edx, 6
mov esi, dword [ecx*4 + 0x500388]
xor ecx, ecx
mov cl, byte [eax]
or edx, esi
mov eax, dword [esp + 0x1c]
mov esi, dword [ecx*4 + 0x500388]
lea ecx, [esp + 0xc]
shl edx, 4
or edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x20]
push edx
push eax
push ecx
call fcn.0043b460
add esp, 0x10
pop ebx
pop esi
add esp, 8
ret
Function at 0x4ebfa0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40c302
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40c311
pop dword [ebp - 0x44]
mov eax, 0x40c311
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x39fb2
push 0
mov eax, 0xdd302e48
sub eax, 0xdcef4d70
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x46c26cd
add ecx, 0xfb9422ea
mov esi, eax
mov edi, 0xb08e5718
sub edi, 0xb04d1b54
add edi, dword [ebp - 0x44]
mov ebx, 0x978b1274
sub ebx, 0xf6eaa27b
xor dword [ebp - 8], edi
mov edx, dword [edi]
xor edx, ebx
xor dword [ebp - 0x28], 0xa1f0d200
mov dword [esi], edx
xor dword [ebp - 0xc], esi
add esi, 4
add edi, 4
loop 0x40c36b
add eax, 0x1c6c97d3
add eax, 0xe39481dc
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x90639ee2
sub ecx, 0x90239ee2
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40106a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x8103f8]
mov dword [ebp - 0x30], eax
mov eax, dword [0x8103fc]
push edi
xor edi, edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], edi
call fcn.00401063
mov eax, dword [0x810400]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x810404]
add ebx, 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
shl eax, 4
cmp dword [0x1e00fac], 0xc
mov dword [ebp - 4], eax
jne 0x4010ef
push edi
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x434]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x1e00fac]
cmp eax, 0xfa9
jne 0x40110b
mov dword [0x1e00fa8], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40111f
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x1e00efc], edi
mov eax, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1e00fa4], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 8], eax
sub esi, dword [ebp - 8]
cmp dword [0x1e00fac], 0xc
mov dword [ebp - 4], eax
jne 0x401175
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add ebx, 0x61c88647
dec dword [ebp - 0x20]
jne 0x4010be
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], ecx
pop ebx
leave
ret 4