joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4259c0
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43f6a8
push eax
mov dword fs:[0], esp
sub esp, 0x5c
xor eax, eax
xor edx, edx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x34]
lea edi, [esi + 8]
mov ecx, ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [esi + 0x3c]
xor ecx, ecx
mov dword [eax], edx
mov dword [eax + 4], edx
lea eax, [esi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [eax + 4], ecx
xor eax, eax
mov ecx, edi
mov dword [esi + 0x44], eax
mov byte [esi + 0x24], al
mov dword [esi + 0x28], eax
call fcn.00414030
mov ebp, dword [esp + 0x7c]
test ebp, ebp
je 0x425acc
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x425acc
mov dword [esi + 0x44], eax
lea ecx, [esp + 0x10]
shr eax, 4
and al, 1
mov byte [esi + 0x24], al
call fcn.004185e0
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], 0
call fcn.004188b0
lea ecx, [esp + 0x10]
call fcn.00418e90
push eax
mov ecx, edi
call fcn.004149b0
mov al, byte [esi + 0x24]
test al, al
je 0x425a82
mov edx, dword [esp + 0x80]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00415b80
jmp 0x425a94
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.00415a60
mov edi, eax
or ebp, 0xffffffff
add esp, 8
cmp edi, ebp
je 0x425abf
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x3c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
push 0
push edi
jne 0x425ad0
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], ebp
call fcn.004186a0
xor al, al
jmp 0x425af3
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
mov dword [esi + 0x28], eax
call fcn.00424e00
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], ebp
call fcn.004186a0
mov al, 1
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 8

Function at 0x427370
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push edi
mov edi, ecx
mov dword [edi], vtable.ZipCRC.0
mov al, byte [0x458e44]
test al, al
jne 0x4273e5
push ebx
push ebp
push esi
xor ebx, ebx
mov esi, 0x458a44
push 8
push ebx
mov ecx, edi
call fcn.004273f0
shl eax, 0x18
mov dword [esi], eax
mov edx, 8
mov ebp, eax
mov ecx, ebp
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebp, eax
jne 0x4273a2
push 0x20
push eax
mov ecx, edi
mov dword [esi], ebp
call fcn.004273f0
mov dword [esi], eax
add esi, 4
inc ebx
cmp esi, 0x458e40
jle 0x42738c
pop esi
pop ebp
mov eax, edi
pop ebx
mov byte [0x458e44], 1
pop edi
ret
mov eax, edi
pop edi
ret

Function at 0x427440
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
test edx, edx
mov esi, ecx
je 0x42747d
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42747d
push ebx
push edi
lea edi, [eax]
mov eax, dword [esi + 4]
xor ebx, ebx
mov bl, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x458a44]
xor ecx, eax
inc edx
dec edi
mov dword [esi + 4], ecx
jne 0x427457
pop edi
pop ebx
pop esi
ret 8
Function at 0x428310
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x43f8da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00418540
xor ebx, ebx
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0x48], bl
mov byte [esi + 0x49], bl
call fcn.004144c0
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 1
mov dword [esi + 0x68], ebx
mov byte [esi + 0x6c], bl
call fcn.004144c0
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 2
mov byte [esi + 0x8c], bl
call fcn.004144c0
lea ecx, [esi + 0xc0]
mov byte [esp + 0x14], 3
mov word [esi + 0xac], bx
mov byte [esi + 0xae], bl
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
call fcn.00423ca0
lea ecx, [esi + 0xd4]
mov byte [esp + 0x14], 4
call fcn.00423ca0
lea ecx, [esi + 0x40]
xor eax, eax
mov dword [esi], vtable.ExeResource.0
xor edx, edx
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [esi + 0x30]
xor ecx, ecx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
lea edx, [esi + 0x20]
lea eax, [esi + 0x1c]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x42b5b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov edx, 1
cmp dword [esi + 0x50], edx
jle 0x42b6bb
push ebx
push edi
lea eax, [esi + 0x66]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax - 1]
mov cl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x453ba8]
mov ecx, dword [ecx*4 + 0x4543a8]
xor ebx, ebx
xor ecx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x453fa8]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4537a8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0x12], ecx
mov bl, byte [eax - 0xc]
xor ecx, ecx
mov cl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x453fa8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4543a8]
mov bl, byte [eax - 0xd]
xor ecx, edi
mov edi, dword [ebx*4 + 0x453ba8]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4537a8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xe], ecx
mov bl, byte [eax - 8]
xor ecx, ecx
mov cl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x453fa8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4543a8]
mov bl, byte [eax - 9]
xor ecx, edi
mov edi, dword [ebx*4 + 0x453ba8]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4537a8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xa], ecx
mov bl, byte [eax - 4]
xor ecx, ecx
mov cl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x453fa8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x4543a8]
mov bl, byte [eax - 5]
xor ecx, edi
mov edi, dword [ebx*4 + 0x453ba8]
xor ebx, ebx
mov bl, byte [eax - 6]
xor ecx, edi
mov edi, dword [ebx*4 + 0x4537a8]
xor ecx, edi
inc edx
mov dword [eax - 6], ecx
mov ecx, dword [esi + 0x50]
cmp edx, ecx
jl 0x42b5c6
pop edi
pop ebx
pop esi
ret
Function at 0x42d8d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 4]
push edi
cmp eax, 0xffffffff
jne 0x42d8ed
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov ebp, dword [esp + 0x2c]
mov esi, dword [ebx + 8]
xor edi, edi
lea ecx, [esp + 0x1c]
mov edx, dword [ebp]
push edi
push ecx
push edx
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [ebx + 8], eax
jne 0x42d922
mov dword [ebx + 8], esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [ebp]
mov ecx, dword [esp + 0x38]
mov dword [ebx + 8], eax
call fcn.00423dc0
push 0x4e20
xor esi, esi
call fcn.00434d24
mov ecx, dword [ebx + 8]
add esp, 4
lea edx, [esp + 0x10]
mov ebp, eax
mov eax, dword [ebx + 4]
push edi
push edx
push 0x4e20
push ebp
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42d980
push ebp
call fcn.004342a8
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x42d99d
push ebp
call fcn.004342a8
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
cmp eax, 4
jge 0x42d9b7
push ebp
call fcn.004342a8
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x30]
add ecx, eax
mov dword [esp + 0x14], eax
mov dword [ebx + 8], ecx
mov edi, dword [ebp]
cmp edi, edx
mov ecx, ebp
je 0x42da75
mov edi, dword [ecx]
cmp edi, dword [esp + 0x34]
je 0x42da75
cmp eax, 4
jl 0x42d9f9
mov edi, dword [esp + 0x18]
dec eax
inc esi
inc edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
lea ecx, [esi + ebp]
jmp 0x42da6d
test eax, eax
je 0x42da27
mov ecx, eax
add esi, ebp
mov edx, ecx
lea edi, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
lea esi, [esp + 0x20]
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, 0x4e20
lea ecx, [esp + 0x10]
push 0
sub edx, eax
push ecx
mov ecx, dword [ebx + 4]
add eax, ebp
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42da81
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42da81
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x14]
add edx, eax
xor esi, esi
add ecx, eax
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov ecx, ebp
cmp dword [ecx], edx
jne 0x42d9d4
mov eax, dword [ecx]
cmp eax, edx
je 0x42da96
cmp eax, dword [esp + 0x34]
je 0x42da96
push ebp
call fcn.004342a8
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
add eax, edx
mov edx, dword [esp + 0x2c]
push 4
push ecx
mov ecx, dword [esp + 0x40]
mov dword [edx], eax
call fcn.00417c60
push ebp
call fcn.004342a8
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x42dad0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x42dae7
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x42db19
mov dword [esi + 8], ebx
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov dword [esi + 8], edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.00423dc0
mov ebx, dword [esp + 0x18]
mov ecx, edi
push ebx
call fcn.004179e0
mov ecx, edi
call fcn.004172a0
test eax, eax
jne 0x42db47
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
lea edx, [esp + 0x14]
push 0
push edx
push ebx
push eax
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42db6f
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x14]
add ecx, ebx
cmp eax, ebx
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebx
sete al
pop ecx
ret 0xc

Function at 0x4310b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
je 0x431135
cmp eax, 0x40
jbe 0x4310dc
lea eax, [esi + 0x40]
push eax
push esi
call fcn.00434140
add esp, 8
mov dword [esi + 0x9c], 0x14
mov edx, dword [esi + 0x9c]
mov ecx, 0x40
push edi
sub ecx, edx
lea edi, [edx + esi]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, esi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x36363636
dec ecx
mov dword [eax - 4], edx
jne 0x431104
lea edi, [esi + 0x40]
push edi
call fcn.00434070
push edi
push 0x40
push esi
call fcn.004340b0
add esp, 0x10
mov dword [esi + 0x9c], 0xffffffff
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x43114f
add esi, 0x40
push esi
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.004340b0
add esp, 0xc
pop esi
ret

Function at 0x431160
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x28]
cmp dword [edi + 0x9c], 0xffffffff
je 0x43117f
push edi
push 0
push 0
call fcn.004310b0
add esp, 0xc
lea esi, [edi + 0x40]
lea eax, [esp + 8]
push esi
push eax
call fcn.00434140
add esp, 8
mov eax, edi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edx
jne 0x431197
push esi
call fcn.00434070
push esi
push 0x40
push edi
call fcn.004340b0
push esi
lea ecx, [esp + 0x1c]
push 0x14
push ecx
call fcn.004340b0
lea edx, [esp + 0x24]
push esi
push edx
call fcn.00434140
mov ecx, dword [esp + 0x48]
add esp, 0x24
test ecx, ecx
jbe 0x4311f0
mov edi, dword [esp + 0x20]
mov eax, ecx
lea esi, [esp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x14
ret
Function at 0x432070
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
push esi
lea eax, [esp + 0x38]
push edi
push eax
call fcn.00431000
mov edx, dword [esp + 0x228]
mov eax, dword [esp + 0x224]
lea ecx, [esp + 0x40]
push ecx
push edx
push eax
call fcn.00431010
mov edx, dword [esp + 0x23c]
mov eax, dword [esp + 0x238]
mov ecx, 0x28
lea esi, [esp + 0x4c]
lea edi, [esp + 0x18c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18c]
push ecx
push edx
push eax
call fcn.004310b0
mov ecx, dword [esp + 0x254]
add esp, 0x1c
dec ecx
mov eax, 0xcccccccd
mul ecx
shr edx, 4
inc edx
mov dword [esp + 0x10], edx
je 0x4321fc
push ebx
push ebp
mov dword [esp + 0x10], 0
mov ebx, 1
lea ebp, [esp + 0x1c]
xor edx, edx
mov ecx, 0x28
mov dword [esp + 0x1c], edx
lea esi, [esp + 0x184]
lea edi, [esp + 0xe4]
mov dword [esp + 0x20], edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], edx
mov ecx, ebx
mov dword [esp + 0x28], edx
mov eax, ebx
shr ecx, 0x10
mov dword [esp + 0x2c], edx
mov byte [esp + 0x31], cl
mov ecx, dword [esp + 0x238]
mov edx, ebx
shr eax, 0x18
shr edx, 8
mov byte [esp + 0x30], al
mov byte [esp + 0x32], dl
test ecx, ecx
mov byte [esp + 0x33], bl
mov eax, 4
jbe 0x4321b9
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xe4]
lea edx, [esp + 0x30]
push ecx
push eax
push edx
call fcn.004310b0
lea eax, [esp + 0xf0]
lea ecx, [esp + 0x3c]
push eax
push 0x14
push ecx
call fcn.00431160
add esp, 0x18
xor eax, eax
mov dl, byte [esp + eax + 0x30]
mov cl, byte [esp + eax + 0x1c]
xor cl, dl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x14
jb 0x432188
mov ecx, 0x28
lea esi, [esp + 0x44]
lea edi, [esp + 0xe4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
dec ecx
mov dword [esp + 0x14], ecx
jne 0x43215c
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, dword [esp + 0x240]
jae 0x4321dc
mov esi, dword [esp + 0x23c]
mov dl, byte [eax + ebp]
inc ecx
mov byte [eax + esi], dl
inc eax
cmp ecx, 0x14
jb 0x4321bf
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc ebx
add esi, 0x14
sub ebp, 0x14
mov dword [esp + 0x10], esi
lea eax, [ebx - 1]
cmp eax, ecx
jb 0x4320fe
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x214
ret

Function at 0x433290
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
je 0x4332bb
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x434070
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x437e85
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x455338
cmp edx, dword [eax]
je 0x437ea7
add eax, 8
inc ecx
cmp eax, 0x4553c8
jl 0x437e98
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x455338]
jne 0x437fd5
mov eax, dword [0x459654]
cmp eax, 1
je 0x437faf
test eax, eax
jne 0x437ed8
cmp dword [0x454cf4], 1
je 0x437faf
cmp edx, 0xfc
je 0x437fd5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x437f0f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0043a100
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00439dc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x437f52
lea eax, [ebp - 0x1a4]
push eax
call fcn.00439dc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x44401c
push edi
call fcn.00434e90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0043a100
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0043a110
lea eax, [ebp - 0xa0]
push 0x443ffc
push eax
call fcn.0043a110
push dword [esi + 0x45533c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0043a110
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0043b066
add esp, 0x2c
pop edi
jmp 0x437fd5
lea eax, [ebp + 8]
lea esi, [esi + 0x45533c]
push 0
push eax
push dword [esi]
call fcn.00439dc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1000925b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, 0x8000
push ebx
call fcn.10017001
push dword [ebp + 8]
mov edi, eax
push str._s
push ebx
push edi
call fcn.10017156
mov esi, dword [ebp + 0xc]
add esp, 0x14
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
mov dword [ebp - 4], eax
call fcn.10016f24
cmp dword [ebp - 4], 0xffffffff
pop ecx
je 0x1000931a
test byte [esi], 0x10
lea eax, [esi + 0x2c]
je 0x1000931f
push 2
mov edi, 0x1002f744
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x10009300
mov esi, eax
push 3
mov edi, 0x1002f748
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10009300
push ebx
call fcn.10017001
mov esi, dword [ebp + 0xc]
add esi, 0x2c
push esi
push 0x1002f534
mov edi, eax
push ebx
push edi
call fcn.10017156
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.1000921e
push 1
push edi
push dword [ebp + 8]
call dword [ebp + 0x10]
push edi
call fcn.10016f24
add esp, 0x34
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000929c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
push 0
push eax
push dword [ebp + 8]
call dword [ebp + 0x10]
add esp, 0xc
jmp 0x10009303
Function at 0x1000ad76
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
mov eax, ecx
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov al, byte [edx + eax]
xor byte [ecx + str.._._._.._._.__], al
inc ecx
cmp ecx, 0x1000
jl 0x1000ad7b
pop ebp
ret

Function at 0x1000ad98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x1000adbf
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
mov eax, esi
cdq
idiv edi
mov eax, dword [ebp + 0x10]
sub eax, edx
mov al, byte [eax + edi - 1]
xor byte [ecx], al
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x1000ada3
pop esi
pop ebp
ret
Function at 0x10001000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100af7e0
push 0x10064630
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100b221c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
test eax, eax
mov esi, 0x10000
je 0x10001045
lea esi, [eax + 0x10000]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea ebx, [eax - 2]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [ebp - 0x34]
push eax
push esi
call edi
test eax, eax
jbe 0x100010cb
cmp dword [ebp - 0x24], 0x1000
jne 0x100010e4
test dword [ebp - 0x20], 0x100
jne 0x100010e4
mov dword [ebp - 4], 0
mov ecx, 0x5a4d
cmp word [esi], cx
jne 0x100010e1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x100010e1
mov dword [ebp - 4], ebx
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], ebx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
lea esi, [eax + edx]
jmp 0x10001065
Function at 0x10001100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100af800
push 0x10064630
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100b221c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], ecx
xor esi, esi
cmp eax, esi
jne 0x1000114d
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x10001164
push 0xc1
jmp 0x10001241
mov edx, dword [ecx + 0x3c]
add edx, ecx
mov dword [ebp - 0x20], edx
cmp dword [edx], 0x4550
je 0x1000117e
push 0xbf
jmp 0x10001241
movzx ecx, word [edx + 0x14]
cmp cx, si
je 0x1000123c
movzx ecx, cx
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x1c], esi
movzx edx, word [edx + 6]
cmp esi, edx
jae 0x1000123c
lea ecx, [esi + esi*4]
lea edi, [eax + ecx*8]
mov edx, str..detour
mov ecx, edi
mov edi, edi
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x100011d0
test bl, bl
je 0x100011cc
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x100011d0
add ecx, 2
add edx, 2
test bl, bl
jne 0x100011b0
xor ecx, ecx
jmp 0x100011d5
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x1000122a
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x1000123c
cmp dword [edi + 0x10], 0
je 0x1000123c
mov edx, dword [ebp + 8]
lea esi, [ecx + edx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x1000123c
cmp dword [esi + 4], 0x727444
jne 0x1000123c
cmp dword [esi + 8], 0
jne 0x10001205
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc esi
mov edx, dword [ebp - 0x20]
jmp 0x10001192
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4