joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c08c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4aa8a8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45c0d2
cmp word [ebx], dx
jne 0x45c0d2
or byte [eax + edi + 0x28], 4
jmp 0x45c0d7
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x45c23a
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x45c21a
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x45c118
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x45c14e
cmp eax, edx
jae 0x45c15c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x45c0f3
jmp 0x45c23a
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45c215
cmp dword [ebp - 0x18], 0
je 0x45c215
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4aa8a8]
test byte [eax + edi + 0x28], 0x48
je 0x45c1eb
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x45c1af
mov word [esi], cx
jmp 0x45c1e6
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4aa8a8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4aa8a8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4aa8a8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x45c23a
pop eax
cmp word [ebp - 4], ax
jne 0x45c1fb
cmp esi, ebx
jne 0x45c1fb
mov word [esi], ax
jmp 0x45c237
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0045beaf
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x45c23a
push 0xd
pop eax
jmp 0x45c1f6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4aa8a8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x45c234
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x45c23a
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45c895
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0045c811
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x45ca04
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x45ca04
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x45c9b9
jg 0x45c8f1
test eax, eax
je 0x45c9af
push 1
push 0x1000
call fcn.0044f48e
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x45c914
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x45c9a6
push 0x8000
push ebx
call fcn.0044cdd8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x45c93d
jg 0x45c938
cmp ecx, 0x1000
jb 0x45c93d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00458237
add esp, 0x10
cmp eax, 0xffffffff
je 0x45c982
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x45c938
jl 0x45c969
test ecx, ecx
jne 0x45c92a
push dword [ebp - 0xc]
push ebx
call fcn.0044cdd8
push esi
call fcn.0044f3eb
add esp, 0xc
xor ebx, ebx
jmp 0x45ca12
cmp byte [edi + 0x24], 0
je 0x45c999
cmp dword [edi + 0x20], 5
jne 0x45c999
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x45c9a4
mov ebx, dword [edi + 0x18]
jmp 0x45c9a6
xor ebx, ebx
push esi
call fcn.0044f3eb
pop ecx
jmp 0x45ca12
test ecx, ecx
jg 0x45c97b
jl 0x45c9b9
test eax, eax
jae 0x45c97b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045beaf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x45c9d9
cmp byte [edi + 0x1c], 0
je 0x45c97b
jmp 0x45ca0a
push ebx
call fcn.00454ef6
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x45c97b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x45ca12
cmp byte [edi + 0x1c], 0
je 0x45ca0f
mov ebx, dword [edi + 0x18]
jmp 0x45ca12
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0045beaf
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45e110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45e13d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45e13d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x403e59
pop dword [ebp - 0xc]
mov eax, 0x403e59
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xb5f0b9c9
sub dword [ebp - 0x1c], 0x679e747e
mov dword [ebp - 0x18], 0x3fc4a1a
sub dword [ebp - 0x18], 0xd1c8fdd5
mov dword [ebp - 0x14], 0xb7016b1a
add dword [ebp - 0x14], 0x954ad914
mov dword [ebp - 0x10], 0x7dbc206d
sub dword [ebp - 0x10], 0x7dbc206d
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x5999db0a
sub eax, 0x59595a7e
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x51805e79
sub dword [ebp - 0x1c], 0xdd0df523
mov dword [ebp - 0x18], 0x4e459e28
sub dword [ebp - 0x18], 0xcd93cb3
mov dword [ebp - 0x14], 0x78b414fb
add dword [ebp - 0x14], 0xeabb5771
mov dword [ebp - 0x10], 0xeb5d275
add dword [ebp - 0x10], 0xf14a2d8b
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x391d9
push 0
call eax
mov ecx, 0x5179
xor ebx, ebx
add ebx, eax
mov edx, 0xfedc0fd8
sub edx, 0xfe9affd8
add edx, dword [ebp - 0xc]
mov edi, 0x25365ecd
mov dword [ebp - 8], 0xb7fc33a7
mov esi, dword [edx]
add dword [ebp - 8], esi
sub esi, edi
xor dword [ebp - 4], 0xff6d1621
mov dword [ebx], esi
xor dword [ebp - 8], 0x9012263e
add ebx, 0x81c37f39
add ebx, 0x7e3c80cb
add edx, 4
loop 0x403f67
add eax, 0xe616a161
add eax, 0x19ea9756
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret