joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0150
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4087
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4f92e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004ae4f0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004ae4f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004ae4f0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004af930
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004af930
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004af930
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ba0fe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x4ba183
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004bebf0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4ba146
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4ba168
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4ba1de
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.004b9ecc
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x4ba1ca
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x4ba1de
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4ba107
pop esi
pop ebx
leave
ret
Function at 0x4bf2c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f92e0]
jne 0x4bf2cf
repz ret
jmp fcn.004c5a04

Function at 0x4c6318
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4f95e0]
je 0x4c6333
inc edi
cmp edi, 0x17
jb 0x4c6324
cmp edi, 0x17
jae 0x4c64b3
push ebp
push 3
call fcn.004cc724
cmp eax, 1
pop ecx
je 0x4c647f
push 3
call fcn.004cc724
test eax, eax
pop ecx
jne 0x4c6367
cmp dword [0x4f9420], 1
je 0x4c647f
cmp ebx, 0xfc
je 0x4c64b2
push 0x500194
mov ebx, 0x314
push ebx
mov ebp, 0x509018
push ebp
call fcn.004c61ac
add esp, 0xc
test eax, eax
je 0x4c639d
push esi
push esi
push esi
push esi
push esi
call fcn.004c14eb
add esp, 0x14
push 0x104
mov esi, 0x509031
push esi
push 0
mov byte [0x509135], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c63e1
push 0x50017c
push 0x2fb
push esi
call fcn.004c61ac
add esp, 0xc
test eax, eax
je 0x4c63e1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004c14eb
add esp, 0x14
push esi
call fcn.004c0fc0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4c6426
push esi
call fcn.004c0fc0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x50932c
push 0x500178
sub ecx, eax
push ecx
push eax
call fcn.004cb26f
add esp, 0x14
test eax, eax
je 0x4c6426
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004c14eb
add esp, 0x14
jmp 0x4c6428
xor esi, esi
push 0x4faa58
push ebx
push ebp
call fcn.004cb1fe
add esp, 0xc
test eax, eax
je 0x4c6448
push esi
push esi
push esi
push esi
push esi
call fcn.004c14eb
add esp, 0x14
push dword [edi*8 + 0x4f95e4]
push ebx
push ebp
call fcn.004cb1fe
add esp, 0xc
test eax, eax
je 0x4c646a
push esi
push esi
push esi
push esi
push esi
call fcn.004c14eb
add esp, 0x14
push 0x12010
push 0x500150
push ebp
call fcn.004cc567
add esp, 0xc
jmp 0x4c64b2
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4c64b2
cmp ebp, 0xffffffff
je 0x4c64b2
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4f95e4]
push dword [esi]
call fcn.004c0fc0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4cc567
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004c5be2
xor ebx, ebx
cmp dword [0x5096f8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4cc63d
push 0x5012a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4cc71d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x501298
push edi
call esi
cmp eax, ebx
je 0x4cc71d
push eax
call fcn.004c5b74
mov dword [esp], 0x501288
push edi
mov dword [0x5096f8], eax
call esi
push eax
call fcn.004c5b74
mov dword [esp], 0x501274
push edi
mov dword [0x5096fc], eax
call esi
push eax
call fcn.004c5b74
mov dword [0x509700], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004c1820
test eax, eax
pop ecx
pop ecx
je 0x4cc60b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004c14eb
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4cc63d
push 0x501258
push edi
call esi
push eax
call fcn.004c5b74
cmp eax, ebx
pop ecx
mov dword [0x509708], eax
je 0x4cc63d
push 0x501240
push edi
call esi
push eax
call fcn.004c5b74
pop ecx
mov dword [0x509704], eax
mov eax, dword [0x509704]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4cc6c2
cmp dword [0x509708], ecx
je 0x4cc6c2
push eax
call fcn.004c5beb
push dword [0x509708]
mov esi, eax
call fcn.004c5beb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4cc6c2
cmp edi, ebx
je 0x4cc6c2
call esi
cmp eax, ebx
je 0x4cc68f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4cc68f
test byte [ebp - 0x18], 1
jne 0x4cc6c2
lea eax, [ebp - 0x10]
push eax
call fcn.004c1857
test eax, eax
pop ecx
je 0x4cc6aa
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004c14eb
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4cc6b9
or dword [ebp + 0x10], 0x200000
jmp 0x4cc6fd
or dword [ebp + 0x10], 0x40000
jmp 0x4cc6fd
mov eax, dword [0x5096fc]
cmp eax, dword [ebp - 8]
je 0x4cc6fd
push eax
call fcn.004c5beb
cmp eax, ebx
pop ecx
je 0x4cc6fd
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4cc6fd
mov eax, dword [0x509700]
cmp eax, dword [ebp - 8]
je 0x4cc6fd
push eax
call fcn.004c5beb
cmp eax, ebx
pop ecx
je 0x4cc6fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5096f8]
call fcn.004c5beb
cmp eax, ebx
pop ecx
je 0x4cc71d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4cc71f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cf32
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041ffd0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp word [esi], 0
je 0x40d0b3
push esi
call fcn.0040d0c7
push esi
call fcn.00424fa3
pop ecx
push esi
mov edi, eax
call fcn.0040d0f2
test al, al
je 0x40cfe7
push esi
call fcn.0040d0c7
test al, al
je 0x40cfa1
lea eax, [edi + 4]
cmp dword [ebp + 0x10], eax
jbe 0x40d0b3
push dword [ebp + 0x10]
push str.__
push dword [ebp + 0xc]
call fcn.0041192f
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call fcn.00411907
mov al, 1
jmp 0x40d0b5
push 0x5c
pop eax
cmp word [esi], ax
jne 0x40d0b3
lea ebx, [esi + 2]
cmp word [ebx], ax
jne 0x40d0b3
mov esi, dword [ebp + 0x10]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x40d0b3
push esi
push str.__
push dword [ebp + 0xc]
call fcn.0041192f
push esi
push 0x434a04
push dword [ebp + 0xc]
call fcn.00411907
push esi
push ebx
jmp 0x40cf92
lea eax, [ebp - 0x1000]
mov ebx, 0x7ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40d0b3
cmp eax, ebx
ja 0x40d0b3
movzx eax, word [esi]
push eax
call fcn.0040d1aa
test al, al
je 0x40d052
lea eax, [edi + 6]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jbe 0x40d0b3
push edi
push str.__
push dword [ebp + 0xc]
call fcn.0041192f
xor eax, eax
mov word [ebp - 0xffc], ax
lea eax, [ebp - 0x1000]
push edi
push eax
push dword [ebp + 0xc]
call fcn.00411907
push edi
jmp 0x40cf91
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.0040caa0
lea eax, [ebp - 0x1000]
push eax
call fcn.00424fa3
add edi, 4
add eax, edi
mov edi, dword [ebp + 0x10]
pop ecx
cmp edi, eax
jbe 0x40d0b3
push edi
push str.__
push dword [ebp + 0xc]
call fcn.0041192f
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.00411907
cmp word [esi], 0x2e
jne 0x40d04c
movzx eax, word [esi + 2]
push eax
call fcn.0040d1aa
test al, al
je 0x40d04c
add esi, 4
jmp 0x40d04c
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x55b000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
push ebx
push esi
mov ebx, edx
mov dword [esp + 0x14], ecx
push edi
mov dword [esp + 0x1c], ebx
mov edi, ecx
xor eax, eax
nop dword [eax]
mov byte [esp + eax + 0xc], al
inc eax
cmp eax, 8
jb 0x55b020
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
xor eax, ecx
rol ecx, 3
mov dword [esp + 0x20], eax
mov eax, dword [edx + 4]
xor eax, ecx
rol ecx, 3
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
xor eax, ecx
rol ecx, 3
xor ecx, dword [edx + 0xc]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov dword [esp + 0x28], eax
xor edx, edx
nop
mov eax, ecx
and eax, 3
mov eax, dword [esp + eax*4 + 0x20]
add eax, ecx
sub ecx, 0x61c88647
mov dword [esp + edx*4 + 0x30], eax
mov eax, ecx
sar eax, 0xb
and eax, 3
mov eax, dword [esp + eax*4 + 0x20]
add eax, ecx
mov dword [esp + edx*4 + 0xb0], eax
inc edx
cmp edx, 0x20
jl 0x55b060
cmp edi, ebx
jae 0x55b1f2
lea esi, [esp + 0x30]
nop dword [eax]
mov ebx, dword [esp + 0xc]
xor edi, edi
mov eax, dword [esp + 0x10]
nop word [eax + eax]
mov edx, eax
mov ecx, eax
shr edx, 5
shl ecx, 4
xor edx, ecx
add edx, eax
xor edx, dword [esi + edi*4]
lea esi, [edx + ebx]
mov edx, esi
mov ecx, esi
shr edx, 5
shl ecx, 4
xor ecx, edx
add ecx, esi
xor ecx, dword [esp + edi*4 + 0xb0]
add ecx, eax
mov edx, ecx
mov eax, ecx
shl eax, 4
shr edx, 5
xor edx, eax
lea eax, [esp + 0x34]
add edx, ecx
xor edx, dword [eax + edi*4]
add edx, esi
mov esi, edx
mov eax, edx
shl eax, 4
shr esi, 5
xor esi, eax
lea eax, [esp + 0xb4]
add esi, edx
xor esi, dword [eax + edi*4]
add esi, ecx
mov ecx, esi
mov eax, esi
shl eax, 4
shr ecx, 5
xor ecx, eax
lea eax, [esp + 0x38]
add ecx, esi
xor ecx, dword [eax + edi*4]
add ecx, edx
mov edx, ecx
mov dword [esp + 0x14], ecx
mov eax, ecx
shr edx, 5
shl eax, 4
xor edx, eax
lea eax, [esp + 0xb8]
add edx, ecx
xor edx, dword [eax + edi*4]
add edx, esi
lea esi, [esp + 0x30]
mov ebx, edx
mov dword [esp + 0x14], edx
shr ebx, 5
mov eax, edx
shl eax, 4
xor ebx, eax
lea eax, [esp + 0x3c]
add ebx, edx
xor ebx, dword [eax + edi*4]
add ebx, ecx
mov eax, ebx
mov ecx, ebx
shr eax, 5
shl ecx, 4
xor eax, ecx
lea ecx, [esp + 0xbc]
add eax, ebx
xor eax, dword [ecx + edi*4]
add edi, 4
add eax, edx
cmp edi, 0x20
jl 0x55b0b0
mov edi, dword [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x14]
mov bl, byte [edi]
mov byte [esp + 0xc], ch
mov dl, bl
xor dl, cl
mov dword [esp + 0x10], eax
movzx ecx, byte [esp + 0xe]
cmp byte [ebp + 0x10], 0
mov byte [esp + 0xd], cl
movzx ecx, byte [esp + 0xf]
mov byte [esp + 0xf], al
mov byte [esp + 0x10], ah
movzx eax, byte [esp + 0x12]
mov byte [esp + 0x11], al
movzx eax, byte [esp + 0x13]
mov byte [esp + 0xe], cl
mov byte [esp + 0x12], al
movzx ecx, dl
movzx eax, bl
cmovne ecx, eax
mov byte [edi], dl
inc edi
mov byte [esp + 0x13], cl
mov dword [esp + 0x18], edi
cmp edi, dword [esp + 0x1c]
jb 0x55b0a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55b390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx + 0x3c]
push ebx
push esi
push edi
mov ebx, dword [eax + ecx + 0x78]
xor esi, esi
mov eax, dword [ebx + ecx + 0x24]
add ebx, ecx
mov dword [ebp - 8], edx
add eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebx + 0x1c]
mov edi, dword [ebx + 0x20]
add edx, ecx
add edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edi
cmp dword [ebx + 0x18], esi
jbe 0x55b425
nop dword [eax + eax]
movzx eax, word [eax + esi*2]
cmp eax, dword [ebx + 0x14]
jae 0x55b41c
mov edi, dword [edi + esi*4]
mov eax, dword [edx + eax*4]
add edi, ecx
add eax, ecx
mov dword [ebp - 4], eax
xor eax, eax
mov cl, byte [edi]
test cl, cl
je 0x55b401
mov edx, edi
rol eax, 3
lea edx, [edx + 1]
movsx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x55b3f0
push dword [ebp + 8]
push dword [ebp - 4]
push eax
push edi
call dword [ebp - 8]
add esp, 0x10
test al, al
jne 0x55b425
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x55b3d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55c100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
xor eax, 0xa8c3d95e
mov dword [ebp - 0x1c], 0xaa7575b3
mov dword [ebp - 0x18], 0xf0a59521
mov dword [ebp - 0x14], 0x315b1289
mov dword [ebp - 0x10], 0x5985ddca
push esi
push edi
cmp eax, 0xa8c3d95f
jne 0x55c31f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0xc0]
mov ecx, eax
xor ecx, 0xdd1e49fc
lea esi, [eax + edx]
xor eax, eax
cmp ecx, 0xdd1e49fc
cmove esi, eax
mov eax, esi
xor eax, 0xf313133
cmp eax, 0xf313133
je 0x55c31f
mov ebx, dword [esi + 0xc]
lea eax, [ebp - 0x1c]
push 0
push 0xf67b7b8d
push eax
lea edx, [esi + 0x340]
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 0xd8]
call section..gcode
mov eax, dword [ebx + 4]
add esp, 0xc
xor eax, 0x2fcab348
cmp eax, 0x2fcab348
je 0x55c31f
mov eax, dword fs:[0x18]
xor edx, edx
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 8]
mov eax, dword fs:[0x18]
lea edi, [ebx + 0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
movzx eax, word [ecx + ebx + 0x14]
add eax, ecx
add edi, eax
movzx eax, word [ecx + ebx + 6]
xor ecx, ecx
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], eax
cmp cx, ax
jae 0x55c31f
nop dword [eax]
movzx eax, dx
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0xc]
lea edi, [edi + eax*8]
lea eax, [ecx + ebx]
cmp eax, entry1
ja 0x55c215
mov eax, dword [edi + 0x10]
add eax, ecx
add eax, ebx
cmp eax, entry1
ja 0x55c225
inc edx
cmp dx, word [ebp + 0xc]
jae 0x55c31f
mov edi, dword [ebp - 8]
jmp 0x55c1f0
mov eax, edi
xor eax, 0xabf6589c
cmp eax, 0xabf6589c
je 0x55c31f
mov eax, dword fs:[0x18]
mov ecx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
add edi, ecx
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
add edi, edx
lea eax, [ecx + edx]
cmp eax, edi
jae 0x55c31f
mov ebx, dword [esi + 0x318]
nop
mov edx, dword [eax + 4]
mov ecx, ebx
xor ecx, dword [eax]
xor edx, dword [esi + 0x31c]
xor ecx, 0x45ecc763
xor edx, 0
cmp ecx, 0x45ecc763
jne 0x55c2f7
test edx, edx
jne 0x55c2f7
mov ecx, dword [esi + 0x320]
xor ecx, dword [eax + 8]
mov edx, dword [esi + 0x324]
xor ecx, 0xc3464624
xor edx, dword [eax + 0xc]
xor edx, 0
cmp ecx, 0xc3464624
jne 0x55c2f7
test edx, edx
jne 0x55c2f7
mov ecx, dword [esi + 0x328]
xor ecx, dword [eax + 0x10]
mov edx, dword [esi + 0x32c]
xor ecx, 0x5ce40551
xor edx, dword [eax + 0x14]
xor edx, 0
cmp ecx, 0x5ce40551
jne 0x55c2f7
test edx, edx
jne 0x55c2f7
mov ecx, dword [esi + 0x330]
xor ecx, dword [eax + 0x18]
mov edx, dword [esi + 0x334]
xor ecx, 0x15070819
xor edx, dword [eax + 0x1c]
xor edx, 0
cmp ecx, 0x15070819
jne 0x55c2f7
test edx, edx
je 0x55c309
inc eax
cmp eax, edi
jb 0x55c260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
xor ecx, 0x1aa09890
cmp ecx, 0x1aa09890
je 0x55c31f
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x7dc7b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e1000]
push edi
or ebp, 0xffffffff
jmp 0x7dc7d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7dc7d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7dc7c8
mov eax, 1
add ebx, ebx
jne 0x7dc7eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7dc7fc
jne 0x7dc81b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7dc81b
dec eax
add ebx, ebx
jne 0x7dc808
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7dc7e0
add ebx, ebx
jne 0x7dc817
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7dc86d
xor ecx, ecx
sub eax, 3
jb 0x7dc833
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7dc8a2
sar eax, 1
mov ebp, eax
jmp 0x7dc83e
add ebx, ebx
jne 0x7dc83e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7dc80c
inc ecx
add ebx, ebx
jne 0x7dc84c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7dc80c
add ebx, ebx
jne 0x7dc859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7dc84e
jne 0x7dc86a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7dc84e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7dc88c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7dc87e
jmp 0x7dc7ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7dc88c
add edi, ecx
jmp 0x7dc7ce
pop esi
mov edi, esi
mov ecx, 0xe0d0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7dc8aa
cmp byte [edi], 0x9a
jne 0x7dc8aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7dc8af
lea edi, [esi + 0x3d8000]
mov eax, dword [edi]
or eax, eax
je 0x7dc91e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x423978]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x423aa4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7dc8dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x423aa8]
or eax, eax
je 0x7dc918
mov dword [ebx], eax
add ebx, 4
jmp 0x7dc8f9
call dword [esi + 0x423ab8]
mov ebp, dword [esi + 0x423aac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7dc952
sub esp, 0xffffff80
jmp 0x675374
Function at 0x4012a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
test edx, edx
je 0x401307
xorps xmm0, xmm0
push 0x4072b8
push edx
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x401307
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
cdq
mov edi, edx
mov ebx, eax
mov dword [ebp - 4], edi
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov ecx, ebx
add esp, 4
or ecx, edi
jne 0x401310
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov edi, eax
push esi
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor ecx, ecx
cmp eax, ebx
jne 0x401344
cmp ecx, dword [ebp - 4]
jne 0x401344
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp - 4]
jmp 0x401351
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
add esp, 4
test edi, edi
je 0x401307
test eax, eax
jne 0x401361
cmp ebx, 8
jbe 0x40137f
cmp dword [edi], 0x696c7062
jne 0x40137f
cmp dword [edi + 4], 0x30307473
jne 0x40137f
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.plist.dll_plist_from_bin]
jmp 0x40138a
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.plist.dll_plist_from_xml]
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret