joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049481
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100494fa
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x100494cc
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax]
jge 0x100494f8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
and dword [ecx + eax], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x100494c5
jmp 0x1004951d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1004951d
push 0x1e34
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x10079f45
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008438c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006ad4c
mov dword [ebp - 0x14], eax
cmp dword [0x107345e4], esi
jne 0x1007a038
push 0x800
push esi
push 0x100080ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10079fc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007a118
push esi
push esi
push 0x100080ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007a118
push 0x10008104
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007a118
push eax
call ebx
push 0x10008110
push edi
mov dword [0x107345e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008120
push edi
mov dword [0x107345e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008134
push edi
mov dword [0x107345ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x107345f4], eax
test eax, eax
je 0x1007a035
push 0x10008150
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x107345f0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007a05d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007a050
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007a072
push 4
pop eax
jmp 0x1007a11a
cmp dword [ebp - 0x14], esi
je 0x1007a072
push dword [0x107345e4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007a057
mov eax, dword [0x107345f0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007a0d0
cmp dword [0x107345f4], edi
je 0x1007a0d0
push eax
call ebx
push dword [0x107345f4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007a0d0
test eax, eax
je 0x1007a0d0
call ecx
test eax, eax
je 0x1007a0c5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007a0c5
test byte [ebp - 8], 1
jne 0x1007a0d0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007a100
mov eax, dword [0x107345e8]
cmp eax, edi
je 0x1007a0fd
push eax
call ebx
test eax, eax
je 0x1007a0fd
call eax
mov esi, eax
test esi, esi
je 0x1007a0fd
mov eax, dword [0x107345ec]
cmp eax, edi
je 0x1007a0fd
push eax
call ebx
test eax, eax
je 0x1007a0fd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x107345e4]
call ebx
test eax, eax
je 0x1007a118
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007a11a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x103eaa98
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
add edx, 0xc
cmp dword [ebp - 8], edx
je 0x103eab4a
cmp dword [ebp - 8], 0
je 0x103eab4a
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
cmp ecx, dword [edx]
jne 0x103eab3d
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
jmp 0x103eab4a
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 8], eax
jmp 0x103eaabd
mov esp, ebp
pop ebp
ret
Function at 0x1040df78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1013f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x1040df9f
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1040dfa6
mov al, 1
jmp 0x1040e091
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x40], edx
call fcn.103e5f18
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x2c]
call dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
call fcn.103e5f18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.103e5e98
add esp, 8
movzx eax, al
test eax, eax
je 0x1040dfec
xor al, al
jmp 0x1040e091
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.1040e658
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x1040e02e
cmp dword [ebp - 0x30], 1
je 0x1040e035
cmp dword [ebp - 0x30], 3
je 0x1040e084
jmp 0x1040e08f
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x1040e064
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x34]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.10499489
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x1040e064
xor al, al
jmp 0x1040e091
mov edx, dword [ebp - 0x2c]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x1040e078
mov dword [ebp - 0x38], 1
jmp 0x1040e07f
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x1040e091
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x1040e091
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1047bb88
mov esp, ebp
pop ebp
ret

Function at 0x1042b8d8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x100ea078
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1042b939
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x1042b8f3
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1042b948
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0x100ea078
cmp dword [ebp + 0xc], 0
je 0x1042b9fb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x1042b9f9
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 3]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 0x23
jne 0x1042b9d6
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x1042b9d6
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x1042b9d6
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 2]
xor ecx, edx
mov edx, dword [ebp - 0x10]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0xc], eax
jmp 0x1042b973
jmp 0x1042ba70
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 4]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x1042ba70
movzx edx, byte [ebp - 1]
cmp edx, 0x23
jne 0x1042ba51
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x1042ba51
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x1042ba51
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 8
mov eax, dword [ebp - 0xc]
and eax, 0xff
movzx ecx, byte [ebp - 1]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
jmp 0x1042b9fb
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1042bb88
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 0
je 0x1042bb9d
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1042ba88
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1042bbbd
xor eax, eax
jmp 0x1042bcaa
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1049e84e
add esp, 0xc
test eax, eax
jne 0x1042bbfa
mov ecx, dword [ebp - 4]
push ecx
call fcn.1049eeea
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x1042bbfa
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1049e84e
add esp, 0xc
test eax, eax
je 0x1042bc0d
mov eax, dword [ebp - 4]
push eax
call fcn.1049dd16
add esp, 4
xor eax, eax
jmp 0x1042bcaa
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp + 0x14]
push edx
call fcn.1042f628
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1042bc3b
mov eax, dword [ebp - 4]
push eax
call fcn.1049dd16
add esp, 4
xor eax, eax
jmp 0x1042bcaa
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call fcn.1049e4d1
add esp, 0x10
cmp eax, dword [ebp - 8]
je 0x1042bc72
mov ecx, dword [ebp - 4]
push ecx
call fcn.1049dd16
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.1042f678
add esp, 4
xor eax, eax
jmp 0x1042bcaa
cmp dword [ebp + 0x14], 0
jle 0x1042bc8d
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
push ecx
call fcn.10493b48
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.1049dd16
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x1042bca7
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10441ca8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1018e538]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
xorps xmm0, xmm0
movss dword [ecx + 0x2c40], xmm0
cmp dword [ebp + 8], 0
jne 0x10441ccc
jmp 0x10441d20
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
call fcn.10441d28
add esp, 4
mov dword [ebp - 0x10], eax
push 0x100ea930
mov eax, dword [ebp + 8]
push eax
call fcn.1042ba88
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10441cfe
jmp 0x10441d20
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0x10]
push eax
call fcn.10499489
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.1049dd16
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x10451e28
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d8621
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1013f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.10427bb8
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.10427bb8
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.104424e8
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.104424e8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.104424e8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c], 0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x1c]
call fcn.10402208
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x24]
call fcn.10402208
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], edx
mov dword [ebp - 0x14], 0
jmp 0x10451f4e
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
jge 0x10451f64
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [eax + edx*4 + 0x58], 0xffffffff
jmp 0x10451f45
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x104aaa3d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.104aa8b3

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3d51e89
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x30c47b4c
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x72883460
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0x7299f330]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
mov ebp, dword [esp + 0xb8]
push esi
mov esi, dword [esp + 0xb4]
cmp dword [esi + 0x318], 0
push edi
je case.default.0x728834c0
test eax, eax
je case.default.0x728834c0
mov eax, dword [eax + 0x9c]
test eax, eax
je case.default.0x728834c0
lea edx, [ebx - 1]
mov ecx, str.Data
cmp edx, 3
ja case.default.0x728834c0
jmp dword [edx*4 + 0x728835dc]
mov ecx, str.Header
mov edx, str.from
jmp 0x728834dd
mov ecx, str.Header
mov edx, 0x7295dfac
push eax
push edx
push ecx
push str.__s__s__s_
lea eax, [esp + 0x20]
push 0xa0
push eax
call fcn.72887630
lea eax, [esp + 0x28]
add esp, 0x18
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x72883500
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1e8]
test eax, eax
je 0x72883555
mov ecx, dword [esi + 0x174]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x728835c0
mov eax, dword [esi + 0x1e8]
test eax, eax
je 0x72883583
mov ecx, dword [esi + 0x174]
mov edx, dword [esp + 0xc4]
push ecx
push edx
push ebp
push ebx
push esi
call eax
add esp, 0x14
jmp 0x728835c0
mov eax, dword [esi + 0x170]
push eax
push 1
push 2
push 0x7295df88
call fcn.728b013f
mov ecx, dword [esi + 0x170]
push ecx
push 1
lea edx, [esp + 0x28]
push edi
push edx
call fcn.728b013f
add esp, 0x20
jmp case.default.0x728834c0
test ebx, ebx
jl 0x728835be
cmp ebx, 2
jg 0x728835be
mov eax, dword [esi + 0x170]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0x7295df88]
push 2
push ecx
call fcn.728b013f
mov edx, dword [esi + 0x170]
mov eax, dword [esp + 0xd4]
push edx
push 1
push eax
push ebp
call fcn.728b013f
add esp, 0x20
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.728ad351
add esp, 0xa4
ret

Function at 0x72888d00
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x72888d0f
jmp dword [ecx*4 + 0x72888d64]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
Function at 0x728abdc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x7299f028]
mov edi, eax
add esp, 4
test edi, edi
jne 0x728abde5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x728abe2c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x728abe30
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x728abe8e
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x728abe53
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x728abed1
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x72965d6f
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x72965d70
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x728abea0
mov eax, edi
pop edi
pop esi
pop ecx
ret