joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f24b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
call fcn.00702820
call fcn.006f3f2c
mov ebx, eax
test eax, eax
je 0x6f24fa
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.006fce88
test eax, eax
je 0x6f2599
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6f24fa
mov eax, dword [eax + 4]
test eax, eax
je 0x6f2504
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
leave
ret
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esi, 0x40
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x47
mov dword [esp + 4], 1
mov dword [esp], str.Fontconfig_warning:_no__cachedir__elements_found._Check_configuration._n
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], 0xb1e878
mov dword [esp + 4], str.Fontconfig_warning:_adding__cachedir__s__cachedir__n
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x3e
mov dword [esp + 4], 1
mov dword [esp], str.Fontconfig_warning:_adding__cachedir__.fontconfig__cachedir__n
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], 0xb1e878
mov dword [esp], ebx
call fcn.006f4488
test eax, eax
jne 0x6f25ac
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str.Fontconfig_error:_out_of_memory
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call fcn.006f4114
add esp, 0x10
pop ebx
pop esi
leave
jmp fcn.006f2450
mov dword [esp + 4], str._.fontconfig
mov dword [esp], ebx
call fcn.006f4488
test eax, eax
je 0x6f2579
jmp 0x6f24fa

Function at 0x6f42b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp], 0
call sub.msvcrt.dll_time
mov edi, eax
test ebx, ebx
je 0x6f43a8
mov eax, dword [ebx + 0x10]
call fcn.006f3e90
mov dword [ebp - 0x20], eax
mov esi, edx
mov eax, dword [ebx]
call fcn.006f3e90
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebx + 8]
call fcn.006f3e90
test esi, esi
je 0x6f434c
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebx + 0x3c]
test ecx, ecx
jle 0x6f434c
mov esi, dword [ebp - 0x20]
sub esi, edi
test esi, esi
jle 0x6f4361
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x56
mov dword [esp + 4], 1
mov dword [esp], str.Fontconfig_warning:_Directory_file_mtime_in_the_future._New_fonts_may_not_be_detected_n
call sub.msvcrt.dll_fwrite
mov dword [ebx + 0x3c], edi
mov eax, 1
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x6f4388
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebx + 0x3c]
test ecx, ecx
jle 0x6f4388
test esi, esi
jne 0x6f430a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x6f4371
mov ecx, dword [ebp - 0x24]
sub ecx, edi
test ecx, ecx
jg 0x6f4313
test edx, edx
je 0x6f437b
sub eax, edi
test eax, eax
jg 0x6f4313
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
test edx, edx
je 0x6f4395
mov ecx, eax
sub ecx, dword [ebx + 0x3c]
test ecx, ecx
jg 0x6f435d
mov dword [ebx + 0x3c], edi
mov eax, 1
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
call fcn.006f4270
mov ebx, eax
test eax, eax
jne 0x6f42da
xor eax, eax
jmp 0x6f437d
Function at 0x6f6a68
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0xc23140], 0
je 0x6f6a88
mov eax, 0xc23140
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.msvcrt.dll_setlocale
mov ebx, eax
test eax, eax
je 0x6f6ab2
mov edi, 0xb1f4e0
mov ecx, 2
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x6f6ac8
mov dword [esp], str.LC_ALL
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x6f6b90
cmp byte [ebx], 0
je 0x6f6b19
mov dword [esp + 4], 0x5f
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x6f6bc4
mov edx, eax
sub edx, ebx
mov dword [ebp - 0x20], edx
inc eax
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x6f6c08
mov edx, eax
sub edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc edi
lea esi, [edi + edx]
cmp esi, 0x7f
jle 0x6f6b44
cmp byte [0xc23140], 0
jne 0x6f6a7a
mov word [0xc23140], 0x6e65
mov byte [0xc23142], 0
mov eax, 0xc23140
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], 0xc23140
mov dword [ebp - 0x24], edx
call sub.msvcrt.dll_strncpy
mov eax, dword [ebp - 0x20]
mov byte [eax + 0xc23140], 0x2d
mov edx, dword [ebp - 0x24]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], edx
add edi, 0xc23140
mov dword [esp], edi
call sub.msvcrt.dll_strncpy
mov byte [esi + 0xc23140], 0
jmp 0x6f6b19
mov dword [esp], str.LC_CTYPE
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
jne 0x6f6ac8
mov dword [esp], str.LANG
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x6f6b19
jmp 0x6f6ac8
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x6f6c3b
mov esi, eax
sub esi, ebx
cmp esi, 0x7f
jg 0x6f6b19
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0xc23140
call sub.msvcrt.dll_strncpy
mov byte [esi + 0xc23140], 0
jmp 0x6f6b19
mov dword [esp + 4], 0x40
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x6f6b08
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x1c]
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [ebp - 0x1c]
lea eax, [edx + ecx - 1]
jmp 0x6f6b08
mov dword [esp + 4], 0x40
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x6f6bd8
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebx + ecx - 1]
jmp 0x6f6bd8
Function at 0x6f8300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
test eax, eax
je 0x6f8360
mov al, byte [eax]
test al, al
je 0x6f8360
lea edx, [ebx + 1]
xor ecx, ecx
nop
mov esi, ecx
ror esi, 0x1f
movzx ecx, al
xor ecx, esi
mov al, byte [edx]
inc edx
test al, al
jne 0x6f8318
mov esi, 0x1f
mov eax, ecx
xor edx, edx
div esi
mov eax, dword [edx*4 + 0xc231c0]
test eax, eax
jne 0x6f834a
jmp 0x6f8366
mov eax, dword [eax]
test eax, eax
je 0x6f835b
cmp dword [eax + 4], ecx
jne 0x6f8344
lea edx, [eax + 8]
cmp ebx, edx
jne 0x6f8344
mov eax, 1
pop ebx
pop esi
leave
ret
xor edx, edx
xor ecx, ecx
jmp 0x6f8334
xor eax, eax
jmp 0x6f835b

Function at 0x6f8724
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x6f874c
mov dl, byte [ecx]
test dl, dl
je 0x6f874c
inc ecx
xor eax, eax
mov ebx, eax
rol ebx, 1
movzx eax, dl
xor eax, ebx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x6f8738
pop ebx
leave
ret
xor eax, eax
pop ebx
leave
ret

Function at 0x6f9338
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x6f9418
mov edx, dword [ebp + 8]
mov al, byte [edx]
test al, al
je 0x6f9418
inc edx
xor ebx, ebx
mov ecx, ebx
ror ecx, 0x1f
movzx ebx, al
xor ebx, ecx
mov al, byte [edx]
inc edx
test al, al
jne 0x6f935c
mov ecx, 0x1f
mov eax, ebx
xor edx, edx
div ecx
mov edi, dword [edx*4 + 0xc231c0]
test edi, edi
jne 0x6f9390
jmp 0x6f93b5
mov esi, edi
mov edi, dword [edi]
test edi, edi
je 0x6f93bc
cmp dword [edi + 4], ebx
jne 0x6f9388
lea esi, [edi + 8]
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x6f9388
mov eax, esi
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
lea esi, [edx*4 + 0xc231c0]
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xc
mov dword [esp], ecx
mov dword [ebp - 0x1c], ecx
call sub.msvcrt.dll_malloc
mov edi, eax
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 4], ecx
mov dword [esp], 0x1d
call fcn.006f27d8
test edi, edi
je 0x6f9424
mov dword [edi], 0
mov dword [edi + 4], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
lea ebx, [edi + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
mov dword [esi], edi
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
xor edx, edx
xor ebx, ebx
jmp 0x6f9378
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x700138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [esp], 0xffffffff
mov ecx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.006ff048
mov ebx, eax
mov dword [esp], eax
call fcn.006fafe4
test eax, eax
jne 0x7001f0
mov eax, dword [ebp - 0x1c]
test byte [eax + 8], 1
jne 0x7001f0
mov edi, dword [eax + 0x1c]
test edi, edi
jle 0x7001f0
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0068eb10
test eax, eax
je 0x7001f0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x20], eax
dec eax
jle 0x7001fa
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax + 0x20]
mov eax, 1
xor edi, edi
jmp 0x7001ce
mov edx, edi
shl edx, 4
movsx edx, word [esi + edx]
sub edx, 0x10
js 0x7001ec
cmp ecx, edx
jge 0x7001c8
mov edi, eax
inc eax
cmp eax, dword [ebp - 0x20]
je 0x7001fc
mov edx, eax
shl edx, 4
movsx ecx, word [esi + edx]
sub ecx, 0x10
jns 0x7001b4
neg ecx
mov edx, edi
shl edx, 4
movsx edx, word [esi + edx]
sub edx, 0x10
jns 0x7001c2
neg edx
jmp 0x7001c2
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
xor edi, edi
mov dword [esp], ebx
call fcn.006faa10
mov dword [ebp + 8], edi
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.006ff048

Function at 0x702820
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], str.FC_DEBUG
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x70285a
mov dword [esp + 4], eax
mov dword [esp], str.FC_DEBUG_s_n
call sub.msvcrt.dll_printf
mov dword [esp], ebx
call sub.msvcrt.dll_atoi
mov dword [0xc97a40], eax
test eax, eax
js 0x702860
add esp, 0x14
pop ebx
leave
ret
mov dword [0xc97a40], 0
add esp, 0x14
pop ebx
leave
ret

Function at 0x703044
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, eax
cmp byte [eax], 0
jne 0x70305c
xor eax, eax
add esp, 0x20
pop ebx
pop esi
leave
ret
mov dword [esp], eax
call fcn.00705044
mov esi, eax
test eax, eax
je 0x703053
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll__access
test eax, eax
jne 0x7030a4
mov dword [esp], ebx
call sub.msvcrt.dll__mkdir_1
test eax, eax
je 0x7030c4
xor eax, eax
mov dword [esp], esi
mov dword [ebp - 0xc], eax
call fcn.00704258
mov eax, dword [ebp - 0xc]
add esp, 0x20
pop ebx
pop esi
leave
ret
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll__access
inc eax
jne 0x70308a
mov eax, esi
call fcn.00703044
test eax, eax
je 0x70308a
jmp 0x70307e
mov dword [esp + 4], 0x1ed
mov dword [esp], ebx
call sub.msvcrt.dll__chmod
test eax, eax
sete al
movzx eax, al
jmp 0x70308c
Function at 0x7030e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x84
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x74], 0x67452301
mov dword [ebp - 0x70], 0xefcdab89
mov dword [ebp - 0x6c], 0x98badcfe
mov dword [ebp - 0x68], 0x10325476
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x8c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x84], ecx
lea eax, [ecx*8]
mov dword [ebp - 0x64], eax
mov edx, ecx
shr edx, 0x1d
mov dword [ebp - 0x60], edx
cmp ecx, 0x3f
jbe 0x7032cf
lea ebx, [ebp - 0x5c]
mov dword [ebp - 0x80], ebx
xor ebx, ebx
lea eax, [ebp - 0x74]
mov dword [ebp - 0x88], eax
mov esi, dword [ebp - 0x8c]
add esi, ebx
mov edi, dword [ebp - 0x80]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x88]
call fcn.007028d4
add ebx, 0x40
mov eax, dword [ebp - 0x84]
sub eax, ebx
cmp eax, 0x3f
ja 0x703158
mov ecx, dword [ebp - 0x84]
sub ecx, 0x40
mov eax, ecx
and eax, 0xffffffc0
mov edx, dword [ebp - 0x8c]
lea edx, [edx + eax + 0x40]
mov dword [ebp - 0x8c], edx
and ecx, 0x3f
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp - 0x64]
mov edi, dword [ebp - 0x80]
mov esi, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x84]
rep movsb byte es:[edi], byte [esi]
shr eax, 3
and eax, 0x3f
mov byte [ebp + eax - 0x5c], pe_nt_image_headers32
mov ecx, dword [ebp - 0x88]
lea edx, [ecx + eax + 0x19]
mov ecx, 0x3f
sub ecx, eax
cmp ecx, 7
jbe 0x7032a8
sub ecx, 8
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x80]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 0x60]
mov dword [edx + 0x3c], eax
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x88]
call fcn.007028d4
lea eax, [ebp - 0x1c]
mov ecx, 4
mov edi, eax
mov esi, dword [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x74], 0
mov ecx, dword [ebp - 0x90]
mov byte [ecx], 0x2f
mov ebx, ecx
inc ebx
xor edx, edx
mov dword [ebp - 0x80], ebx
mov esi, ecx
nop
mov cl, byte [eax + edx]
mov bl, cl
shr bl, 4
mov edi, ebx
and edi, 0xff
mov bl, byte [edi + str.0123456789abcdef]
mov byte [esi + edx*2 + 1], bl
and ecx, 0xf
mov cl, byte [ecx + str.0123456789abcdef]
mov byte [esi + edx*2 + 2], cl
inc edx
cmp edx, 0x10
jne 0x70323c
mov ebx, dword [ebp - 0x80]
mov byte [ebx + 0x20], 0
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x90]
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [ebp - 0x90]
lea eax, [edx + ecx - 1]
mov esi, str._le32d8.cache_3
mov ecx, 4
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov eax, edx
add esp, 0x84
pop ebx
pop esi
pop edi
leave
ret
xor ebx, ebx
mov edi, edx
mov al, bl
rep stosb byte es:[edi], al
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x88]
call fcn.007028d4
mov ecx, 0x38
mov edi, dword [ebp - 0x80]
mov al, bl
rep stosb byte es:[edi], al
jmp 0x7031f1
lea edx, [ebp - 0x5c]
mov dword [ebp - 0x80], edx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x88], ecx
jmp 0x7031b2
Function at 0x703940
Capabilities:
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], eax
mov ebx, edx
mov edi, ecx
mov edx, dword [edx + 0x14]
cmp edx, 0x1f
jbe 0x7039ec
mov eax, dword [0xc23240]
test eax, eax
je 0x7039aa
mov ecx, dword [ebx]
jmp 0x703973
mov eax, dword [eax + 0x18]
test eax, eax
je 0x7039aa
cmp dword [eax + 0xc], ecx
jne 0x70396c
mov esi, dword [ebx + 4]
cmp word [eax + 0x10], si
jne 0x70396c
mov esi, dword [ebx + 0x1c]
cmp dword [eax + 0x14], esi
jne 0x70396c
inc dword [eax + 4]
mov esi, dword [eax]
test esi, esi
je 0x7039a7
mov edx, edi
mov eax, esi
call fcn.0070370c
test eax, eax
jne 0x7039ee
mov dword [esp], esi
call fcn.0070381c
mov edx, dword [ebx + 0x14]
cmp edx, 0x3ff
jg 0x7039f8
mov dword [esp], edx
mov dword [ebp - 0x20], edx
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
mov edx, dword [ebp - 0x20]
je 0x7039ee
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ecx, 1
cmp eax, dword [ebx + 0x14]
je 0x703a85
jmp 0x703a91
xor esi, esi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileMappingA
sub esp, 0x18
mov edx, eax
test eax, eax
je 0x703b04
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], edx
mov dword [ebp - 0x20], edx
call sub.KERNEL32.dll_MapViewOfFile
sub esp, 0x14
mov esi, eax
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
push ecx
test esi, esi
je 0x703b04
xor ecx, ecx
cmp dword [esi], 0xfc02fc04
je 0x703abd
test ecx, ecx
je 0x703aa8
mov dword [esp], esi
call fcn.008f2ba8
xor esi, esi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], esi
call sub.KERNEL32.dll_UnmapViewOfFile
push edx
xor esi, esi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
cmp dword [esi + 4], 2
jle 0x703a8d
mov eax, dword [ebx + 0x14]
cmp dword [esi + 8], eax
jne 0x703a8d
mov edx, edi
mov eax, esi
mov dword [ebp - 0x20], ecx
call fcn.0070370c
test eax, eax
mov ecx, dword [ebp - 0x20]
je 0x703a8d
mov edx, ebx
mov eax, esi
call fcn.007032e4
test eax, eax
mov ecx, dword [ebp - 0x20]
je 0x703a8d
test ecx, ecx
je 0x7039ee
mov dword [esi], 0xfc02fc05
jmp 0x7039ee
mov edx, dword [ebx + 0x14]
jmp 0x7039b2

Function at 0x707320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 4]
cmp ecx, 8
jbe 0x707350
mov ecx, 8
xor edx, edx
xor eax, eax
xor eax, dword [ebx + edx*4 + 8]
inc edx
cmp ecx, edx
jne 0x707338
mov edx, dword [ebx]
test edx, edx
je 0x70734a
xor eax, dword [edx + 4]
pop ebx
leave
ret
test ecx, ecx
jg 0x707334
xor eax, eax
jmp 0x707341
Function at 0x708acc
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll__mkdir_1
test eax, eax
js 0x708afc
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll__unlink
mov eax, 1
add esp, 0x44
pop ebx
leave
ret
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00703478
test eax, eax
js 0x708b38
mov dword [esp], 0
call sub.msvcrt.dll_time
sub eax, dword [ebp - 0x10]
cmp eax, 0x258
jle 0x708b38
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll__rmdir
test eax, eax
je 0x708b40
nop
xor eax, eax
add esp, 0x44
pop ebx
leave
ret
mov dword [esp], ebx
call fcn.00708acc
jmp 0x708af5

Function at 0x708b64
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__unlink
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_rename
not eax
shr eax, 0x1f
add esp, 0x14
pop ebx
leave
ret
Function at 0x709fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0xc
mov dword [eax + 0x118], 0x715d10
lea eax, [eax + 0x100]
mov dword [esp], eax
call fcn.00722d20
xor edx, edx
test esi, esi
je 0x70a017
lea edi, [ebx + 0x1a0]
jmp 0x709fe6
add esi, 1
mov edx, dword [ebx + 0x1ac]
cmp edx, dword [ebx + 0x1a8]
je 0x70a23c
movzx eax, byte [esi]
mov byte [edx], al
lea eax, [edx + 1]
mov dword [ebx + 0x1ac], eax
cmp byte [esi], 0
jne 0x709fe3
mov edx, dword [ebx + 0x1b0]
mov dword [ebx + 0x1b0], eax
lea eax, [ebx + 0x90]
mov dword [esp + 4], eax
lea eax, [ebx + 0x94]
mov dword [ebx + 0xe8], edx
mov dword [ebx + 0x168], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call fcn.0071e330
mov eax, dword [ebx + 8]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], ebx
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x158], 0
mov dword [ebx + 0x15c], 0
mov dword [ebx + 0x13c], 0
mov dword [ebx + 0x140], 0
mov dword [ebx + 0x144], 0
mov dword [ebx + 0x148], 0
mov dword [ebx + 0x14c], 0
mov dword [ebx + 0x150], 0
mov dword [ebx + 0x154], 0
mov byte [ebx + 0x160], 0
mov byte [ebx + 0x161], 0
mov dword [ebx + 0x198], 0
mov dword [ebx + 0x19c], 0
mov dword [ebx + 0x11c], 0
mov dword [ebx + 0x120], 0
mov dword [ebx + 0x124], 0
mov dword [ebx + 0x128], 0
mov dword [ebx + 0x12c], 0
mov byte [ebx + 0x134], 1
mov dword [ebx + 0x138], 0
mov dword [ebx + 0x16c], 0
mov dword [ebx + 0x174], 0
mov dword [ebx + 0x180], 0
mov dword [ebx + 0xf0], 0
mov dword [ebx + 0xfc], 0
mov dword [ebx + 0xf4], 0
mov dword [ebx + 0x1dc], 0
mov dword [ebx + 0x1e0], 0
mov byte [ebx + 0x1e8], 0
mov byte [ebx + 0x1e9], 0
mov dword [ebx + 0x1ec], 0
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
call fcn.00709610
test al, al
je 0x70a252
mov edx, dword [ebx + 0x1ac]
jmp 0x709ff8
xor edx, edx
jmp 0x70a017
Function at 0x726cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
test ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
je 0x726d7b
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__Join._types:
add esi, 0x40
mov dword [esp], esi
call fcn.00726cc0
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x726d63
xor ebx, ebx
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebx + edx]
xor eax, 1
and eax, 1
mov dword [esp + 4], eax
movzx eax, byte [ebx + edi]
add ebx, 1
mov dword [esp], eax
call fcn.00726c40
mov dword [esp + 4], 0xb41330
mov dword [esp], esi
movsx eax, al
mov dword [esp + 8], eax
call fcn.00726cc0
cmp ebx, dword [ebp - 0x14]
jne 0x726d27
mov dword [esp], esi
mov dword [esp + 4], 0xb41333
call fcn.00726cc0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00725450
test eax, eax
je 0x726d05
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.fribidi:_fribidi_joining.c:__LINE__:_assertion_failed__jtypes__n
add eax, 0x40
mov dword [esp], eax
call fcn.00726cc0
jmp 0x726d05