joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5560a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
test edx, edx
jne 0x5560b1
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
not eax
cmp esi, 8
jb 0x55616d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
sub edi, 1
jne 0x5560c6
pop edi
test esi, esi
je 0x55618b
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x76e128]
sub esi, 1
jne 0x556171
not eax
pop esi
ret

Function at 0x558570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x55859d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x55859d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401309
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 4]
xor eax, eax
lock cmpxchg dword [0x6128a4], ebx
je 0x40115a
cmp ebx, eax
je 0x40115e
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
jmp 0x40113a
xor ebx, ebx
jmp 0x401163
mov ebx, 1
mov eax, dword [0x6128a8]
dec eax
jne 0x401179
mov dword [esp], 0x1f
call fcn.005add4b
jmp 0x4011ac
mov eax, dword [0x6128a8]
test eax, eax
jne 0x4011a2
mov dword [0x6128a8], 1
mov dword [esp + 4], 0x616014
mov dword [esp], 0x61600c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011ac
mov dword [0x610008], 1
mov eax, dword [0x6128a8]
dec eax
jne 0x4011d2
mov dword [esp + 4], 0x616008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x6128a8], 2
test ebx, ebx
jne 0x4011dc
xchg dword [0x6128a4], ebx
mov eax, dword [entry1]
test eax, eax
je 0x4011fd
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
mov dword [esp + 8], ebx
mov dword [esp], esi
call eax
sub esp, 0xc
call fcn.005a78fb
mov dword [esp], 0x5a7ba4
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push ecx
mov dword [0x6128e0], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call sub.api_ms_win_crt_runtime_l1_1_0.dll__fpreset
mov eax, dword [0x61001c]
mov dword [ebp - 0x1c], eax
lea eax, [eax*4 + 4]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov edx, dword [0x610018]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], ebx
jle 0x401281
mov eax, dword [edx + ebx*4]
mov dword [ebp - 0x28], edx
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea ecx, [eax + 1]
add ecx, ecx
mov dword [esp], ecx
mov dword [ebp - 0x24], ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov edi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [edi + ebx*4], eax
mov edi, eax
mov esi, dword [edx + ebx*4]
inc ebx
rep movsb byte es:[edi], byte [esi]
jmp 0x401248
mov edi, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x1c], 0
cmovns eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [edi + eax*4], edx
mov dword [0x610018], edi
call fcn.005a7655
mov eax, dword [0x610014]
mov edx, dword [0x5af754]
mov dword [edx], eax
mov dword [esp + 8], eax
mov eax, dword [0x610018]
mov dword [esp + 4], eax
mov eax, dword [0x61001c]
mov dword [esp], eax
call fcn.0040e0a4
cmp dword [0x61000c], 0
mov dword [0x610010], eax
jne 0x4012db
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
cmp dword [0x610008], 0
jne 0x4012e9
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x610010]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
xor eax, eax
mov dword [0x6128c8], eax
jmp 0x40111d
Function at 0x401882
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x43c
mov dword [ebp - 0x42c], eax
mov edi, edx
mov dword [ebp - 0x430], ecx
xor eax, eax
mov dword [ebp - 0x41c], eax
call fcn.0042f44e
mov esi, eax
xor edx, edx
mov dword [esp], edx
xor ecx, ecx
mov edx, dword [ebp - 0x42c]
call fcn.0042f4b2
mov ebx, eax
test eax, eax
je 0x4018ee
mov eax, esi
call fcn.0042f484
mov eax, ebx
call fcn.00427b4d
mov esi, eax
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Failed_to_parse_XML_file:__s_n
jmp 0x40194c
test esi, esi
je 0x401900
mov eax, dword [esi + 0xc]
xor edx, edx
call fcn.00425c8e
test eax, eax
jne 0x40190c
mov eax, esi
call fcn.0042f484
jmp 0x401a73
lea ecx, [ebp - 0x420]
lea edx, [ebp - 0x41c]
call fcn.0042fca7
mov ebx, eax
mov eax, esi
call fcn.0042f484
test ebx, ebx
je 0x401959
mov eax, ebx
call fcn.00427b4d
mov esi, eax
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Failed_to_parse_binary_sequence:__s_n
mov dword [esp], eax
call fcn.005adc24
jmp 0x401a73
cmp dword [ebp - 0x430], 0
je 0x401998
mov dword [esp], 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x420]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x401a65
test edi, edi
lea esi, [ebp - 0x418]
je 0x4019b0
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
jmp 0x4019d2
mov eax, dword [ebp - 0x42c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov dword [esp + 4], str..bin
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov edx, 0x5b9366
mov eax, esi
call fcn.00427968
mov edi, eax
test eax, eax
jne 0x401a0c
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Failed_to_open_file__s_n
mov dword [esp], eax
call fcn.005adc24
mov ebx, 0xfffffffd
jmp 0x401a65
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x420]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp eax, dword [ebp - 0x420]
je 0x401a5e
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Failed_to_write_output_to_file__s_n
mov dword [esp], eax
call fcn.005adc24
mov ebx, 0xfffffffd
mov eax, edi
call fcn.00425b84
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, ebx
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x3c], edx
lea edi, [ebp - 0x2c]
mov edx, edi
call fcn.004b854e
mov ebx, eax
test eax, eax
jne 0x401b7a
mov ecx, dword [ebp - 0x3c]
cmp ecx, 2
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
jne 0x401ad5
mov dword [esp], 1
call esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x401b0d
dec ecx
jne 0x401b0d
xor edx, edx
movzx ecx, byte [edi + edx]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
mov dword [esp], 1
call esi
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x5b93a4
mov dword [esp], eax
call fcn.005adc24
mov edx, dword [ebp - 0x40]
inc edx
cmp edx, 0x14
jne 0x401ada
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], str.File_hash__SHA_1_:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
xor esi, esi
movzx ecx, byte [edi + esi]
mov dword [ebp - 0x40], ecx
mov dword [esp], 2
mov edx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [ebp - 0x3c], edx
call edx
mov ecx, dword [ebp - 0x40]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x5b93a4
mov dword [esp], eax
call fcn.005adc24
inc esi
cmp esi, 0x14
mov edx, dword [ebp - 0x3c]
jne 0x401b28
mov dword [esp], 2
call edx
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov eax, ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x422f9d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
test eax, eax
jne 0x422fd2
cmp dword [0x5af030], 1
jbe 0x422fce
mov dword [0x611418], 2
xor ecx, ecx
mov dword [0x611414], ecx
mov dword [esp], str.gf_delete_file_deletes_nothing___ignoring_n
call fcn.004268ea
xor eax, eax
jmp 0x422fe5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edx
test eax, eax
jne 0x422fce
mov eax, 0xfffffffd
leave
ret

Function at 0x422fe7
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push edx
push edx
cmp eax, 1
sbb eax, eax
and eax, 0xfffffffd
leave
ret

Function at 0x423006
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x23c
mov dword [ebp - 0x22c], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_tmpfile
mov ebx, eax
test eax, eax
jne 0x4230e3
cmp dword [0x5af030], 2
jbe 0x423057
mov dword [0x611418], 3
xor eax, eax
mov dword [0x611414], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], eax
mov dword [esp], str._Win32__system_failure_for_tmpfile__:_0x_08x_n
call fcn.004268ea
mov dword [esp + 8], 0x104
lea esi, [ebp - 0x220]
mov dword [esp + 4], esi
mov dword [esp], str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
sub esp, 0xc
test eax, eax
je 0x4230e9
call fcn.00422f83
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov dword [esp + 8], eax
mov dword [esp + 4], str.gpac__08x_
lea edi, [ebp - 0x11c]
mov dword [esp], edi
call fcn.005ae188
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__tempnam
mov edi, eax
mov edx, 0x5cb88f
call fcn.00427968
mov esi, eax
test eax, eax
je 0x4230d5
dec dword [0x6116d8]
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], eax
mov dword [esp], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test esi, esi
je 0x4230e9
mov ebx, esi
inc dword [0x6116d8]
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4260b7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, eax
mov eax, dword [eax + 0x34]
test eax, eax
je 0x4260f7
mov edx, dword [ebx]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
xor edx, edx
add dword [ebx + 8], eax
adc dword [ebx + 0xc], edx
add dword [ebx + 0x10], eax
adc dword [ebx + 0x14], edx
xor eax, eax
mov dword [ebx + 0x34], eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x426155
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, edx
mov edx, dword [eax + 0x20]
test edx, 0xfffffffd
je 0x426269
mov ebx, eax
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x426181
cmp dword [eax], 0
je 0x426269
cmp edx, 1
je 0x42618b
cmp edx, 4
jne 0x4261f0
mov eax, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
cmp dword [ebx + 0x14], edi
jne 0x4261da
cmp dword [ebx + 0x10], eax
jne 0x4261da
cmp edi, 0
ja 0x426269
cmp edx, 4
jne 0x426269
add eax, eax
mov dword [esp + 4], eax
mov dword [esp], ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov ecx, eax
mov dword [ebx + 4], eax
test eax, eax
je 0x426269
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
add eax, eax
adc edx, edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
jmp 0x4261de
test ecx, ecx
je 0x4261e6
mov eax, dword [ebx + 0x10]
mov edx, esi
mov byte [ecx + eax], dl
add dword [ebx + 0x10], 1
adc dword [ebx + 0x14], 0
jmp 0x426269
cmp dword [ebx + 0x2c], 0
je 0x42622a
mov eax, dword [ebx + 0x30]
cmp dword [ebx + 0x34], eax
jne 0x426205
mov eax, ebx
call fcn.004260b7
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x34]
mov ecx, esi
mov byte [edx + eax], cl
mov eax, dword [ebx + 0x34]
inc eax
mov dword [ebx + 0x34], eax
cmp eax, dword [ebx + 0x30]
jne 0x426269
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004260b7
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, esi
movzx esi, al
mov dword [esp], esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
cmp edi, edx
jne 0x42625d
cmp esi, eax
jne 0x42625d
add esi, 1
adc edi, 0
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
add eax, 1
adc edx, 0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x426343
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, edx
movzx edx, dh
mov dword [ebp - 0xc], eax
call fcn.00426155
movzx edx, bl
mov eax, dword [ebp - 0xc]
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00426155

Function at 0x426367
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, eax
mov ebx, edx
shr edx, 0x10
movzx edx, dl
call fcn.00426155
movzx edx, bh
mov eax, esi
call fcn.00426155
movzx edx, bl
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.00426155
Function at 0x426392
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, eax
mov ebx, edx
shr edx, 0x18
call fcn.00426155
mov edx, ebx
shr edx, 0x10
movzx edx, dl
mov eax, esi
call fcn.00426155
movzx edx, bh
mov eax, esi
call fcn.00426155
movzx edx, bl
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.00426155

Function at 0x4263c9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov esi, edx
mov edx, ecx
mov dword [ebp - 0xc], eax
call fcn.00426392
mov edx, esi
mov eax, dword [ebp - 0xc]
add esp, 0x14
pop esi
pop ebp
jmp fcn.00426392

Function at 0x4268ea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [0x611414]
mov dword [esp + 8], eax
mov eax, dword [0x611418]
mov dword [esp + 4], eax
mov eax, dword [0x6113d8]
mov dword [esp], eax
call dword [0x5af008]
cmp dword [0x6113e0], 0
je 0x426948
cmp dword [0x611418], 1
jne 0x426948
cmp dword [0x611414], 0x12
je 0x426948
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
leave
ret

Function at 0x42755d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, eax
mov dword [ebp - 0x1c], edx
mov esi, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
add eax, esi
adc edx, edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x30]
cmp dword [ebx + 8], ecx
sbb eax, dword [ebp - 0x2c]
jb 0x4275c6
mov eax, ebx
call fcn.0042613b
test eax, eax
mov edx, dword [ebp - 0x20]
jne 0x4275b2
mov eax, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x427621
mov eax, dword [ebx + 0x20]
cmp eax, 3
ja 0x4275c1
cmp eax, 1
jbe 0x4275ca
jmp 0x4275e2
cmp eax, 4
je 0x4275ca
xor edx, edx
jmp 0x427645
add esi, dword [ebx + 4]
mov edi, dword [ebp - 0x1c]
mov ecx, edx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
add dword [ebx + 0x10], esi
adc dword [ebx + 0x14], edi
jmp 0x427645
cmp dword [ebx + 0x2c], 0
je 0x4275f5
mov dword [ebp - 0x28], edx
mov eax, ebx
call fcn.004260b7
mov edx, dword [ebp - 0x28]
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov edx, eax
test eax, eax
js 0x4275c6
add dword [ebx + 0x10], eax
adc dword [ebx + 0x14], 0
jmp 0x427645
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x1c], ecx
je 0x427640
mov edx, 8
mov eax, ebx
call fcn.00427195
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx - 1], al
jmp 0x427621
mov edx, dword [ebx + 0x10]
sub edx, esi
mov eax, edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42764f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, eax
cmp esi, eax
je 0x4276b9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
cmp dword [0x5af030], 0
je 0x4276b9
mov dword [0x611418], 1
xor edx, edx
mov dword [0x611414], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.Error_writing_data___s_:__d_blocks_to_write_but__d_blocks_written_n
call fcn.004268ea
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x427c69
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
jne 0x427c70
xor eax, eax
ret
mov ecx, eax
add edx, eax
or eax, 0xffffffff
cmp ecx, edx
jne 0x427c7c
ret
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
shl ebx, 8
inc ecx
shr eax, 0x18
movzx esi, byte [ecx - 1]
xor eax, esi
xor ebx, dword [eax*4 + 0x5cd518]
mov eax, ebx
cmp ecx, edx
jne 0x427c81
pop ebx
pop esi
pop ebp
ret

Function at 0x428d11
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10
mov dword [esp], 0x68
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov edx, eax
test eax, eax
je 0x428d5b
lea ebx, [eax + 0x14]
mov ecx, 0x15
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov eax, edx
add esp, 0x10
pop ebx
pop edi
pop ebp
ret
Function at 0x428dc9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, edx
cmp dword [eax + 0x60], 0
jne 0x428e3c
mov ecx, dword [eax + 0x5c]
lea edx, [ecx + 1]
mov dword [eax + 0x5c], edx
mov byte [eax + ecx + 0x1c], pe_nt_image_headers32
cmp ecx, 0x37
jle 0x428e2c
cmp edx, 0x3f
jg 0x428dfb
inc edx
mov dword [eax + 0x5c], edx
mov byte [eax + edx + 0x1b], 0
jmp 0x428deb
call fcn.004251dc
mov edx, dword [eax + 0x5c]
cmp edx, 0x37
jg 0x428e15
lea ecx, [edx + 1]
mov dword [eax + 0x5c], ecx
mov byte [eax + edx + 0x1c], 0
jmp 0x428e00
mov edx, dword [eax + 0x14]
bswap edx
mov ecx, dword [eax + 0x18]
bswap ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], edx
call fcn.004251dc
jmp 0x428e3c
cmp edx, 0x38
je 0x428e15
inc edx
mov dword [eax + 0x5c], edx
mov byte [eax + edx + 0x1b], 0
jmp 0x428e2c
mov edx, dword [eax]
shr edx, 0x18
mov byte [ebx], dl
mov edx, dword [eax]
shr edx, 0x10
mov byte [ebx + 1], dl
mov edx, dword [eax]
mov byte [ebx + 2], dh
mov edx, dword [eax]
mov byte [ebx + 3], dl
movzx edx, byte [eax + 7]
mov byte [ebx + 4], dl
movzx edx, word [eax + 6]
mov byte [ebx + 5], dl
mov edx, dword [eax + 4]
mov byte [ebx + 6], dh
mov edx, dword [eax + 4]
mov byte [ebx + 7], dl
movzx edx, byte [eax + 0xb]
mov byte [ebx + 8], dl
movzx edx, word [eax + 0xa]
mov byte [ebx + 9], dl
mov edx, dword [eax + 8]
mov byte [ebx + 0xa], dh
mov edx, dword [eax + 8]
mov byte [ebx + 0xb], dl
movzx edx, byte [eax + 0xf]
mov byte [ebx + 0xc], dl
movzx edx, word [eax + 0xe]
mov byte [ebx + 0xd], dl
mov edx, dword [eax + 0xc]
mov byte [ebx + 0xe], dh
mov edx, dword [eax + 0xc]
mov byte [ebx + 0xf], dl
movzx edx, byte [eax + 0x13]
mov byte [ebx + 0x10], dl
movzx edx, word [eax + 0x12]
mov byte [ebx + 0x11], dl
mov edx, dword [eax + 0x10]
mov byte [ebx + 0x12], dh
mov edx, dword [eax + 0x10]
mov byte [ebx + 0x13], dl
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x428ecb
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov ecx, 5
xor eax, eax
mov edi, dword [ebp - 0x1c]
rep stosd dword es:[edi], eax
call fcn.00428d11
test eax, eax
je 0x428f0e
mov ecx, esi
mov edx, ebx
call fcn.00428d64
cmp dword [eax + 0x64], 0
jne 0x428f0e
mov edx, dword [ebp - 0x1c]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00428dc9
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret