joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442020
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x442092
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x44220e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x44220e
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x9d17d63a
mov ecx, 0xc5
nop
movzx edi, byte [esp + eax + 0x62e829c6]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
mov edi, edx
not edi
and edx, 0xdd
and edi, 0x22
sub edx, edi
mov byte [esp + eax + 0x62e829c6], dl
inc eax
dec ecx
cmp eax, 0x9d17d641
jne 0x4420b0
mov eax, dword [esp]
mov ecx, dword [0x4506dc]
test ecx, ecx
je 0x44213a
xor edx, edx
mov edi, dword [0x4506e0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x7789b0cb
je 0x442110
inc edx
cmp ecx, edx
jne 0x442100
jmp 0x44213a
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x44213a
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x4506e4]
push ecx
call fcn.00440b10
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x44220e
push 0x1e03da9a
push dword [0x4586f0]
call fcn.004434a0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov edx, 0x9d17d63a
mov esi, 0xc5
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x62e829c6]
mov ebx, esi
xor ebx, edx
and ebx, edi
xor ebx, edx
mov edi, ebx
not edi
and ebx, 0xdd
and edi, 0x22
sub ebx, edi
mov byte [esp + edx + 0x62e829c6], bl
inc edx
dec esi
cmp edx, 0x9d17d641
jne 0x442190
mov edx, dword [0x4506dc]
test edx, edx
je 0x44220e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x4506e0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x4421f0
inc edi
cmp edx, edi
jne 0x4421e0
jmp 0x44220e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x44220e
push ecx
push 1
push dword [0x4506e4]
push edx
mov esi, eax
call fcn.00440b10
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x443eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x443ed0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x443eeb
mov eax, 0xffffffff
jmp 0x443eee
add eax, 0xa
push eax
call fcn.0040c900
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x443f31
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x443f20
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
mov dl, 0x45
nop
nop
nop
nop
nop
nop
nop
mov dh, byte [esp + ecx]
xor dh, dl
xor dh, 0x7f
add dh, 0xde
mov byte [esp + ecx], dh
inc ecx
dec dl
cmp ecx, 7
jne 0x443fa0
mov esi, dword [esp]
mov ecx, dword [0x4506dc]
test ecx, ecx
je 0x444011
xor edx, edx
mov ebx, dword [0x4506e0]
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x443fe0
inc edx
cmp ecx, edx
jne 0x443fd0
jmp 0x444011
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x444011
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x4506e4]
push ecx
mov edi, eax
call fcn.00440b10
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040c910
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x444050
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44406b
mov eax, 0xffffffff
jmp 0x44406e
add eax, 0xa
push eax
call fcn.0040c900
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4440b1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4440a0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x1c1d1a1b
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
mov dl, 0x45
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dh, byte [esp + ecx + 0x20]
xor dh, dl
xor dh, 0x7f
add dh, 0xde
mov byte [esp + ecx + 0x20], dh
inc ecx
dec dl
cmp ecx, 7
jne 0x444120
mov esi, dword [esp + 0x20]
mov ecx, dword [0x4506dc]
test ecx, ecx
je 0x444189
xor edx, edx
mov ebx, dword [0x4506e0]
nop
nop
cmp dword [ebx + edx*8], 0x87573896
je 0x444160
inc edx
cmp ecx, edx
jne 0x444150
jmp 0x444189
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x444189
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push dword [0x4506e4]
push ecx
mov ebx, eax
call fcn.00440b10
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040c910
add esp, 4
test edi, edi
je 0x44419c
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4441b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov dl, 0x45
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
xor cl, dl
xor cl, 0x7f
add cl, 0xde
mov byte [esp + eax], cl
inc eax
dec dl
cmp eax, 7
jne 0x4441e0
mov eax, dword [esp]
mov edx, dword [0x4506dc]
test edx, edx
je 0x444248
xor ebx, ebx
mov ecx, dword [0x4506e0]
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa70a987f
je 0x444220
inc ebx
cmp edx, ebx
jne 0x444210
jmp 0x444248
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x444248
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push dword [0x4506e4]
push edx
call fcn.00440b10
add esp, 0x20
test edi, edi
je 0x444252
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x44425e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444270
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov bl, 0x45
nop
nop
nop
nop
nop
nop
mov bh, byte [esp + eax]
xor bh, bl
xor bh, 0x7f
add bh, 0xde
mov byte [esp + eax], bh
inc eax
dec bl
cmp eax, 7
jne 0x4442a0
mov eax, dword [esp]
mov ebx, dword [0x4506dc]
test ebx, ebx
je 0x44430e
xor ebp, ebp
mov edi, dword [0x4506e0]
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xd41f89d1
je 0x4442e0
inc ebp
cmp ebx, ebp
jne 0x4442d0
jmp 0x44430e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44430e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x4506e4]
push ebx
call fcn.00440b10
add esp, 0x30
cmp eax, 0x103
jne 0x444399
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov cl, 0x45
movzx edx, byte [esp + eax]
xor dl, cl
xor dl, 0x7f
add dl, 0xde
mov byte [esp + eax], dl
inc eax
dec cl
cmp eax, 7
jne 0x444330
mov eax, dword [esp]
mov ecx, dword [0x4506dc]
test ecx, ecx
je 0x444391
xor edx, edx
mov edi, dword [0x4506e0]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x53f09cfa
je 0x444370
inc edx
cmp ecx, edx
jne 0x444360
jmp 0x444391
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x444391
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x4506e4]
push ecx
call fcn.00440b10
add esp, 0x18
test eax, eax
js 0x444399
mov eax, dword [esp + 8]
test esi, esi
je 0x4443ac
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4443aa
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x444500
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x444520
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x1c1d1a1b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov bl, 0x45
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov bh, byte [esp + eax]
xor bh, bl
xor bh, 0x7f
add bh, 0xde
mov byte [esp + eax], bh
inc eax
dec bl
cmp eax, 7
jne 0x444590
mov eax, dword [esp]
mov edi, dword [0x4506dc]
test edi, edi
je 0x4445f2
xor ebx, ebx
mov ebp, dword [0x4506e0]
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x9ecf05eb
je 0x4445d1
inc ebx
cmp edi, ebx
jne 0x4445c0
jmp 0x4445f2
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x4445f2
lea eax, [esp + 0x10]
push esi
push eax
push edx
push ecx
push 4
push dword [0x4506e4]
push edi
call fcn.00440b10
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10089df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
cmp ecx, 0
sete bl
mov esi, dword [0x100af4a8]
cmp eax, 0
sete bh
add esi, 0xfffffefc
mov dword [0x100af4a4], esi
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x1008a005
jmp 0x10089e9f
mov eax, dword [ebp - 0x1c]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x1d]
and bh, bl
test bh, 1
mov edi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
jne 0x10089f42
jmp 0x10089f12
mov al, byte [ebp - 0x35]
mov ecx, 0xfffff234
mov dword [0x100af4a4], 0x2f3
test al, 1
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edx
jne 0x10089fe4
jmp 0x10089ef2
mov dword [0x100af4a4], 0x62d
mov ecx, dword fs:[0x18]
xor eax, eax
mov dword [0x100af4a4], 0x1f43
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
add edx, 0x14
mov ecx, dword [ecx + 0x14]
mov esi, dword [0x100af4a8]
add esi, 0x8d6
mov dword [0x100af4a8], esi
cmp ecx, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x18], eax
je 0x1008a005
jmp 0x10089f5c
mov eax, dword [ebp - 0x3c]
mov dword [0x100af4a4], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x48]
cmp ecx, edx
mov dword [ebp - 0x1c], ecx
je 0x10089ff6
jmp 0x10089e3d
mov eax, 0x431
mov ecx, dword [ebp - 0x28]
mov dx, word [ecx]
mov dword [0x100af4a4], 0x14f0
shr dx, 1
movzx esi, dx
cmp dx, 0
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x3c], eax
je 0x10089ef2
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x10089f75
mov eax, dword [ebp - 0x34]
mov dword [0x100af4a8], 0x20eb
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x1008a005
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x44]
mov byte [ebp - 0x1d], cl
mov dword [ebp - 0x1c], edx
jmp 0x10089e3d
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x2c]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x54], eax
mov word [ebp - 0x56], dx
mov word [ebp - 0x58], di
jb 0x10089fa9
mov ax, word [ebp - 0x56]
mov word [ebp - 0x58], ax
mov ax, word [ebp - 0x58]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x54]
cmp word [ecx + edx*2], ax
sete bl
add edx, 1
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x4c]
cmp edx, esi
setb bh
and al, bh
test al, 1
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x50], edx
jne 0x10089f75
jmp 0x10089e7a
mov eax, dword [ebp - 0x40]
mov dword [0x100af4a8], 0x20eb
mov dword [ebp - 0x18], eax
jmp 0x1008a005
xor eax, eax
mov dword [0x100af4a8], 0x20eb
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1008b150
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1008b1c4
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
jl 0x1008b1c4
jmp 0x1008b1b0
mov dword [0x100af4a8], 0x1fa3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1008b1f4
jmp 0x1008b1dc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1008b195
jmp 0x1008b1dc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1008b1b0
jmp 0x1008b17c
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1008b248
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1008b214
jmp 0x1008b1dc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1008b1dc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1008b1e3
jmp 0x1008b1dc
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff8
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x6c
jne 0x1008b1dc
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1008b1dc
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
Function at 0x1008b710
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
call fcn.10001080
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x1008b7ba
jmp 0x1008b7b2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x38]
mov dword [esp + 0x4c], ecx
mov dword [0x100af4a4], 0xf35
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x30]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.1008c280
mov dword [0x100af4a4], 0xe8a
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x100af4a4], 0x413
mov dword [esp + 0x18], eax
jmp 0x1008b87f
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
je 0x1008b734
jmp 0x1008b86b
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [0x100af4a4], 0xf0
mov dword [0x100af4a8], 0x1dd6
mov dword [esp + 0x10], eax
call fcn.1008b150
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
jne 0x1008b87f
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.1008a010
lea ecx, [0x1008b100]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x74], 0x144c00
mov edx, dword [0x100af490]
mov dword [esp + 0x8c], edx
mov edx, dword [0x100af494]
mov dword [esp + 0x84], edx
mov edx, dword [0x100af498]
mov dword [esp + 0x64], edx
mov edx, dword [0x100af49c]
mov dword [esp + 0x5c], edx
mov edx, dword [0x100af4a0]
mov dword [esp + 0x70], edx
mov dword [0x100af4a4], 0x22a8
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 8]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
je 0x1008b795
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 8], eax
jmp 0x1008b858
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
jmp 0x1008b7b2
Function at 0x1008c840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x100af4a8], 0x4e7
mov dword [0x100af4ac], 0
mov dword [0x100af4b0], 0
mov dword [0x100af4bc], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1008c9bb
jmp 0x1008c986
jmp 0x1008c9bb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x100af4a8], 0x1670
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x100af4ac], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x100af4b0], edx
mov esi, dword [0x100af4a4]
add esi, 0x7be
mov dword [0x100af4a4], esi
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x100af4b4], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x100af4b4]
mov edx, dword [0x100af4b0]
mov byte [edi + edx], cl
mov dword [0x100af4a4], 0xa1
mov edx, dword [0x100af4ac]
movzx edx, byte [edi + edx]
mov ebx, dword [0x100af4b0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x100af4bc], ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
mov ecx, dword [0x100af4a8]
add ecx, 0xffffdc3f
mov dword [0x100af4a8], ecx
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x38], edx
je 0x1008c899
jmp 0x1008c99a
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
jmp 0x1008c89e
mov eax, dword [0x100af4ac]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x100af4b0]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x1008c89e
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004011e0
add esp, 8
cmp dword [0x408d74], 2
jne 0x401091
push 0x4015d0
mov edx, dword [0x408d70]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00406160
add esp, 0xc
lea ecx, [ebp - 0x24]
push ecx
call fcn.00405da0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40108f
cmp dword [ebp - 4], 0
je 0x401065
mov edx, dword [ebp - 4]
push edx
call sub.cgraph.dll_agclose
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [0x408d6c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00401670
add esp, 8
mov eax, dword [0x408d6c]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 4
jmp 0x40103e
jmp 0x4010f2
call fcn.00401100
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4010f2
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00403790
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010f0
cmp dword [ebp - 4], 0
je 0x4010c6
mov edx, dword [ebp - 4]
push edx
call sub.cgraph.dll_agclose
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [0x408d6c]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.cgraph.dll_agwrite
add esp, 8
mov eax, dword [0x408d6c]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 4
jmp 0x40109f
jmp 0x401091
push 0
call dword [sym.imp.MSVCR90.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x4011e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.00401450
add esp, 4
mov dword [0x408d68], eax
mov dword [0x408d00], 0
push str.:gdo:
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00406290
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4012f6
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x3a
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x35
ja case.0x401248.1
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x401364]
jmp dword [ecx*4 + 0x40134c]
mov dword [0x408d74], 1
jmp case.0x401248.1
mov dword [0x408d74], 2
jmp case.0x401248.1
push 0x408120
mov edx, dword [0x4091b4]
push edx
call fcn.004013a0
add esp, 8
mov dword [0x408d6c], eax
jmp case.0x401248.1
mov eax, dword [0x4091b0]
push eax
mov ecx, dword [0x408d68]
push ecx
push str._s:_option___c_missing_argument_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0x10
jmp case.0x401248.1
cmp dword [0x4091b0], 0x3f
jne 0x4012c4
push 0
call fcn.00401420
add esp, 4
jmp case.0x401248.1
mov edx, dword [0x4091b0]
push edx
mov eax, dword [0x408d68]
push eax
push str._s:_option___c_unrecognized_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0x10
push 1
call dword [sym.imp.MSVCR90.dll_exit]
jmp 0x401203
mov ecx, dword [0x408d04]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*4]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [0x408d04]
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], 0
jle 0x401320
mov edx, dword [ebp + 0xc]
mov dword [0x408d70], edx
cmp dword [0x408d6c], 0
jne 0x401337
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x20
mov dword [0x408d6c], eax
cmp dword [0x408d74], 0
jne 0x401345
call fcn.00401490
mov esp, ebp
pop ebp
ret

Function at 0x4013a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401416
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
cmp eax, 0x72
jne 0x4013d4
mov dword [ebp - 4], str.reading
jmp 0x4013db
mov dword [ebp - 4], str.writing
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x408d68]
push eax
push str._s:_could_not_open_file__s_for__s_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0x14
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_perror]
add esp, 4
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret