joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4b7014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x108]
mov edi, edx
push eax
push 0
push 0
push 0x23
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x43bcf8
push 0x30
push str.Error
push str.Cant_find_AppData_folder__cannot_save_settings
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004555d3
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00462daf
push edi
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 0
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004629ae
add esp, 0x18
test eax, eax
jne 0x43bd39
mov eax, dword [ebp - 0x10c]
test eax, eax
jne 0x43bd3b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004555d3
mov esp, ebp
pop ebp
ret

Function at 0x43d250
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x43d27f
push esi
call fcn.004407f0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x43d278
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x43d302
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x43d2ed
mov eax, dword [esi + 8]
test eax, eax
je 0x43d2a5
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x43d2e8
cmp eax, 2
je 0x43d2ed
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43d296
cmp eax, 3
je 0x43d2cd
cmp eax, 1
jne 0x43d296
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x43d296
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x43d296
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0043d330
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x43d324
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0043d330
add esp, 4
pop edi
pop esi
ret
Function at 0x43d330
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x43d35c
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x43d3e2
lea ebx, [esi + 0x78]
nop dword [eax + eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x43d3b6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43d395
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x184]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x43d3f8
cmp eax, dword [esi + 0x60]
jb 0x43d377
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
jne 0x43d370
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x44a1f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1a8]
mov dword [esp + 0x1c], ebx
jne 0x44a215
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x44a21b
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x44a330
push edi
nop dword [eax]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x44a26d
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
nop dword [eax]
cmp esi, edx
jle 0x44a2c6
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
nop dword [eax]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x44a2b0
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
cmp esi, 0xff
jle 0x44a290
mov esi, dword [esp + 0x14]
test esi, esi
je 0x44a311
mov ecx, 1
lea edx, [ebp - 1]
nop
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x44a2f0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x44a250
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x46953d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004693bc

Function at 0x472c9b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x41885aa3
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6744160f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4018e0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit

Function at 0x4019e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401a3b
cmp byte [esi + ebx - 1], 0xa
je 0x401a0f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x4060b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x402120
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4060b4]
movzx eax, al
bt eax, esi
jae 0x402180
mov ecx, dword [0x4060a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x402026
test byte [0x403030], 8
jne 0x4020c0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x403040], 8
jne 0x402070
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401ff5
cmp esi, 3
jbe 0x402030
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x404200]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401ff5
mov ecx, dword [0x4060b4]
test ecx, ecx
je 0x402160
mov dword [esp], 0x403040
call dword [0x4060b4]
test al, 8
je 0x401fcc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401fcc
mov ebx, dword [0x4060b4]
test ebx, ebx
je 0x402140
mov dword [esp], 0x403030
call dword [0x4060b4]
test al, 8
je 0x401fb9
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
shr edx, 6
imul ebx, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, ebx
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401fbf
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4060b4
call sym._load_func.part.0
jmp 0x401f80
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4060b4
call sym._load_func.part.0
jmp 0x4020ca
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4060b4
call sym._load_func.part.0
jmp 0x40207e
mov eax, 0xffffffff
jmp 0x402026
Function at 0x402370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442d5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x458], 0
mov dword [esi + 0x45c], 0
mov dword [esi + 0x460], 0
mov dword [esi + 0x464], 0
mov dword [esi + 0x468], 0
mov dword [esi + 0x46c], 0
mov dword [esi + 0x470], 0
mov dword [esi + 0x874], 0
mov dword [esi + 0x878], 0
mov dword [esi + 0x87c], 0
mov dword [esi + 0x880], 0
mov dword [esi + 0x884], 0
mov dword [esi + 0x888], 0
mov dword [esi + 0x88c], 0
mov dword [esi + 0xc90], 0
mov dword [esi + 0xc94], 0
mov dword [esi + 0xc98], 0
mov dword [esi + 0xc9c], 0
mov dword [esi + 0xca0], 0
mov dword [esi + 0xca4], 0
mov dword [esi + 0xca8], 0
mov dword [esi + 0x10ac], 0
mov dword [esi + 0x10b0], 0
mov dword [esi + 0x10b4], 0
mov dword [esi + 0x10b8], 0
mov dword [esi + 0x10bc], 0
mov dword [esi + 0x10c0], 0
mov dword [esi + 0x10c4], 0
mov dword [esi + 0x10d4], 0
mov dword [esi + 0x10d8], 0xf
mov byte [esi + 0x10c4], 0
mov dword [esi + 0x10dc], 0
mov dword [esi + 0x10ec], 0
mov dword [esi + 0x10f0], 0xf
mov byte [esi + 0x10dc], 0
mov dword [esi + 0x10f4], 0
mov dword [esi + 0x1104], 0
mov dword [esi + 0x1108], 0xf
mov byte [esi + 0x10f4], 0
mov dword [esi + 0x110c], 0
mov dword [esi + 0x111c], 0
mov dword [esi + 0x1120], 0xf
mov byte [esi + 0x110c], 0
mov dword [esi + 0x1124], 0
mov dword [esi + 0x1134], 0
mov dword [esi + 0x1138], 0xf
mov byte [esi + 0x1124], 0
mov dword [esi + 0x113c], 0
mov dword [esi + 0x114c], 0
mov dword [esi + 0x1150], 0xf
mov byte [esi + 0x113c], 0
mov dword [esi + 0x1154], 0
mov dword [esi + 0x1158], 0
mov byte [esi + 0x115c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov dword [esi + 0x1164], eax
mov edx, esp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1160], eax
mov eax, dword [ebp + 8]
mov dword [esi], 0x451408
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
lea ebx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402670
sub eax, ebx
mov ecx, edx
push eax
push dword [ebp + 8]
call fcn.00401560
mov ecx, esi
call fcn.00436c90
push 0x600
lea eax, [esi + 0x1168]
push 0
push eax
call fcn.0040c7a0
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442e0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.00409881
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x4031fb
push eax
push esi
call fcn.00409b64
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004097b7
int3

Function at 0x4053c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442f50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], 0x45160c
call fcn.0040a6d8
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00409a64
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x409200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
push edi
mov edi, edx
mov eax, dword [edi]
mov edx, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x409252
nop
bsf eax, esi
mov edx, dword [edi]
mov ebx, 0
cmovne ebx, eax
mov ecx, ebx
and ecx, 3
mov eax, dword [ebx*4 + 0x450eb0]
not eax
and esi, eax
mov al, cl
xor al, bl
mov ebx, dword [ebp - 4]
sub al, cl
add al, 4
mov byte [edx + ebx], al
inc edx
mov dword [edi], edx
test esi, esi
jne 0x409220
mov eax, edx
sub eax, dword [ebp - 8]
cmp eax, 1
jle 0x409270
mov cl, byte [edx + ebx - 1]
mov ch, byte [edx + ebx - 2]
cmp cl, ch
jae 0x409270
mov byte [edx + ebx - 1], ch
mov byte [edx + ebx - 2], cl
cmp eax, 2
jle 0x40929b
mov cl, byte [edx + ebx - 2]
mov ch, byte [edx + ebx - 3]
cmp cl, ch
jae 0x40928b
mov byte [edx + ebx - 2], ch
mov byte [edx + ebx - 3], cl
mov cl, ch
mov ch, byte [edx + ebx - 1]
cmp ch, cl
jae 0x40929b
mov byte [edx + ebx - 1], cl
mov byte [edx + ebx - 2], ch
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4092b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
push edi
mov edi, edx
mov eax, dword [edi]
mov ecx, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x409303
nop
bsr eax, esi
mov ecx, dword [edi]
mov ebx, 0
cmovne ebx, eax
mov edx, ebx
and edx, 3
mov eax, dword [ebx*4 + 0x450eb0]
not eax
and esi, eax
mov al, dl
xor al, bl
mov ebx, dword [ebp - 4]
sub dl, al
add dl, 0x1d
mov byte [ecx + ebx], dl
inc ecx
mov dword [edi], ecx
test esi, esi
jne 0x4092d0
mov eax, ecx
sub eax, dword [ebp - 8]
cmp eax, 1
jle 0x409321
mov dl, byte [ecx + ebx - 1]
mov dh, byte [ecx + ebx - 2]
cmp dl, dh
jae 0x409321
mov byte [ecx + ebx - 1], dh
mov byte [ecx + ebx - 2], dl
cmp eax, 2
jle 0x40934c
mov dl, byte [ecx + ebx - 2]
mov dh, byte [ecx + ebx - 3]
cmp dl, dh
jae 0x40933c
mov byte [ecx + ebx - 2], dh
mov byte [ecx + ebx - 3], dl
mov dl, dh
mov dh, byte [ecx + ebx - 1]
cmp dh, dl
jae 0x40934c
mov byte [ecx + ebx - 1], dl
mov byte [ecx + ebx - 2], dh
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f981
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x448578
push 0x448570
push str.FlsAlloc
push 0x1e
call fcn.0041f84b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f9b5
push dword [ebp + 8]
mov ecx, esi
call dword [0x44425c]
call esi
jmp 0x41f9bb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41f9ff
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x448588
push 0x448580
push str.FlsGetValue
push 0x20
call fcn.0041f84b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41fa36
push dword [ebp + 8]
mov ecx, esi
call dword [0x44425c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x420d6e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420bdf

Function at 0x421270
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040b8e0
mov eax, dword [0x456054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041e485
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4212b2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x42140e
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042d8c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x57e9d0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004221ac
mov ecx, dword [esi*4 + 0x57e9d0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x421407
cmp eax, dword [edi + ecx + 0x24]
jne 0x421407
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421407
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004221ac
add esp, 0x14
test edx, edx
jl 0x421407
jg 0x42137d
test eax, eax
jb 0x421407
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x421407
jl 0x421397
cmp dword [ebp - 0x1008], eax
ja 0x421407
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4213b5
test ebx, ebx
je 0x4213ee
cmp ecx, edi
jae 0x4213ee
mov al, byte [ecx]
cmp al, 0xd
jne 0x4213cf
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4213db
cmp byte [ecx + 1], 0xa
jne 0x4213db
inc ecx
jmp 0x4213db
movzx eax, al
movsx eax, byte [eax + 0x4562c8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4213b5
cmp edx, ebx
jne 0x4213b5
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x42140c
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040af51
leave
ret
Function at 0x421509
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x57e9d0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x421549
cmp byte [ebx], 0xa
jne 0x421549
or byte [eax + edi + 0x28], 4
jmp 0x42154e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x42164c
mov al, byte [edx]
cmp al, 0x1a
je 0x42162e
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x42157d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4215a2
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4215ac
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x42155f
jmp 0x42164c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421629
cmp dword [ebp - 0xc], 0
je 0x421629
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x57e9d0]
test byte [eax + edi + 0x28], 0x48
je 0x421603
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4215ee
mov byte [esi], dl
jmp 0x4215ff
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x57e9d0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x42164c
cmp byte [ebp - 1], 0xa
jne 0x421612
cmp esi, ebx
jne 0x421612
mov byte [esi], 0xa
jmp 0x42164b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004221ca
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x42164c
mov byte [esi], 0xd
jmp 0x42164b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x57e9d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x421648
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42164c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret