joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418400
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], esi
push edi
test eax, eax
jle 0x418596
lea ebx, [edx + 0x18]
nop word [eax + eax]
mov edx, dword [ebx - 0x18]
test edx, edx
je 0x418587
mov ecx, esi
call fcn.00417e80
mov edi, eax
mov eax, dword [ebx - 0x14]
mov dword [ebp - 0x1c], edi
test eax, eax
je 0x41845e
push eax
lea ecx, [esi + 0x2fb8]
call fcn.00403590
mov ecx, eax
jmp 0x418460
xor ecx, ecx
mov dword [edi + 0x10], ecx
movsx eax, word [ebx]
movd xmm1, eax
movsx eax, word [ebx + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 0x2c], xmm1
movss dword [edi + 0x30], xmm0
movsx eax, word [ebx + 4]
movd xmm1, eax
movsx eax, word [ebx + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 0x34], xmm1
movss dword [edi + 0x38], xmm0
movsx eax, word [ebx + 8]
movd xmm1, eax
movsx eax, word [ebx + 0xa]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [edi + 0x90]
cvtdq2ps xmm0, xmm0
and eax, 0xfffffe49
or eax, 0x49
mov dword [edi + 0x90], eax
movss dword [edi + 0x3c], xmm1
movss dword [edi + 0x40], xmm0
test ecx, ecx
je 0x4184ee
cmp dword [ecx + 0x14], 0
jne 0x4184e5
mov dword [ecx + 0x14], edi
jmp 0x4184ee
cmp dword [ecx + 0x18], 0
jne 0x4184ee
mov dword [ecx + 0x18], edi
mov eax, dword [ebx - 0xc]
mov ecx, edi
mov dword [edi + 0x88], eax
movsx eax, byte [ebx - 8]
mov dword [edi + 0x44], eax
mov eax, dword [ebx - 4]
and eax, 0x61fc20
or dword [edi + 8], eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41851b
mov ecx, eax
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x418512
push dword [ecx]
lea eax, [ebp - 0x18]
push str.DockNode__02X
push 0x14
push eax
call fcn.00403100
mov al, byte [ebp - 0x18]
lea esi, [ebp - 0x17]
add esp, 0x10
or edx, 0xffffffff
test al, al
je 0x41856a
or edi, 0xffffffff
cmp al, 0x23
jne 0x41854e
cmp byte [esi], al
jne 0x41854e
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x460460]
test al, al
jne 0x418540
mov edi, dword [ebp - 0x1c]
mov ecx, dword [0x46e460]
not edx
push edx
lea ecx, [ecx + 0x1c30]
call fcn.00403590
mov esi, dword [ebp - 0x20]
mov dword [edi + 0x68], eax
mov eax, dword [ebp + 8]
add ebx, 0x24
sub eax, 1
mov dword [ebp + 8], eax
jne 0x418430
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d6d2
mov esp, ebp
pop ebp
ret
Function at 0x428ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x428b06
mov eax, dword [0x46e460]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x428af6
dec dword [eax + 0x374]
push ecx
call fcn.00444271
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x428b3a
mov eax, dword [0x46e460]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x428b2a
dec dword [eax + 0x374]
push ecx
call fcn.00444271
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x428b6e
mov eax, dword [0x46e460]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x428b5e
dec dword [eax + 0x374]
push ecx
call fcn.00444271
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x428bbe
mov eax, dword [0x46e460]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x428bae
dec dword [eax + 0x374]
push ecx
call fcn.00444271
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x428bf2
mov eax, dword [0x46e460]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x428be2
dec dword [eax + 0x374]
push ecx
call fcn.00444271
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x428c26
mov eax, dword [0x46e460]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x428c16
dec dword [eax + 0x374]
push ecx
call fcn.00444271
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042b3f0
Function at 0x438cb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, edx
je 0x438d21
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x438cf8
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x438cdf
cmp byte [esi], cl
jne 0x438cdf
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x460460]
test cl, cl
jne 0x438cd0
mov ecx, dword [0x46e460]
not eax
cmp dword [ecx + 0x1c84], eax
jne 0x438d0e
mov dword [ecx + 0x1c88], eax
cmp dword [ecx + 0x1cbc], eax
jne 0x438d66
pop edi
mov byte [ecx + 0x1cc0], 1
pop esi
pop ebp
ret
mov esi, dword [0x46e460]
xor edx, edx
mov eax, dword [esi + 0x1c48]
mov ecx, dword [eax + 0xfc]
mov eax, dword [eax + 0x104]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.00403140
add esp, 4
cmp dword [esi + 0x1c84], eax
jne 0x438d57
mov dword [esi + 0x1c88], eax
cmp dword [esi + 0x1cbc], eax
jne 0x438d66
mov byte [esi + 0x1cc0], 1
pop edi
pop esi
pop ebp
ret
Function at 0x43d270
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x468208
push 0x43edc0
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x46a040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
or edi, 0xffffffff
mov dword [ebp - 0x124], edi
xor esi, esi
mov dword [ebp - 0x128], esi
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 4], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
call fcn.0043d3b0
mov dword [ebp - 0x130], eax
push 0x104
lea eax, [ebp - 0x120]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x43d34c
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x124], edi
cmp edi, 0xffffffff
je 0x43d34c
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
mov dword [ebp - 0x128], esi
test esi, esi
je 0x43d34c
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 0x14]
add ecx, dword [eax + 0x10]
push ecx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0043d386
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043d6d2
mov esp, ebp
pop ebp
ret
Function at 0x43d520
Capabilities:
Encode data using xor
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x46a040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x464a40]
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
xor edi, edi
xor ecx, ecx
mov dword [ebp - 8], edi
movups xmmword [ebp - 0x30], xmm0
nop dword [eax]
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0xe
jb 0x43d550
mov byte [ebp - 0x21], 0
mov cl, 0x6e
mov dword [ebp - 0x20], 0x1c0b256e
xor eax, eax
mov dword [ebp - 0x1c], 0x5d020b00
mov dword [ebp - 0x18], 0x20a405c
mov word [ebp - 0x14], 2
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x43d58f
mov cl, byte [ebp - 0x20]
jmp 0x43d580
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x13], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x43d5cd
cmp dword [ebp - 8], edi
je 0x43d5cd
mov edi, dword fs:[0x30]
add edi, 0x1000
mov eax, dword [ebx + 0x18]
test dword [eax + 0x40], 0xfffffffd
jne 0x43d650
cmp dword [eax + 0x44], 0
jne 0x43d650
test edi, edi
je 0x43d6a3
mov eax, dword [edi + 0x30]
test dword [eax + 0x70], 0xfffffffd
jne 0x43d5fd
cmp dword [eax + 0x74], 0
je 0x43d6a3
movaps xmm0, xmmword [0x464a20]
mov dh, 0x37
mov cl, 0x58
mov byte [ebp - 9], 0
mov ch, 0x45
mov byte [ebp - 0x10], dh
mov al, 0x7b
mov byte [ebp - 9], 0
mov dl, 0x56
mov bl, 0x53
mov ah, 0x52
xor cl, dh
xor ch, dh
mov byte [ebp - 0xe], cl
xor al, dh
mov byte [ebp - 0xa], ch
xor dl, dh
mov byte [ebp - 0xf], al
xor bl, dh
mov byte [ebp - 0xd], dl
xor ah, dh
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], ah
xor ecx, ecx
movups xmmword [ebp - 0x30], xmm0
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0xe
jae 0x43d6b4
jmp 0x43d641
movaps xmm0, xmmword [0x464a30]
mov dh, 0x16
mov cl, 0x79
mov byte [ebp - 9], 0
mov ch, 0x64
mov byte [ebp - 0x10], dh
mov al, 0x5a
mov byte [ebp - 9], 0
mov dl, 0x77
mov bl, 0x72
mov ah, 0x73
xor cl, dh
xor ch, dh
mov byte [ebp - 0xe], cl
xor al, dh
mov byte [ebp - 0xa], ch
xor dl, dh
mov byte [ebp - 0xf], al
xor bl, dh
mov byte [ebp - 0xd], dl
xor ah, dh
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], ah
xor ecx, ecx
movups xmmword [ebp - 0x30], xmm0
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0xe
jb 0x43d694
jmp 0x43d6b4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d6d2
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0xf]
mov byte [ebp - 0x21], 0
push eax
lea eax, [ebp - 0x2f]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0044939f
int3
Function at 0x43e208
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43e247
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43e247
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43e247
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43e247
cmp dword [ecx + 0x74], 0xe
jbe 0x43e247
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x441002
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00456fd0
mov eax, dword [0x46a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0044aa12
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x441044
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4411a0
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00456f20
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x46df98]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0044ac21
mov ecx, dword [esi*4 + 0x46df98]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x441199
cmp eax, dword [ecx + edi + 0x24]
jne 0x441199
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x441199
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044ac21
add esp, 0x14
test edx, edx
jl 0x441199
jg 0x44110f
test eax, eax
jb 0x441199
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x441199
jl 0x441129
cmp dword [ebp - 0x1008], eax
ja 0x441199
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x441147
test ebx, ebx
je 0x441180
cmp ecx, edi
jae 0x441180
mov al, byte [ecx]
cmp al, 0xd
jne 0x441161
lea eax, [edi - 1]
cmp ecx, eax
jae 0x44116d
cmp byte [ecx + 1], 0xa
jne 0x44116d
inc ecx
jmp 0x44116d
movzx eax, al
movsx eax, byte [eax + 0x46a240]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x441147
cmp edx, ebx
jne 0x441147
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x44119e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043d6d2
leave
ret
Function at 0x44b2c6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x46df98]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44b306
cmp byte [ebx], 0xa
jne 0x44b306
or byte [edi + eax + 0x28], 4
jmp 0x44b30b
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x44b40a
mov dl, byte [eax]
cmp dl, 0x1a
je 0x44b3ed
inc eax
cmp dl, 0xd
je 0x44b337
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x44b35d
cmp eax, ecx
jae 0x44b36b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x44b31f
jmp 0x44b40a
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44b3e8
cmp dword [ebp - 0x10], 0
je 0x44b3e8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x46df98]
test byte [eax + edi + 0x28], 0x48
je 0x44b3c2
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x44b3ad
mov byte [esi], dl
jmp 0x44b3be
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x46df98]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x44b40a
cmp byte [ebp - 1], 0xa
jne 0x44b3d1
cmp esi, ebx
jne 0x44b3d1
mov byte [esi], 0xa
jmp 0x44b409
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044ac3f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x44b40a
mov byte [esi], 0xd
jmp 0x44b409
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x46df98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x44b407
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x44b40a
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x44b413
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x46df98]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44b459
cmp word [ebx], dx
jne 0x44b459
or byte [eax + edi + 0x28], 4
jmp 0x44b45e
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x44b5c1
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x44b5a1
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x44b49f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x44b4d5
cmp eax, edx
jae 0x44b4e3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x44b47a
jmp 0x44b5c1
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44b59c
cmp dword [ebp - 0x18], 0
je 0x44b59c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x46df98]
test byte [eax + edi + 0x28], 0x48
je 0x44b572
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x44b536
mov word [esi], cx
jmp 0x44b56d
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x46df98]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x46df98]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x46df98]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x44b5c1
pop eax
cmp word [ebp - 4], ax
jne 0x44b582
cmp esi, ebx
jne 0x44b582
mov word [esi], ax
jmp 0x44b5be
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0044ac3f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x44b5c1
push 0xd
pop eax
jmp 0x44b57d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x46df98]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x44b5bb
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x44b5c1
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x44c490
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45c7e8
push 0x45c7e0
push str.FlsAlloc
push 0x1f
call fcn.0044c3ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44c4c4
push dword [ebp + 8]
mov ecx, esi
call dword [0x45a258]
call esi
jmp 0x44c4ca
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44c50e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45c7f8
push 0x45c7f0
push str.FlsGetValue
push 0x21
call fcn.0044c3ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44c545
push dword [ebp + 8]
mov ecx, esi
call dword [0x45a258]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x44c54d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45c800
push 0x45c7f8
push str.FlsSetValue
push 0x22
call fcn.0044c3ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44c587
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x45a258]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x450807
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4508a4
push ebx
push esi
call fcn.004507d0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00450764
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x450851
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4508a3
push edi
push eax
call fcn.0044df58
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x450871
call fcn.0044c259
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4508a2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00450764
add esp, 0x20
test eax, eax
jne 0x450890
push edi
call fcn.0044c259
jmp 0x450898
push ebx
call fcn.0044c259
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x455085
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00455001
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4551f4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4551f4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4551a9
jg 0x4550e1
test eax, eax
je 0x45519f
push 1
push 0x1000
call fcn.0044c1fc
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x455104
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x455196
push 0x8000
push ebx
call fcn.0044a3fb
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x45512d
jg 0x455128
cmp ecx, 0x1000
jb 0x45512d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0044d246
add esp, 0x10
cmp eax, 0xffffffff
je 0x455172
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x455128
jl 0x455159
test ecx, ecx
jne 0x45511a
push dword [ebp - 0xc]
push ebx
call fcn.0044a3fb
push esi
call fcn.0044c259
add esp, 0xc
xor ebx, ebx
jmp 0x455202
cmp byte [edi + 0x24], 0
je 0x455189
cmp dword [edi + 0x20], 5
jne 0x455189
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x455194
mov ebx, dword [edi + 0x18]
jmp 0x455196
xor ebx, ebx
push esi
call fcn.0044c259
pop ecx
jmp 0x455202
test ecx, ecx
jg 0x45516b
jl 0x4551a9
test eax, eax
jae 0x45516b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044ac3f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4551c9
cmp byte [edi + 0x1c], 0
je 0x45516b
jmp 0x4551fa
push ebx
call fcn.0045109b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x45516b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x455202
cmp byte [edi + 0x1c], 0
je 0x4551ff
mov ebx, dword [edi + 0x18]
jmp 0x455202
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0044ac3f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x456e70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x456e9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x456e9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1002aaee
pop dword [ebp - 0x10]
mov eax, 0x93ca5ad8
sub eax, 0x83c7afea
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x7406e4ce
add dword [ebp - 0x20], 0xda4b607d
mov dword [ebp - 0x1c], 0x30cf7628
sub dword [ebp - 0x1c], 0xfe9c29e3
mov dword [ebp - 0x18], 0x6b64d39e
sub dword [ebp - 0x18], 0x1f188f70
mov dword [ebp - 0x14], 0x76b87ec6
sub dword [ebp - 0x14], 0x76b87ec6
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x255c8da9
add dword [ebp - 0x20], 0x4f15dbad
mov dword [ebp - 0x1c], 0xcc75cb57
add dword [ebp - 0x1c], 0x74f6961e
mov dword [ebp - 0x18], 0x6c4f87b8
sub dword [ebp - 0x18], 0x8e01b4c
mov dword [ebp - 0x14], 0xebf1ec6f
add dword [ebp - 0x14], 0x140e1391
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x366bc
push 0
call eax
mov ecx, 0x47d0
mov edx, eax
mov ebx, 0x85dc688d
add ebx, 0x8a272d73
add ebx, dword [ebp - 0x10]
mov edi, 0x43d2b887
xor dword [ebp - 4], esi
mov esi, dword [ebx]
add dword [ebp - 8], 0xd83575a2
xor esi, edi
add dword [ebp - 0xc], eax
mov dword [edx], esi
mov dword [ebp - 4], 0x65e48dfe
add edx, 0x2b1d9a72
sub edx, 0x2b1d9a6e
add ebx, 4
loop 0x1002abfa
add eax, 0xdcd6fa15
sub eax, 0xdcd5e802
mov ebx, eax
add eax, 0x721f692
add eax, 0xf8de0973
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret