joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419347
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
jne 0x41935d
xor bl, bl
jmp 0x41947a
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
mov word [ebp - 0x12], 0x7482
lea esi, [ebp - 0x18]
mov word [ebp - 0x18], 0xb809
mov word [ebp - 0x15], 0x6bc6
mov byte [ebp - 0x13], 0xfb
mov byte [ebp - 0x16], 0x49
call dword [sym.imp.system.dll_public:_static_class_Ref_class_String____cdecl_String::create_void_]
mov bl, 0x64
mov bh, 0x6d
pop ecx
mov byte [ebp - 8], bl
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push dword [ebp - 8]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 4]
call fcn.004131e1
lea ecx, [ebp - 0x10]
call fcn.00401d8a
add bh, bl
inc esi
mov bl, byte [esi]
xor bl, bh
mov byte [ebp - 8], bl
jne 0x419390
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
call fcn.004131e1
lea ecx, [ebp - 4]
call fcn.00401d8a
and dword [ebp - 8], 0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], 0x9448d827
mov dword [ebp - 0x18], 0xae1869cd
call fcn.0041e10c
push eax
lea ecx, [ebp - 8]
call fcn.004131e1
lea ecx, [ebp - 0x10]
call fcn.00401d8a
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [eax], edi
test edi, edi
je 0x41941d
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 8]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x419439
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, ebx
call dword [eax + 4]
lea ecx, [ebp - 0x10]
cmp dword [eax], 0
setne bl
call fcn.00401d8a
test esi, esi
je 0x419466
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, esi
mov eax, dword [ecx]
call dword [eax + 8]
test edi, edi
je 0x41947a
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
add ecx, 4
add ecx, edi
mov edx, dword [ecx]
call dword [edx + 8]
lea ecx, [ebp + 8]
call fcn.00401d8a
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x4261af
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x426237
xor ecx, ecx
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0x48], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x40], 0x137e2179
mov dword [eax + 0x44], 0x5be0cd19
xor eax, eax
pop ebp
ret
push 0xb1
mov ecx, str.md___NULL
call fcn.0042bf31
int3
Function at 0x427e5a
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x427eaa
xor ecx, ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
push 0xd0
mov ecx, str.md___NULL
call fcn.0042bf31
int3
Function at 0x42851a
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x428555
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret
push 0xa7
mov ecx, str.md___NULL
call fcn.0042bf31
int3

Function at 0x428e0f
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x428e43
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret
push 0xeb
mov ecx, str.md___NULL
call fcn.0042bf31
int3
Function at 0x43248c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.lib.stdc.dll_fopen]
mov ebx, edx
push 0x454bdc
push str._dev_urandom
mov dword [ebp - 4], ecx
call edi
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4324c6
push 0x454bdc
push str._dev_random
call edi
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4324f6
xor edi, edi
push edi
push 3
push edi
push esi
call dword [sym.imp.lib.stdc.dll_setvbuf]
add esp, 0x10
test eax, eax
jne 0x4324ec
push esi
push ebx
push 1
push dword [ebp - 4]
call dword [sym.imp.lib.stdc.dll_fread]
add esp, 0x10
mov edi, eax
push esi
call dword [sym.imp.lib.stdc.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4324fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [sym.imp.lib.stdc.dll_clockTicks]
push edi
mov edi, edx
mov dword [ebp - 0x10], ecx
call esi
cmp eax, 0x64
jl 0x4325b3
call esi
cmp eax, 0x2710
jg 0x4325b3
and dword [ebp - 8], 0
mov eax, edi
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
test edi, edi
je 0x4325b5
mov esi, dword [sym.imp.lib.stdc.dll_clock]
push ebx
dec edi
xor ebx, ebx
push 8
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 4]
pop eax
mov dword [ebp - 0xc], ebx
dec eax
mov dword [ebp - 0x18], eax
call esi
mov dword [ebp - 0x14], eax
call esi
mov ebx, dword [ebp - 0x14]
cmp ebx, eax
jne 0x43256b
xor edi, 1
call esi
cmp ebx, eax
je 0x43255f
mov dword [ebp - 4], edi
call esi
mov ebx, eax
call esi
cmp ebx, eax
jne 0x432587
mov edi, dword [ebp - 8]
xor edi, 1
call esi
cmp ebx, eax
je 0x432578
mov dword [ebp - 8], edi
mov edi, dword [ebp - 4]
cmp edi, dword [ebp - 8]
je 0x432551
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add ebx, ebx
or ebx, edi
mov dword [ebp - 0xc], ebx
test eax, eax
jne 0x43254d
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
mov byte [eax], bl
inc eax
mov dword [ebp - 0x10], eax
test edi, edi
jne 0x43253e
mov eax, dword [ebp - 0x20]
pop ebx
jmp 0x4325b5
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x433606
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10c0
call fcn.0043dbd0
push esi
push edi
mov esi, 0x450e44
mov eax, 0x10a0
lea ecx, [esp + 0x28]
mov byte [ecx], 0
inc ecx
sub eax, 1
jne 0x433626
lea eax, [esp + 0x28]
push eax
push 0
push dword [esi - 4]
push esi
call fcn.004325f2
add esp, 0x10
test eax, eax
jne 0x43370a
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xc]
push eax
lea edi, [esi + 0x20]
push edi
call fcn.00432aee
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00433046
add esp, 0x18
lea edx, [esp + 8]
xor ecx, ecx
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4 + 0x30]
jne 0x433707
inc ecx
cmp ecx, 4
jne 0x43367a
lea edx, [esp + 0x18]
xor ecx, ecx
mov eax, dword [edx + ecx*4]
cmp eax, dword [edi + ecx*4]
jne 0x433707
inc ecx
cmp ecx, 4
jne 0x433693
xor eax, eax
lea edi, [esp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x3e8
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xc]
push eax
push eax
call fcn.00432aee
add esp, 0xc
sub edi, 1
jne 0x4336b0
mov edi, 0x3e8
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xc]
push eax
push eax
call fcn.00433046
add esp, 0xc
sub edi, 1
jne 0x4336cd
xor eax, eax
cmp byte [esp + eax + 8], 0
jne 0x433707
inc eax
cmp eax, 0x10
jl 0x4336e7
add esi, 0x44
cmp esi, 0x450f10
jl 0x43361d
xor eax, eax
jmp 0x43370a
push 5
pop eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43a181
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [0x46c03c], 0
lea eax, [ebp - 4]
push ebx
push esi
push eax
mov word [ebp - 0x19], 0xce54
lea esi, [ebp - 0x28]
mov dword [ebp - 0x14], 0x8947c23b
mov dword [ebp - 0x20], 0xd0ffc57e
mov dword [ebp - 0x28], 0x90224196
mov dword [ebp - 0x10], 0x11c955b1
mov dword [ebp - 0x24], 0xade8105d
mov word [ebp - 0x16], 0x861b
mov word [ebp - 0x1c], 0xd75d
mov byte [ebp - 0x17], 0x67
mov byte [ebp - 0x1a], 0x74
call dword [sym.imp.system.dll_public:_static_class_Ref_class_String____cdecl_String::create_void_]
mov bl, 0x53
mov bh, 0xc5
pop ecx
mov byte [ebp - 8], bl
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push dword [ebp - 8]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 4]
call fcn.004131e1
lea ecx, [ebp - 0xc]
call fcn.00401d8a
add bh, bl
inc esi
mov bl, byte [esi]
xor bl, bh
mov byte [ebp - 8], bl
jne 0x43a1e2
lea eax, [ebp - 4]
mov esi, 0x46c03c
push eax
mov ecx, esi
call fcn.004131e1
lea ecx, [ebp - 4]
call fcn.00401d8a
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ba0
Capabilities:
Delete network filter via wfp api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push 0
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
call dword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
test eax, eax
je 0x401c03
push eax
push str.____FwpmEngineOpen0_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
push edi
push dword [ebp - 0x18]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterDeleteById0]
test eax, eax
jne 0x401c29
push esi
push edi
push str.Deleted_filter_id:__llu._n
call fcn.00401010
add esp, 0xc
jmp 0x401c4f
cmp eax, 0x80320003
jne 0x401c3f
push str.____The_filter_does_not_exist._n
call fcn.00401010
add esp, 4
jmp 0x401c4f
push eax
push esi
push edi
push str.____Failed_to_delete_filter_id:__llu_with_error_code:_0x_x._n
call fcn.00401010
add esp, 0x10
lea edx, [ebp - 0x14]
call fcn.00402540
test eax, eax
je 0x401c90
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.fwpuclnt.dll_FwpmProviderDeleteByKey0]
test eax, eax
je 0x401c83
cmp eax, 0x8032000a
je 0x401c90
push eax
push str.____FwpmProviderDeleteByKey0_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
jmp 0x401c90
push str.Deleted_custom_WFP_provider._n
call fcn.00401010
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004026a0
mov esp, ebp
pop ebp
ret
Function at 0x402180
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push 0x28
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40222f
call esi
cmp eax, 0x3f0
je 0x4021f7
call esi
push eax
push str.____OpenThreadToken_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40222f
call esi
push eax
push str.____OpenProcessToken_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x40226e
call esi
push eax
push str.____LookupPrivilegeValueA_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40229f
call esi
push eax
push str.____AdjustTokenPrivileges_failed_with_error_code:_0x_x._n
jmp 0x40224c
call esi
cmp eax, 0x514
jne 0x4022b7
push str.____Failed_to_get_SeDebugPrivilege._You_might_not_be_able_to_get_the_process_handle_of_the_EDR_process._n
call fcn.00401010
add esp, 4
jmp 0x402254
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004026a0
mov esp, ebp
pop ebp
ret
Function at 0x402330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x40241f
test ebx, ebx
je 0x40241f
push ecx
lea edx, [ebp - 0x18]
call fcn.004022e0
add esp, 4
test eax, eax
jne 0x40237e
pop esi
mov eax, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x4023ad
pop esi
mov eax, 5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4023b3
sub ecx, edx
sar ecx, 1
push edi
lea eax, [esi + ecx*2]
push eax
lea eax, [ebp - 0x220]
push eax
push str._S_S
push 0x208
push ebx
call fcn.00401fa0
xor edi, edi
add esp, 0x14
cmp word [ebx], di
je 0x40240c
mov esi, ebx
nop word [eax + eax]
movzx eax, word [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
mov word [esi], ax
lea edi, [edi + 1]
lea esi, [ebx + edi*2]
add esp, 4
cmp word [esi], 0
jne 0x4023f0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 3
pop esi
xor ecx, ebp
pop ebx
call fcn.004026a0
mov esp, ebp
pop ebp
ret

Function at 0x402440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x402523
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402523
push ecx
lea edx, [ebp - 0x20c]
mov ecx, esi
call fcn.00402330
add esp, 4
test eax, eax
jne 0x402528
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 8
call esi
mov edx, eax
add esp, 4
mov dword [edi], edx
test edx, edx
je 0x4024ea
lea ecx, [ebp - 0x20c]
push ebx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4024b0
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [edx], eax
mov eax, dword [edi]
push dword [eax]
call esi
mov ecx, dword [edi]
add esp, 4
mov dword [ecx + 4], eax
mov eax, dword [edi]
pop ebx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4024ff
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004026a0
mov esp, ebp
pop ebp
ret
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10007fbe
pop dword [ebp - 0xc]
mov eax, 0x10007fbe
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xdfeacf80
add dword [ebp - 0x1c], 0x6e6775cb
mov dword [ebp - 0x18], 0x10b65b3
add dword [ebp - 0x18], 0x3127e692
mov dword [ebp - 0x14], 0x1e2dbb3e
sub dword [ebp - 0x14], 0xd1e17710
mov dword [ebp - 0x10], 0xa06f43de
sub dword [ebp - 0x10], 0xa06f43de
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x31983af8
sub eax, 0x21967a78
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xfbae1e3b
sub dword [ebp - 0x1c], 0x873bb4e5
mov dword [ebp - 0x18], 0x3ddec5af
add dword [ebp - 0x18], 0x38d9bc6
mov dword [ebp - 0x14], 0x8d698010
sub dword [ebp - 0x14], 0x29fa13a4
mov dword [ebp - 0x10], 0x41cca4cf
add dword [ebp - 0x10], 0xbe335b31
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x205f8d19
sub eax, 0x105dcd19
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x33643
push 0
call eax
mov ecx, 0xf4795016
sub ecx, 0xf4791882
xor esi, esi
add esi, eax
mov edx, 0xddb2654e
add edx, 0x325002b2
add edx, dword [ebp - 0xc]
mov edi, 0x5a715496
add edi, 0xb4b1d716
mov ebx, dword [edx]
sub dword [ebp - 4], ecx
xor ebx, edi
mov dword [ebp - 8], 0xd47684e7
mov dword [esi], ebx
xor dword [ebp - 8], 0xfe704cba
add esi, 4
add edx, 0xa82a268b
sub edx, 0xa82a2687
loop 0x100080dd
add eax, 0xadd0181a
sub eax, 0xadcf46f7
mov ebx, eax
add eax, 0x360f144f
sub eax, 0x360f144a
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_394
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_105
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x403ce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x403d12
jl 0x403d05
test ecx, ecx
jne 0x403d12
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x403dd2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00405380
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x403d7e
jg 0x403d3d
test esi, esi
je 0x403d7e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x403d55
mov eax, dword [esp + 0x10]
jl 0x403d4f
cmp eax, esi
jae 0x403d55
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0040a7f0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x403d9f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x403dbb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x403d24
jl 0x403dbb
test ecx, ecx
jne 0x403d24
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x403e16
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x403e16
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0040a7f0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x403e87
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x403e3c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x403e72
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0040ee95
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x403e87
cmp edi, eax
ja 0x403e50
test edi, edi
je 0x403e87
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0040ee95
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc