joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d6b40
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x8204cc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x5d6b53
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5d6b94
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x820574]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x5d6bc6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5d6bca
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x5d6bbb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5d6be8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5d6bec
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5d6bdd
xor ecx, ecx
mov eax, 0x8204dc
xor ebx, ebx
mov bl, byte [ecx + 0x820584]
cmp byte [esp + ebx + 0x14], 0
je 0x5d6c17
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x82059c]
cmp byte [esp + ebx + 0x14], 0
je 0x5d6c2e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x5d6bfe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5d6b87
lea edx, [esp + 0x84]
push edx
call fcn.005d6c70
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x87ac10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x87ad1c
test eax, eax
je 0x87ad1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x895fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x87ad03
lea edi, [eax + 4]
jmp 0x87ac67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x87ac7c
mov dword [ebp - 4], 2
jmp 0x87ac9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x87ac93
mov dword [ebp - 4], 1
jmp 0x87ac9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x87ad13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x87acd6
mov byte [ecx], 0x3d
jmp 0x87ace2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x87aced
mov byte [ecx], 0x3d
jmp 0x87acf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x87ac64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xcf0968
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0xc1bbf9
nop
jmp 0x96f880
nop
jmp 0x1052d56
nop
jmp 0x87b7e7
nop
nop
jmp 0xae8e6b
mov dword [0x826cac], 1
nop
nop
jmp 0x94aa9f
mov edx, 5
mov dh, 0x75
bswap edx
mov edx, 4
cwd
mov edx, 2
cmovno edx, ecx
bswap dx
cdq
mov edx, 5
mov edx, 5
pop edx
jmp 0x10fe345
nop
jmp 0x1053a61
nop
jmp 0xd8cb17
mov dword [0x826cb4], eax
jmp 0x98153f
nop
jmp 0xb7cbc9
nop
jmp 0xc8cc0b
nop
jmp 0xaebf48
test ebx, ebx
jmp 0xccb08f
nop
nop
jmp 0x10802d7
nop
jmp 0xd45ea1
nop
jmp 0xc5b4f2
nop
jmp 0xd665a1
nop
nop
nop
jmp 0xe1d78b
nop
nop
nop
jmp 0xb9a7d1
nop
jmp 0xac45d3
nop
jmp 0x9dae0f
nop
jmp 0xecee22
nop
nop
nop
jmp 0x105ee52
push eax
call fcn.004962f9
pop ecx
mov edi, ebp
cmovae ebx, edi
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
ror ebx, 0xb0
sub bx, si
add ebx, 0x4e527140
mov ebx, dword [0x826cb4]
jmp 0xa9d388
nop
nop
jmp 0xe7098d
nop
jmp 0xa915dd
je 0xf88139
push ebx
jmp 0xf8812d
push edx
cmove edx, ebp
mov edx, 1
mov edx, 2
mov dl, bl
mov edx, 4
mov edx, 2
mov dx, 0x6e55
jmp 0x991be4
call fcn.00401004
inc eax
jmp 0xc393d6
push ebp
bswap bp
jmp 0x110b315
nop
jmp 0xa3c25c
nop
nop
nop
jmp 0x10a9cfc
pushal
jmp 0xdf9911
nop
jmp 0x45e221
nop
jmp 0xafa950
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, esi
cdq
not bp
mov eax, 2
not bp
movsx bx, bh
lahf
mov eax, 5
cwde
mov eax, 4
mov eax, 2
cdq
movzx ebp, bx
lahf
mov eax, 5
xchg ch, ch
mov eax, 6
not di
cmovns dx, dx
popal
jmp 0xccf379
nop
nop
jmp 0xac8c36
nop
jmp 0xdf29db
nop
jmp 0xa8b266
je 0xc393e7
push eax
mov ebx, eax
jmp 0xcd1a1c
call fcn.004962ff
add esp, 4
movsx ax, al
pop eax
jmp 0xa30773
nop
nop
jmp 0xaafc33
nop
jmp 0x9c7fba
nop
jmp 0xbbdca8
nop
jmp 0x1040831
nop
jmp 0x90129d
nop
jmp 0x8d6502
fninit
mov eax, dword [ebp + 8]
cmc
mov ebx, 0x2cfb2e6e
mov dword [0x826cb0], eax
seta ah
mov ebx, dword [ebp + 0xc]
btc ax, 0x13
sbb eax, edi
sal ah, cl
mov eax, dword [ebx]
test dx, 0x2801
stc
test eax, eax
jmp 0xf7de7e
mov ebp, esp
jmp 0xd3fa7e

Function at 0xd1d87e
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0xe804fa
jmp 0xc8d63a
nop
jmp 0xb3104d
jmp loc.0046db5e
nop
jmp 0xdd282e
nop
jmp 0x9e79ad
nop
jmp 0x10671d6
push ebp
mov ebp, esp
jmp 0xff66e8
pushal
bswap edi
cwde
mov eax, 1
mov eax, 2
mov eax, 4
mov al, 0x89
mov eax, 2
cdq
mov eax, 5
movsx bx, bl
mov eax, 4
setns al
mov eax, 2
cbw
mov eax, 5
movzx edi, ax
mov dx, 0x4c20
mov eax, 6
popal
seta ch
push edx
movzx ax, cl
not cx
bswap ecx
mov edx, 1
mov edx, 2
movsx ecx, sp
mov edx, 4
cwd
mov edx, 2
bswap edx
mov edx, 5
movsx edx, bx
mov edx, 4
jmp 0xdd63af
nop
nop
nop
jmp 0xedb422
mov edx, 2
cwde
mov edx, 5
cmovge cx, ax
lahf
mov edx, 5
movzx dx, dh
cmova dx, si
pop edx
movzx ax, cl
setnp ah
mov eax, dword fs:[0x30]
bswap ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
jmp 0xf8bf55
nop
jmp 0xfcf5e5
nop
jmp 0x8c70f2
mov dword [ebp - 4], eax
cwde
mov eax, dword [ebp - 4]
jmp 0xadb65e
nop
jmp 0xd40114
sub esp, 4
jmp 0x101b385
mov dword [ebp - 4], 0
jmp 0x8c93e1
nop
jmp 0xc0f635
Function at 0xdab4b1
Capabilities:
Packed with generic packer

Disassembly:
nop
test ebp, edi
cmc
clc
nop
jmp 0xcbb3da
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0xdde5cf
mov edx, 4
cwd
rcl al, 0x48
mov edx, 2
test ebp, 0x140183c
mov edx, 5
bt eax, 0xeb
add dx, dx
mov edx, 5
pop edx
mov dword [ebp - 4], 0
bts eax, edx
sal ah, cl
mov dword [ebp - 8], 0
mov ah, 0x85
push ebx
push ecx
clc
shr ah, 0xb3
push edx
mov eax, reloc.oleaut32.dll_SysStringLen
cpuid
movzx bx, al
rcr dx, 0x1a
cwd
shr ecx, 0x10
sub ebx, 0x77b23b3c
ror ah, cl
btc ebx, ecx
mov dword [ebp - 4], ecx
bt ax, 0x5b
clc
bt ebx, ebp
pop edx
shl bx, cl
rol ah, cl
movsx eax, si
pop ecx
shrd bx, si, 0xf9
rol ax, 0xa3
pop ebx
cwde
or eax, ebx
nop
rcl al, 0xb2
push ebx
sal ax, 0xf1
push ecx
btc ebx, ecx
push edx
sub ax, cx
ror ax, cl
sal cx, cl
mov eax, reloc.WS2_32.dll_getpeername
cpuid
and bh, 0xd9
inc ebx
shr edx, 0x18
dec bl
and bl, dl
movsx ebx, bx
shr ecx, 0x18
add edx, ecx
mov dword [ebp - 8], edx
movzx bx, bh
jmp 0x10960d6
call fcn.00496305
add esp, 0x10
mov bl, 0xe5
movsx ebx, sp
xchg ebx, ebx
mov dword [ebp - 0xc], eax
setae bh
cmovb bx, si
mov ebx, eax
push 0x80000301
movzx ebx, cx
push 0
push dword [ebp - 8]
cmovl bx, bx
movzx ebx, ax
push 1
not bl
mov ebx, 0x497df0
jmp 0xd99347
call fcn.00403749
lea esp, [esp + 8]
cmp esp, 0x29971eb2
xadd bl, bh
mov dword [ebp - 0x14], eax
rol bx, 0xb4
mov ebx, dword [ebp - 0xc]
cmp al, dh
cmp esp, 0x27d6755f
stc
test ebx, ebx
je 0xdd7a6a
push ebx
jmp 0xdd7a59
pushal
mov eax, 1
or dl, 0xa4
mov eax, 2
mov eax, 4
xor ch, 0xdc
mov eax, 2
movsx edi, sp
mov eax, 5
mov eax, 4
cmc
stc
mov eax, 2
add edi, ebp
sar edx, 0xfb
sub esi, 0x5dc75266
mov eax, 5
sbb di, bp
ror ebp, 0x39
mov eax, 6
or si, bx
popal
bswap eax
btr ax, cx
push edx
neg edx
mov edx, 1
adc dl, 0xa7
sar eax, cl
mov edx, 2
shr eax, cl
btr dx, si
adc eax, edi
mov edx, 4
lahf
mov edx, 2
bsr ax, sp
ror ah, 0x78
add ax, 0x389d
mov edx, 5
jmp 0x9d3303
call fcn.00496305
add esp, 0x10
mov dword [ebp - 0x10], eax
xchg ch, cl
push dword [ebp - 0x10]
movsx ecx, bx
movzx ecx, bp
push dword [ebp - 0xc]
mov cl, 0xd6
bswap cx
setbe cl
mov ecx, 2
jmp 0xc3cba1
push ebp
neg ebp
test bx, 0x73be
bt bp, 0x6a
mov ebp, esp
cmp edi, 0x6c3f7e8e
sub esp, 0x14
jmp 0x95d9ab
call fcn.004962ff
lea esp, [esp + 4]
ror bx, cl
movzx ebx, bp
xchg bh, bh
mov ebx, dword [ebp - 0x10]
cmc
cmp esp, ebx
test ebx, ebx
jmp 0xdf7e65
jmp 0xfb8f71
je 0xe22b90
push ebx
jmp 0xe22b86
call fcn.004962ff
add esp, 4
not eax
mov eax, dword [ebp - 0x14]
jmp 0x46d854
nop
nop
nop
clc
cmp ax, 0x1a5f
nop
cmp ebp, 0x63724b3d
test esp, ebp
nop
test dx, bp
nop
cmp ebp, ebx
nop
nop
nop
cmp ah, bh
nop
jmp 0x8dbfba
pop edx
movsx ecx, si
cmovl cx, cx
pop ecx
mov bl, dl
pop ebx
not bh
mov ebx, 0x41f03bc3
setle bl
push 0x80000301
movsx bx, ah
jmp 0x11085cb
push 0
push dword [ebp - 4]
xchg bl, bl
bswap ebx
not bl
push 1
cmovnp bx, bx
setns bl
movsx ebx, sp
mov ebx, 0x497df0
jmp 0xb2069b
Function at 0xdbe3e7
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
not al
pop eax
mov eax, dword [ebp - 4]
jmp 0x107e677
jmp 0xd6331c
mov dword [ebp - 4], 0
jmp 0xc30434
nop
nop
nop
stc
nop
nop
cmp ecx, 0x4fd47a99
nop
cmp ebx, esi
cmp di, 0x4994
jmp 0xe1a173
nop
stc
jmp 0xcc4296
push ebp
mov ebp, esp
clc
sub esp, 4
jmp 0xc77414
nop
cmc
cmp bh, 0xb6
clc
nop
test esp, 0x5fbf4815
nop
test esp, ebp
nop
test bp, dx
stc
nop
test ecx, esp
cmp si, 0x39db
pushal
rdtsc
add ecx, esp
mov eax, 1
rcr esi, 0xf0
cwde
not dx
mov eax, 2
shr edx, 0x96
mov eax, 4
dec eax
bsr dx, ax
mov eax, 2
rcl di, 0xe7
bt dx, 0x88
mov eax, 5
cwde
shld cx, cx, 0xad
mov eax, 4
mov eax, 2
sub bx, sp
mov eax, 5
xadd esi, ecx
ror bl, 0x22
mov eax, 6
sub di, ax
clc
popal
cmp si, 0xead
push edx
xor dx, bx
test bp, 0x6f6b
mov edx, 1
shr dl, cl
sub edx, 0x2ea841d9
mov edx, 2
btr dx, 0x9a
mov edx, 4
and dx, 0x69d8
mov edx, 2
rol edx, cl
add edx, esi
mov edx, 5
add dx, 0x5268
bsr dx, di
stc
mov edx, 4
mov edx, 2
bt dx, sp
bswap dx
bts edx, ebx
mov edx, 5
mov edx, 5
pop edx
cmp ecx, edi
clc
test ecx, 0x5ce41004
push eax
push ecx
sub eax, eax
mov ecx, dword [ebp + 0x10]
xchg al, al
mov al, byte [ecx + ebp + 7]
mov ecx, 0x2585588e
movsx ecx, si
mov dword [ebp - 4], eax
jmp 0xa36ce5
jmp loc.0046d172

Function at 0xefec81
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 4], eax
bswap dx
cwd
movzx bx, bl
pop edx
bswap ebx
mov bl, 6
push 0x80000301
push 0
movsx bx, bh
bswap ebx
push dword [ebp - 4]
movzx ebx, bx
push 1
mov ebx, 0x497250
jmp 0xfb8830
sub esp, 8
mov dword [ebp - 4], 0
jmp 0xf1cbee
nop
cmp edi, ebp
nop
cmc
nop
nop
nop
cmp sp, 0x419a
nop
cmp eax, 0x791a52a8
jmp 0xcecbd4
nop
stc
nop
nop
jmp 0xda0cd8
nop
test edi, 0x2588394e
nop
nop
pushal
mov eax, 1
mov eax, 2
shl al, cl
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
dec edi
mov eax, 2
sbb esi, 0x48905571
btc edx, ebx
mov eax, 5
shr cx, cl
mov eax, 6
rcr bl, 0xaf
cmp bp, ax
popal
push edx
shl edx, cl
sub edx, ebp
rol dl, 0x88
mov edx, 1
setno bh
mov edx, 2
inc edx
bsr bx, ax
btr ebx, edi
mov edx, 4
adc dl, 0x7d
mov edx, 2
mov edx, 5
mov edx, 4
test edi, 0x6d922a9d
cmp bp, si
btc eax, edx
mov edx, 2
adc dx, 0x4b74
mov edx, 5
stc
mov edx, 5
btc edx, esp
or dl, 0xcb
pop edx
shr ax, cl
not al
add eax, edx
push edx
rdtsc
sbb bx, 0x6e22
xor eax, eax
xchg al, bl
mov al, dh
setb dl
not bh
jmp 0xa64fc8
push ebp
shl ebp, 0x56
sub ebp, ebp
mov ebp, esp
jmp 0xb5a680
jmp 0xb9e130
call fcn.00496305
add esp, 0x10
jmp 0xfd3103
jmp loc.0046d6d8
Function at 0x10c9ff1
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 4], ebx
mov bl, cl
mov dword [ebp - 8], ebx
mov bl, dl
movsx dx, dh
mov dword [ebp - 0xc], ebx
pop ebx
cwd
not ecx
movzx ecx, bx
pop edx
xchg ecx, ebx
not bl
mov ebx, 0x6a120ce
pop ecx
movzx ebx, ax
movsx bx, ch
push 0x80000301
movsx ebx, dx
bswap bx
push 0
mov ebx, 0x39fa77f6
push dword [ebp - 4]
jmp 0x1053d30
push 0
not bx
mov bh, cl
push dword [ebp - 8]
movzx ebx, bp
movsx bx, bh
push 1
not bh
mov ebx, 0x497250
call fcn.00496305
add esp, 0x10
setp bl
not bh
mov bh, bl
push 0x80000101
movsx ebx, si
mov bl, ah
push 0
mov bx, 0x35f4
movzx ebx, sp
push eax
push 1
mov ebx, 0x497df0
jmp 0x957669
call fcn.00496305
add esp, 0x10
movzx bx, al
movsx ebx, di
mov dword [ebp - 0x1c], eax
cmovb ebx, edx
movsx ebx, bp
bswap bx
push 0x80000301
jmp 0xbf2909
call fcn.00496305
add esp, 0x10
setle cl
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
xchg ecx, ecx
jmp 0xefd206
call fcn.00496305
add esp, 0x10
mov bx, sp
seto bl
push 0x80000101
mov bx, 0x7d7
movsx bx, al
movzx ebx, si
push 0
cmovbe bx, dx
push eax
mov bx, 0x4ee8
cmovns ebx, ebp
movsx bx, al
push 1
mov ebx, 0x497df0
jmp 0xa9e0ad
push 0
movzx bx, cl
bswap ebx
seta bl
push dword [ebp - 0xc]
mov bl, 0x43
movsx ebx, ax
push 1
setle bl
mov ebx, 0x497250
jmp 0xb101e7
nop
cmp sp, si
stc
nop
test ebp, 0x37c259e3
clc
nop
cmc
test esi, edx
nop
stc
nop
cmc
nop
test bx, sp
cmc
nop
cmp ebx, 0x6b504323
pushal
btc eax, edx
sar bx, cl
mov eax, 1
mov eax, 2
movsx ecx, si
inc dh
ror ebx, 0xb9
mov eax, 4
neg ecx
jmp 0xc728c0
mov eax, 2
bsr di, bp
jmp 0xf92522
nop
test ecx, edi
stc
nop
test cl, 0xb5
nop
clc
cmp ax, 0x29e7
nop
stc
nop
jmp 0xc659c9
push 0
movsx ebx, di
cmovns ebx, ebx
push eax
push 1
mov ebx, 0x497df0
jmp 0xf949d2
jmp 0xd0f1cc
call fcn.00496305
add esp, 0x10
cmovns ebx, ebx
mov ebx, 0x7f8c46ed
push 0x80000101
jmp 0xdc8609
push dword [ebp - 0x1c]
xchg ch, cl
push dword [ebp - 0x14]
xchg cl, ch
mov ecx, 3
jmp loc.00466872
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0xfe5087
mov eax, 5
mov si, 0x5c76
mov eax, 4
btr bp, 0xee
not si
mov eax, 2
mov eax, 5
cbw
movzx esi, dx
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
cmp edi, edx
neg dh
mov edx, 4
mov edx, 2
shr al, cl
mov edx, 5
movsx edx, sp
mov edx, 4
bt edx, edi
mov edx, 2
mov edx, 5
rdtsc
bsf eax, esi
inc ax
mov edx, 5
pop edx
mov dword [ebp - 4], 0
adc al, 0xc7
bts eax, eax
or eax, esp
mov dword [ebp - 8], 0
cmc
neg ah
mov dword [ebp - 0xc], 0
push ecx
xor cx, 0x2a4e
push edx
push ebx
mov eax, 1
cpuid
sub ebx, ebx
not bl
mov bl, al
jmp 0x8fd7fc
call fcn.00496305
add esp, 0x10
mov dword [ebp - 0x14], eax
xchg bh, bh
cmovp ebx, edi
mov ebx, esp
push 0x80000301
mov bx, 0x19e3
jmp 0x904ebf
mov dword [ebp - 0xc], 0
jmp 0xe2bd00
push 1
cmovne bx, bp
mov ebx, 0x497250
jmp 0xeb7069
push ebp
cmc
mov ebp, esp
sub esp, 0x2c
jmp 0xf8c0a4

Function at 0x12161ab
Capabilities:
Encode data using xor

Disassembly:
push 0xee200f52
call fcn.011afa3d
aaa
rcr dl, 1
xchg ebp, eax
jecxz 0x1216216
lodsb al, byte [esi]
invalid
invalid
Function at 0x41944f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004192c0

Function at 0x419849
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00408030
mov eax, dword [0x47cd00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004172ab
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41988b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4199e7
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00407380
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47e8b8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041a840
mov ecx, dword [esi*4 + 0x47e8b8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4199e0
cmp eax, dword [edi + ecx + 0x24]
jne 0x4199e0
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4199e0
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041a840
add esp, 0x14
test edx, edx
jl 0x4199e0
jg 0x419956
test eax, eax
jb 0x4199e0
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4199e0
jl 0x419970
cmp dword [ebp - 0x1008], eax
ja 0x4199e0
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41998e
test ebx, ebx
je 0x4199c7
cmp ecx, edi
jae 0x4199c7
mov al, byte [ecx]
cmp al, 0xd
jne 0x4199a8
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4199b4
cmp byte [ecx + 1], 0xa
jne 0x4199b4
inc ecx
jmp 0x4199b4
movzx eax, al
movsx eax, byte [eax + 0x47cfc8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41998e
cmp edx, ebx
jne 0x41998e
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4199e5
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040736f
leave
ret
Function at 0x419cde
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x47e8b8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419d1e
cmp byte [ebx], 0xa
jne 0x419d1e
or byte [eax + edi + 0x28], 4
jmp 0x419d23
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x419e21
mov al, byte [edx]
cmp al, 0x1a
je 0x419e03
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x419d52
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x419d77
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x419d81
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x419d34
jmp 0x419e21
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419dfe
cmp dword [ebp - 0xc], 0
je 0x419dfe
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x47e8b8]
test byte [eax + edi + 0x28], 0x48
je 0x419dd8
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x419dc3
mov byte [esi], dl
jmp 0x419dd4
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x47e8b8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x419e21
cmp byte [ebp - 1], 0xa
jne 0x419de7
cmp esi, ebx
jne 0x419de7
mov byte [esi], 0xa
jmp 0x419e20
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041a85e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x419e21
mov byte [esi], 0xd
jmp 0x419e20
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x47e8b8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419e1d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419e21
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419e2a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x47e8b8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419e6d
cmp word [esi], dx
jne 0x419e6d
or byte [edi + eax + 0x28], 4
jmp 0x419e72
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x419fc5
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x419fa5
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x419eb4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x419eea
cmp eax, edx
jae 0x419ef6
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x419e8c
jmp 0x419fc5
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419fa1
cmp dword [ebp - 0x14], 0
je 0x419fa1
mov eax, dword [ebx*4 + 0x47e8b8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x419f79
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x419f42
mov word [esi], cx
jmp 0x419f75
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x47e8b8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x47e8b8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x47e8b8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x419fc5
pop ebx
cmp word [ebp - 4], bx
jne 0x419f8a
cmp esi, dword [ebp + 0xc]
jne 0x419f8a
mov word [esi], bx
jmp 0x419fc2
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041a85e
add esp, 0x10
cmp word [ebp - 4], bx
je 0x419fc5
push 0xd
jmp 0x419fbe
mov ecx, dword [ebx*4 + 0x47e8b8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419fbc
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419fc5
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret