joyce8/EMBER2024-capa huggingface dataset:
Function at 0x83c108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0083c258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x83c12e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83c11a
add dl, dl
jne 0x83c139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83c18c
xor eax, eax
add dl, dl
jne 0x83c146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83c22d
add dl, dl
jne 0x83c155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83c160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83c16b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83c176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x83c182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x83c125
mov eax, 1
add dl, dl
jne 0x83c19a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83c1a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x83c191
sub eax, ebx
mov ebx, 1
jne 0x83c1d8
mov ecx, 1
add dl, dl
jne 0x83c1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x83c1c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x83c1b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x83c125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x83c1ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x83c1fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x83c1e6
cmp eax, 0x7d00
jae 0x83c21d
cmp eax, 0x500
jb 0x83c218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x83c125
cmp eax, 0x7f
ja 0x83c220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x83c125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x83c24e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x83c125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405660
Capabilities:
Execute syscall

Disassembly:
jne 0x405667
cmp dword [eax + 8], esi
je 0x405671
mov ecx, eax
lock add byte [ebp - 0x14118a40], al
or al, 0x8b
sbb byte [ecx + 0x5d], ch
mov ecx, dword [edx + 0x14]
mov dword [eax], ecx
mov ebx, dword [eax]
imul ebx, dword [ebp - 0x75], 0x889144a
mov dword [edx + 0x14], eax
mov eax, dword [edx + 0x38]
lea ecx, [edx + 0x38]
test eax, eax
je 0x4056ac
cmp dword [eax + 4], edi
syscall
cmp dword [eax + 8], esi
je 0x4056a0
mov ecx, eax
mov eax, dword [eax]
test eax, eax
jne 0x4056b9
pop edi
pop esi
pop ebx
pop ebp
ret 0xcb0c
pop ebx
xor byte [ecx + 0x3c4a8ba2], cl
mov dword [eax], ecx
mov dword [edx + 0x3c], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
lea edx, [eax - 0x6f6f6f70]
lahf
test byte [ebx + 0x8398b3f], 0x56
mov esi, dword [ebp + 0x10]
inc edx
mov edi, dword [ebp + 0xc]
push esi
push edi
push eax
call fcn.00405640
push edi
movsb byte es:[edi], byte [esi]
salc
and dword [eax + 0x5d5e0376], 0xffffffc2
or al, 0
nop
pop esp
add eax, 0x4f908490
ficom dword [eax - 0x6f6f6f70]
nop

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
sti
inc ecx
push ecx
push edx
push eax
adc cl, cl
test eax, 0x8d530000
invalid
sub byte [ebp + 0x30], 5
sahf
inc esi
xor byte [edx], 0x30
mov byte [esi], cl
jmp 0x40130c
push ebp
mov ebp, esp
and eax, 0x14
dec ebx
jge 0x407f09
dec edi
jl 0x407f60
mov dword [ebp + 0x10], 0x49004e
fld qword [ebp + 8]
sbb al, 0x1d
xor dl, al
inc eax
add byte [ebx + 0x3253180e], cl
pop ebp
and byte [esi + 0x33], dl
not byte [edi - 0x21]
loopne 0x407ea3
ret 0x40
jne 0x407f23
mov dword [ecx], esi
test byte [0x7afbb18c], 0xe
jp 0x407f33
fld qword [ebp + 8]
fchs
movsd dword es:[edi], dword [esi]
pop ebp
or bh, al
add dword [ecx], eax
add byte [eax], al
test dword [esi + 0x558bc54d], ebp
or byte [ebx + 0x5150ec45], bl
scasb al, byte es:[edi]
dec ebp
lds ecx, [ebx + 0x459b0855]
in al, dx
push eax
push ecx
push edx
inc edx
lodsb al, byte [esi]
sbb cl, al
inc eax
cmp ch, bl
out 8, al
fld qword [ebp - 0x14]
fcomp qword [0x2adc28c]
cmp dword [eax], 0xc
shl eax, cl
test ah, 0x44
jnp 0x407fcd
xor al, 0x73
push eax
cmp esi, ebx
xchg byte [eax - 0x23], bl
inc ebp
fld qword [ebp - 0x14]
in al, dx
out 0x1d, eax
xor byte [eax + eax*2], cl
add bh, bl
loopne 0x407f64
jnp 0x407fb4
jnp 0x407fe7
je 0x407fb9
in al, dx
fcom qword [eax]
adc byte [edx + 0x40], cl
add byte [ebp - 0x7caf1305], cl
in al, dx
or ch, bl
sbb al, 0x24
call dword [sym.imp.MSVCRT.dll_modf]
push esp
hlt
dec esi
mov dword [ebp - 4], ecx
ja 0x407f62
test al, 0x8d
and eax, 0x73f03b50
lea esp, [0x73f03b50]
das
mov dl, byte [esi]
mov al, bh
cli
inc esi
cmp ecx, dword [edx + esi*2 + 0xf74ebf6]
or dword [edi], edx
wbinvd
pop ss
fcomp qword [0xcb98c292]
fnstsw ax
and eax, 0x4100
jne 0x40801d
fld qword [ebp + 8]
fmul qword [0x40c2f8]
hlt
add ah, dh
push ebp
adc esi, dword [ecx + 0x281ddcc0]
ret 0x40
mov eax, dword [ebp + 0x10]
lea esi, [eax + ebx]
mov edi, dword [esp + ebx + 0x375c085]
add esi, dword [ebp - 4]
xchg ebx, eax
dec ebp
adc al, 0x5f
xor dword [edi], ebp
inc bp
adc byte [eax - 9], dh
fsubr dword [ecx + eax - 0x3a]
add edi, esi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ecx, dword [edi - 0x2b]
cwde
push esp
inc ecx
xchg dword [esi - 0x7b], edx
rcl byte [edi + 0xf], 0x85
pop ds
test dword [edi], ebx
add dword [eax], eax
std
clc
pop es
xor byte [eax], al
mov dword [0x4107f8], 0xc70016
call dword [0x40332a]
mov eax, dword [0x49417a08]
add edi, eax
add cl, byte [edi]
test dword [eax], edi
add dword [eax], eax
add byte [ebx - 0x25], al
aam 0x41
add byte [esi + 0x3bc8a0c], bh
dec ebx
sal byte [ebx + edi - 0x75], 0x3d
push 0xa10040c1
je 0x40a72d
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [eax], 0x5b
jge 0x40a781
inc eax
add byte [ebx + 0xe7d5b38], al
lahf
leave
pop edx
add al, 0x8a
push cs
push ecx
call edi
add esp, 8
jmp 0x40a792
mov eax, dword [sym.imp.MSVCRT.dll__pctype]
xor edx, edx
mov dl, byte [esi]
mov ecx, dword [eax]
mov al, byte [ecx + edx*2]
and eax, 0x4d
test esp, ebx
jne 0x40a7cc
mov dl, byte [ecx + eax + 0x46]
salc
dec ebx
jne 0x40a769
mov ecx, dword [edx + 0x4108e0]
mov eax, dword [0x4107fc]
cmp eax, 0xffffff84
jb 0xd93ef111
stc
test byte [ecx + 0x14], bl
add byte [eax], al
xabort 4
inc edx
cmp ecx, 0xffffff98
xchg edx, eax
and ebp, dword [esi]
sub bl, ch
add byte [eax], al
xchg byte [ecx + eax], ch
add byte [eax], al
cmp byte [esi], 0
je 0x40a79e
push esi
call dword [0x3440c16c]
imul edi, edi, 0x8904c483
fsubrp st(0)
or byte [ecx], al
jmp 0x40a7a4
Function at 0x416b10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
push edi
push 0
push 0x4295cc
push 0x4293ec
push 0x80000002
mov esi, 0x4295c4
call fcn.0041dc70
mov edi, dword [esp + 0x30]
add esp, 0x10
test eax, eax
jne 0x416d23
test edi, edi
push ebx
je 0x416c11
mov eax, dword [0x42954c]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], eax
xor edx, edx
mov cl, byte [esp + edx + 0xc]
mov al, cl
and al, 0x80
shl cl, 1
test al, al
je 0x416b72
or cl, 1
mov al, byte [esp + edx + 0xd]
xor al, cl
mov cl, al
and cl, 1
shr al, 1
test cl, cl
je 0x416b85
or al, 0x80
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 3
jl 0x416b61
mov edx, dword [esp + 0xf]
push edx
call fcn.00416d70
mov bl, byte [esp + 0x10]
xor al, bl
push eax
call fcn.00416d50
mov cl, byte [esp + 0x2e]
mov dl, byte [esp + 0x16]
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1c], al
mov al, byte [esp + 0x15]
mov byte [esp + 0x1f], al
mov al, byte [esp + 0x2f]
mov byte [esp + 0x20], cl
mov cl, byte [esp + 0x17]
add esp, 8
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], ah
mov byte [esp + 0x19], dl
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], cl
xor esi, esi
mov dl, byte [esp + esi + 0x14]
push edx
call fcn.00416d70
xor al, byte [esp + esi + 0x19]
push eax
call fcn.00416d50
add esp, 8
mov byte [esp + esi + 0x14], al
inc esi
cmp esi, 7
jl 0x416be6
mov eax, dword [esp + 0x1b]
push eax
jmp 0x416ce0
push 0
call fcn.0042f400
mov edx, dword [0x42954c]
xor ecx, ecx
mov dword [esp + 0x18], ecx
add esp, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ecx
xor edx, edx
mov cl, byte [esp + edx + 0xc]
mov al, cl
and al, 0x80
shl cl, 1
test al, al
je 0x416c46
or cl, 1
mov al, byte [esp + edx + 0xd]
xor al, cl
mov cl, al
and cl, 1
shr al, 1
test cl, cl
je 0x416c59
or al, 0x80
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 3
jl 0x416c35
mov eax, dword [esp + 0xf]
push eax
call fcn.00416d70
mov bl, byte [esp + 0x10]
xor al, bl
push eax
call fcn.00416d50
mov cl, byte [esp + 0x15]
mov dl, byte [esp + 0x2e]
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1c], al
mov al, byte [esp + 0x16]
mov byte [esp + 0x1f], cl
mov cl, byte [esp + 0x2f]
mov byte [esp + 0x20], dl
mov dl, byte [esp + 0x17]
add esp, 8
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], ah
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], dl
xor esi, esi
mov al, byte [esp + esi + 0x14]
push eax
call fcn.00416d70
xor al, byte [esp + esi + 0x19]
push eax
call fcn.00416d50
add esp, 8
mov byte [esp + esi + 0x14], al
inc esi
cmp esi, 7
jl 0x416cba
mov ecx, dword [esp + 0x1b]
push ecx
call fcn.00416d70
xor al, byte [esp + 0x18]
push eax
call fcn.00416d50
add esp, 8
lea edx, [esp + 0x14]
mov byte [esp + 0x1b], al
push 8
push edx
push 0x4295bc
push 0x42957c
push 0x80000002
call fcn.0041ee60
add esp, 0x14
mov esi, 0x429578
test eax, eax
pop ebx
jne 0x416d23
mov esi, 0x429570
test edi, edi
mov eax, 0x429568
jne 0x416d31
mov eax, 0x429564
push esi
push eax
push 0x429550
call fcn.0041ad60
add esp, 0xc
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4176b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov eax, dword [esp + 0x5c]
mov dword [esp], 0x4298cc
test eax, eax
mov ecx, 0x42fa7c
mov dword [esp + 4], eax
jne 0x4176d0
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 0x4298c8
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4176e8
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], 0x4298c4
test eax, eax
mov dword [esp + 0x14], eax
jne 0x417700
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], 0x4298c0
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x417718
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x20], 0x4298bc
test eax, eax
mov dword [esp + 0x24], eax
jne 0x417730
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], 0x4298b8
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x417748
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], 0x4298b0
test eax, eax
mov dword [esp + 0x34], eax
jne 0x417760
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x78]
mov dword [esp + 0x38], 0x4298a8
test eax, eax
mov dword [esp + 0x3c], eax
jne 0x417778
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x40], 0x4298a0
test eax, eax
mov dword [esp + 0x44], eax
jne 0x417790
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x48], 0x429898
test eax, eax
mov dword [esp + 0x4c], eax
jne 0x4177ab
mov dword [esp + 0x4c], ecx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x50], 0x429890
test eax, eax
mov dword [esp + 0x54], eax
jne 0x4177c6
mov dword [esp + 0x54], ecx
push ebx
mov ebx, dword [fcn.004261d8]
push ebp
push esi
push edi
xor edi, edi
lea esi, [esp + 0x14]
mov ebp, 0xb
mov eax, dword [esi - 4]
push eax
call ebx
mov ecx, dword [esi]
lea edi, [edi + eax + 1]
push ecx
call ebx
add esi, 8
dec ebp
lea edi, [edi + eax + 1]
jne 0x4177db
lea edi, [edi + edi*2 + 0x64]
push edi
call fcn.0042ef45
mov esi, eax
add esp, 4
test esi, esi
je 0x417865
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ebp, dword [fcn.004261cc]
mov ecx, edx
and ecx, 3
mov dword [esp + 0x6c], 0
rep stosb byte es:[edi], al
lea edi, [esp + 0x10]
mov ebx, 0xb
mov ecx, dword [edi + 4]
mov edx, dword [edi]
lea eax, [esp + 0x6c]
push eax
push ecx
push edx
call fcn.00423e90
add esp, 0xc
test eax, eax
je 0x417852
mov eax, dword [esp + 0x6c]
push eax
push esi
call ebp
lea ecx, [esp + 0x6c]
push ecx
call fcn.0041e950
add esp, 4
add edi, 8
dec ebx
jne 0x417832
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x4215f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [fcn.004261d8]
push esi
xor esi, esi
mov eax, 1
push edi
mov dword [esp + 0x14], 0x42b4fc
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x42b4f0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x42b4e8
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x42b4dc
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x429958
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0x42b4d0
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x42a2e8
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x42b4cc
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 0x42b4c4
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0x42b4b4
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], 0x42b4a4
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x42b498
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x42b494
mov dword [esp + 0x78], eax
lea edi, [esp + 0x14]
mov ebx, 0xd
mov eax, dword [edi]
push eax
call ebp
add edi, 8
dec ebx
lea esi, [esi + eax + 2]
jne 0x4216a9
add esi, 0xa
push esi
call fcn.0042ef45
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x421725
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, ebx
and ecx, 3
mov dword [esp + 0x10], 0xd
rep stosb byte es:[edi], al
lea edi, [esp + 0x14]
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x4216fe
mov eax, dword [edi + 4]
test eax, eax
je 0x421717
mov eax, dword [edi]
push eax
push esi
call dword [fcn.004261e0]
push esi
call ebp
mov cl, byte [esp + 0x80]
add esi, eax
mov byte [esi], cl
inc esi
mov eax, dword [esp + 0x10]
add edi, 8
dec eax
mov dword [esp + 0x10], eax
jne 0x4216ec
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x42ca50
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2014
call fcn.0042ee80
mov ecx, dword [esp + 0x201c]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x201c]
mov dword [ecx], eax
push ebp
push esi
xor esi, esi
mov dword [ecx + 4], eax
push edi
test ebx, ebx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
jl 0x42cbfb
push 2
push eax
push ebx
call fcn.004355e9
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x42cbe6
cmp edi, 0x14
jle 0x42cbba
cmp edi, 0x2000
mov ebp, 0x2000
jg 0x42cab9
mov ebp, edi
mov ebx, edi
sub ebx, ebp
test ebx, ebx
jl 0x42cbaf
mov edx, dword [esp + 0x2028]
push 0
push ebx
push edx
call fcn.004355e9
add esp, 0xc
test eax, eax
jl 0x42cb83
mov ecx, dword [esp + 0x2028]
lea eax, [esp + 0x24]
push ebp
push eax
push ecx
call fcn.004305ca
add esp, 0xc
cmp ebp, eax
jne 0x42cb74
test esi, esi
lea edx, [ebp - 0x14]
jne 0x42cb41
lea eax, [esp + edx + 0x24]
test edx, edx
jl 0x42cb41
mov ecx, dword [0x42dc40]
cmp ecx, dword [eax]
jne 0x42cb3b
cmp dword [eax + 8], 0x1000000
jne 0x42cb3b
cmp dword [eax + 4], 0x14
jne 0x42cb3b
mov edi, dword [esp + 0x202c]
mov ecx, 5
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
mov esi, 1
dec edx
dec eax
test esi, esi
je 0x42cb05
test ebx, ebx
jle 0x42cb6f
mov edx, 0x14
mov eax, 0
sub edx, ebp
add ebx, edx
sets al
dec eax
and ebx, eax
mov eax, edi
sub eax, ebx
cmp eax, 0x2000
jle 0x42cb6b
mov ebp, 0x2000
jmp 0x42cb9a
mov ebp, eax
jmp 0x42cb9a
or ebx, 0xffffffff
jmp 0x42cb9a
call fcn.00430e98
mov ecx, dword [eax]
push ecx
push 0x42ddf8
jmp 0x42cb90
call fcn.00430e98
mov edx, dword [eax]
push edx
push 0x42ddd8
call fcn.0042d580
add esp, 8
xor ebp, ebp
test esi, esi
je 0x42cabd
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2014
ret
test esi, esi
jne 0x42cbfb
mov ebx, dword [esp + 0x2028]
mov eax, dword [esp + 0x2030]
test eax, eax
je 0x42cbfb
mov eax, dword [esp + 0x202c]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
call fcn.0042cc10
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2014
ret
call fcn.00430e98
mov edx, dword [eax]
push edx
push 0x42ddc0
call fcn.0042d580
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2014
ret
Function at 0x42ce90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042d5a0
mov esi, dword [esp + 0x28]
xor eax, eax
mov ecx, esi
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [ecx], eax
test edi, edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
jl 0x42cfc2
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push edx
push eax
push edi
call fcn.0042ca50
add esp, 0xc
test eax, eax
je 0x42cfaa
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
push edi
call fcn.004355e9
add esp, 0xc
test eax, eax
jl 0x42cf8c
push 0x10
push esi
push edi
call fcn.004305ca
add esp, 0xc
cmp eax, 0x10
jne 0x42cf6e
mov eax, dword [esi]
mov ecx, dword [0x42dc3c]
cmp ecx, eax
jne 0x42cf57
mov eax, dword [esi + 8]
cmp eax, 0x1000000
jne 0x42cf40
mov esi, dword [esi + 4]
cmp esi, 0x10
jne 0x42cf29
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
push esi
push 0x42dfe0
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push eax
push 0x42dfc4
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push eax
push 0x42dfa0
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.00430e98
mov edx, dword [eax]
push edx
push 0x42df84
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.00430e98
mov eax, dword [eax]
push eax
push 0x42df64
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push 0x42df48
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push 0x42df2c
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x42cfe0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0042d5a0
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov ecx, 0x11
xor eax, eax
mov edi, esi
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x42d013
push ebp
push edi
call fcn.0042d0d0
add esp, 8
cmp dword [ebp], 0
je 0x42d0b9
push 0x44
push esi
push edi
call fcn.004305ca
add esp, 0xc
cmp eax, 0x44
jne 0x42d09d
mov eax, dword [esi]
mov ecx, dword [0x42dc44]
cmp eax, ecx
jne 0x42d088
mov eax, dword [esi + 0x34]
mov ebx, 1
test eax, eax
je 0x42d071
mov ecx, dword [esi + 0x38]
push 0
add ecx, eax
push ecx
push edi
call fcn.004355e9
add esp, 0xc
cmp eax, 0xffffffff
jne 0x42d071
call fcn.00430e98
mov edx, dword [eax]
push edx
push 0x42e054
call fcn.0042d580
add esp, 8
push 1
push 0
push edi
call fcn.004355e9
add esp, 0xc
mov dword [ebp], eax
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
push fcn.0042e030
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.00430e98
mov eax, dword [eax]
push eax
push 0x42e018
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push 0xffffffffffffffff
push 0x42dff8
call fcn.0042d580
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42d310
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call fcn.0042d5a0
mov ebx, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov esi, dword [esp + 0x58]
mov dword [ebx], ebp
mov dword [eax], ebp
test esi, esi
jl 0x42d438
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x42d438
cmp byte [eax], 0
je 0x42d438
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
push esi
call fcn.0042d140
add esp, 0x10
test eax, eax
je 0x42d447
mov eax, dword [esp + 0x44]
test eax, eax
je 0x42d447
push eax
call fcn.0042ef45
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebx], edi
je 0x42d41a
mov ecx, dword [esp + 0x44]
xor eax, eax
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x4c]
push eax
push esi
call fcn.004355e9
add esp, 0xc
cmp eax, 0xffffffff
je 0x42d3fb
mov ecx, dword [esp + 0x44]
mov edx, dword [ebx]
push ecx
push edx
push esi
call fcn.004305ca
mov ecx, dword [esp + 0x50]
add esp, 0xc
cmp ecx, eax
jne 0x42d3dc
mov eax, dword [esp + 0x68]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, 1
pop ebx
add esp, 0x44
ret
call fcn.00430e98
mov ecx, dword [eax]
push ecx
push 0x42e198
call fcn.0042d580
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
call fcn.00430e98
mov edx, dword [eax]
push edx
push 0x42e178
call fcn.0042d580
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
call dword [fcn.004261c0]
push eax
push 0x42e15c
call fcn.0042d580
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
push 0xffffffffffffffff
push 0x42e130
call fcn.0042d580
add esp, 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x1005662
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1005671
pop dword [ebp - 0x1c]
mov eax, 0x20a4fd2
sub eax, 0x109f961
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x4aa3264c
add dword [ebp - 0x2c], 0x3af1eff
mov dword [ebp - 0x28], 0xb855ec16
add dword [ebp - 0x28], 0x79dd602f
mov dword [ebp - 0x24], 0xeeba4376
sub dword [ebp - 0x24], 0xa26dff48
mov dword [ebp - 0x20], 0x15e76440
sub dword [ebp - 0x20], 0x15e76440
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x76449b77
sub eax, 0x75448a23
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x7cad2d0
sub dword [ebp - 0x2c], 0x9358697a
mov dword [ebp - 0x28], 0x65b0d724
sub dword [ebp - 0x28], 0x244475af
mov dword [ebp - 0x24], 0x7791d128
sub dword [ebp - 0x24], 0x142264bc
mov dword [ebp - 0x20], 0x7147e6b2
add dword [ebp - 0x20], 0x8eb8194e
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3679b
push 0
call eax
mov ecx, 0x44ab
mov edi, eax
mov ebx, 0x946ce614
add ebx, 0x6ca179ec
add ebx, dword [ebp - 0x1c]
mov edx, 0xa46fd3d8
add edx, 0xb2d9330d
sub dword [ebp - 8], 0x40d13688
mov esi, dword [ebx]
xor esi, edx
xor dword [ebp - 0x18], ebx
mov dword [edi], esi
mov dword [ebp - 0x10], 0xc22eab31
add edi, 0xfdd44bfc
add edi, 0x22bb408
add ebx, 0xa00c0979
sub ebx, 0xa00c0975
loop 0x1005788
add eax, 0xf89a9f9e
sub eax, 0xf8999a1f
mov ebx, eax
add eax, 0x67decfcb
sub eax, 0x67decfc6
mov ecx, 0xe9593d88
add ecx, 0x17a6c278
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1005ae4
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1005b0b
inc esi
mov al, byte [esi]
test al, al
je 0x1005b04
cmp al, 0x22
jne 0x1005af9
cmp byte [esi], 0x22
jne 0x1005b1c
jmp 0x1005b1b
cmp al, 0x20
jle 0x1005b1c
inc esi
cmp byte [esi], 0x20
jg 0x1005b0f
jmp 0x1005b1c
cmp al, 0x20
jg 0x1005b22
inc esi
mov al, byte [esi]
test al, al
jne 0x1005b17
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1005b3c
movzx eax, word [ebp - 0x14]
jmp 0x1005b3f
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x1005c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005c63
xor eax, eax
jmp 0x1005c6b
shr eax, 4
not eax
and eax, 1
ret 4