joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004516
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x3e0
push 0x34
call fcn.01004b78
test eax, eax
pop ecx
je 0x1004539
mov ecx, eax
call fcn.010020e0
mov dword [ebp + 0x64], eax
jmp 0x100453d
and dword [ebp + 0x64], 0
push ebx
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp + 0x64]
call fcn.010043d1
movzx ebx, al
test ebx, ebx
jne 0x1004574
cmp dword [ebp + 0x64], ebx
je 0x100456d
mov ecx, dword [ebp + 0x64]
push 1
call fcn.010043a2
xor eax, eax
jmp 0x10046f2
push esi
mov esi, dword [ebp + 0x78]
push edi
push 4
mov edi, 0x10017b8
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x100458c
sbb eax, eax
sbb eax, 0xffffffff
cmp dword [ebp - 0x28], 2
jne 0x1004665
test eax, eax
je 0x1004665
push 0x10017a4
push dword [ebp + 0x70]
lea ecx, [ebp - 0x190]
call fcn.0100448b
and dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x78]
xor esi, esi
inc esi
test bl, 4
mov dword [ebp - 0x14c], esi
mov dword [ebp + 0x5c], 0x100179c
mov dword [ebp + 0x60], eax
je 0x10045db
mov ecx, dword [ebp + 0x64]
call fcn.01002379
test bl, 2
je 0x10045f6
lea ecx, [ebp - 0x378]
call fcn.010032a0
lea ecx, [ebp - 0x378]
call fcn.010025e6
test bl, 8
je 0x1004617
cmp dword [ebp - 0x34], 5
jb 0x1004617
lea ecx, [ebp - 0x378]
call fcn.01003562
lea ecx, [ebp - 0x378]
call fcn.010032f3
lea eax, [ebp + 0x5c]
push eax
push 2
lea ecx, [ebp - 0x190]
call fcn.010041c2
test eax, eax
jne 0x1004637
lea ecx, [ebp - 0x190]
call fcn.01004357
mov ecx, dword [ebp + 0x64]
test ecx, ecx
je 0x1004644
push esi
call fcn.010043a2
mov esi, dword [ebp - 0x134]
lea ecx, [ebp - 0x11c]
call fcn.01003936
lea ecx, [ebp - 0x190]
call fcn.01003d71
jmp 0x10046ee
lea ecx, [ebp - 0x118]
call fcn.010038f7
test bl, 2
je 0x100468b
lea ecx, [ebp - 0x378]
call fcn.010032a0
lea ecx, [ebp - 0x378]
call fcn.010025e6
test bl, 8
je 0x10046b2
cmp dword [ebp - 0x28], 2
jne 0x10046b2
cmp dword [ebp - 0x34], 5
jb 0x10046b2
lea ecx, [ebp - 0x378]
call fcn.01003562
lea ecx, [ebp - 0x378]
call fcn.010032f3
push dword [ebp + 0x70]
lea ecx, [ebp - 0x118]
call fcn.01003abb
test eax, eax
mov ecx, dword [ebp + 0x64]
jne 0x10046d6
test ecx, ecx
je 0x10046d2
push 1
call fcn.010043a2
xor esi, esi
jmp 0x10046e3
xor esi, esi
inc esi
test ecx, ecx
je 0x10046e3
push esi
call fcn.010043a2
lea ecx, [ebp - 0x118]
call fcn.01003936
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10
Function at 0x100471f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x10017c0
call fcn.0100570c
mov edi, 0x94
mov eax, edi
call fcn.01004900
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x100a6a0], ecx
mov eax, dword [esi + 4]
mov dword [0x100a6ac], eax
mov edx, dword [esi + 8]
mov dword [0x100a6b0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x100a6a4], esi
cmp ecx, 2
je 0x100477f
or esi, 0x8000
mov dword [0x100a6a4], esi
shl eax, 8
add eax, edx
mov dword [0x100a6a8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10047ba
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10047ba
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10047d2
cmp eax, 0x20b
je 0x10047bf
mov dword [ebp - 0x1c], esi
jmp 0x10047e6
cmp dword [ecx + 0x84], 0xe
jbe 0x10047ba
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x10047e0
cmp dword [ecx + 0x74], 0xe
jbe 0x10047ba
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.010056ba
pop ecx
test eax, eax
jne 0x1004812
cmp dword [0x100a690], 1
jne 0x10047ff
call fcn.01004ece
push 0x1c
call fcn.01004d05
push 0xff
call fcn.01004b86
pop ecx
pop ecx
mov dword [ebp - 4], esi
call fcn.010054f5
test eax, eax
jge 0x1004826
push 0x1b
call fcn.010046fa
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100bbf4], eax
call fcn.010053cf
mov dword [0x100a688], eax
call fcn.0100532d
test eax, eax
jge 0x100484c
push 8
call fcn.010046fa
pop ecx
call fcn.010050e1
test eax, eax
jge 0x100485d
push 9
call fcn.010046fa
pop ecx
call fcn.01004bb6
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x1004870
push eax
call fcn.010046fa
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.01005078
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x1004891
movzx eax, word [ebp - 0x34]
jmp 0x1004894
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.01004516
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x10048b2
push edi
call fcn.01004cc5
call fcn.01004ce7
jmp 0x10048e4
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.01005745
ret
Function at 0x1004d05
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x100a010]
je 0x1004d25
inc eax
cmp eax, 0x12
jb 0x1004d16
shl eax, 3
cmp edx, dword [eax + 0x100a010]
mov dword [ebp + 8], eax
jne 0x1004ec3
mov ecx, dword [0x100a690]
cmp ecx, 1
je 0x1004e98
test ecx, ecx
jne 0x1004d57
cmp dword [0x100a008], 1
je 0x1004e98
cmp edx, 0xfc
je 0x1004ec3
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004d92
push 5
pop ecx
mov esi, 0x1001b34
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004da1
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x1004dd9
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004db9
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1001b30
push ebx
call fcn.01004940
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004dde
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100a014]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004df5
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01004900
mov edx, esp
push 6
pop ecx
mov esi, 0x1001b14
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004e21
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1004e2d
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004e46
mov eax, dword [ebp + 8]
mov esi, 0x1001b10
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x100a014]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004e61
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1004e6d
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1001ae8
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0100622e
add esp, 0xc
jmp 0x1004ec3
mov ecx, dword [eax + 0x100a014]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004ea3
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100622e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100a81c], ebx
push esi
push edi
jne 0x10062ae
push 0x1001c28
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10062e9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001c1c
push edi
call esi
test eax, eax
mov dword [0x100a81c], eax
je 0x10062e9
push 0x1001c0c
push edi
call esi
push 0x1001bf8
push edi
mov dword [0x100a820], eax
call esi
cmp dword [0x100a6a0], 2
mov dword [0x100a824], eax
jne 0x10062ae
push 0x1001bdc
push edi
call esi
test eax, eax
mov dword [0x100a82c], eax
je 0x10062ae
push 0x1001bc4
push edi
call esi
mov dword [0x100a828], eax
mov eax, dword [0x100a828]
test eax, eax
je 0x10062f3
call eax
test eax, eax
je 0x10062da
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100a82c]
test eax, eax
je 0x10062da
test byte [ebp - 8], 1
jne 0x10062f3
cmp dword [0x100a6ac], 4
jb 0x10062ed
or byte [ebp + 0x12], 0x20
jmp 0x1006312
xor eax, eax
jmp 0x1006322
or byte [ebp + 0x12], 4
jmp 0x1006312
mov eax, dword [0x100a820]
test eax, eax
je 0x1006312
call eax
mov ebx, eax
test ebx, ebx
je 0x1006312
mov eax, dword [0x100a824]
test eax, eax
je 0x1006312
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100a81c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10070e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x100bac8]
push ebx
push esi
push edi
jae 0x1007269
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x100bae0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x14], ebx
je 0x1007269
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
jne 0x1007138
xor eax, eax
jmp 0x100727d
test al, 0x20
je 0x1007149
push 2
push edi
push edi
push ecx
call fcn.0100801b
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1007205
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jbe 0x100723d
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x418]
cmp ecx, dword [ebp + 0x10]
jae 0x100719f
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1007190
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x14]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x1007175
mov edi, eax
lea eax, [ebp - 0x418]
sub edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10071df
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp eax, edi
jl 0x10071e8
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x1007169
jmp 0x10071ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x1007264
cmp dword [ebp + 8], edi
je 0x100723d
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x1007232
mov dword [0x100a698], eax
jmp 0x1007270
push edi
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1007227
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], edi
mov dword [ebp - 8], eax
jmp 0x10071ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x10071ea
push dword [ebp + 8]
call fcn.01007f06
pop ecx
jmp 0x100727a
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1007252
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x1007131
mov dword [0x100a694], 0x1c
mov dword [0x100a698], edi
jmp 0x100727a
sub eax, dword [ebp - 0x10]
jmp 0x100727d
and dword [0x100a698], 0
mov dword [0x100a694], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10084a8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.01004900
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1008506
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x100a6a0]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jae 0x100850a
xor eax, eax
jmp 0x1008554
cmp eax, 1
je 0x100853a
cmp esi, edi
jbe 0x1008524
push 0x4000
mov eax, esi
sub eax, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 4
push 0x1000
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100a6a0]
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44a810
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc0
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x1c]
mov edi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0xcc]
mov eax, dword [esp + 0x12]
mov ecx, dword [esp + 0x14]
and edx, 0xffff
and eax, 0xffff
mov dword [esi], edx
lea edx, [esp + 0x18]
and ecx, 0xffff
push edx
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0xa]
and ecx, 0xffff
and edx, 0xffff
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 8]
and ecx, 0xffff
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0xc4]
test eax, eax
lea edi, [edx + ecx]
je 0x44a8b9
mov edx, dword [0x651d64]
push 0x651a98
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, edi
pop edi
cdq
mov ecx, eax
mov eax, 0x88888889
xor ecx, edx
sub ecx, edx
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0x18], edx
lea eax, [edx + edx*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x18]
shl edx, 2
sub ecx, edx
xor edx, edx
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0xc0]
add eax, ecx
test eax, eax
mov eax, dword [esi + 0x20]
setl dl
shl edx, 1
and al, 0xfd
or edx, eax
mov eax, esi
or edx, 1
mov dword [esi + 0x20], edx
pop esi
add esp, 0xc0
ret
Function at 0x54cd81
Capabilities:
Encode data using xor

Disassembly:
lea eax, [ebp - 0x61681a24]
stosd dword es:[edi], eax
fcomp qword [ebx + eax*8 - 0x1892483f]
or ebx, dword [esi]
loopne 0x54cdf1
add eax, 0x583cce06
inc ebx
in al, 0xe7
xchg esi, eax
hlt
invalid
sahf
std
movsb byte es:[edi], byte [esi]
lodsd eax, dword [esi]
mov ch, 0xdd
retf
cwde
cmpsb byte [esi], byte es:[edi]
fisubr dword [esi - 0x5c]
je 0x54cdb5
pop ebp
cmpsd dword [esi], dword es:[edi]
bound edx, qword [esp + edi*4 - 0x1b]
mov edi, 0xc750d620
fdiv st(0), st(0)
daa
or eax, 0x503e232d
jae 0x54ce57
pop esi
dec ebx
mul byte [edx - 0x12798cdb]
sbb eax, 0xbfac05b2
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
inc eax
cmp bh, byte [edx + ebx*8]
sbb dword [edi - 0x4c0af7f1], edi
xlatb
imul dword [ebx + 0x31]
pop eax
sbb dword [edi + eax*2], 0x4c
lodsb al, byte [esi]
mov cl, 0x19
ror ah, cl
xor dword [esi + 0x3c], 0xffffff98
add edi, dword [esi - 0x70]
cmp byte [esi - 0x41], ch
cmp eax, 0x53c6a227
stc
jge 0x54cdf8
scasb al, byte es:[edi]
nop
pop edi
imul dword [ebp + 0x4b6d1783]
out 0xb7, eax
aaa
jge 0x54cddc
jno 0x54cdc2
cmpsb byte [esi], byte es:[edi]
sbb dword [edx - 0x22], 0x48
inc ebp
movsd dword es:[edi], dword [esi]
mul bl
in al, dx
jmp dword [esi - 0x21]
push ds
enter 0x443f, 0xffffffffffffffee
push esi
jne 0x54ce3c
repe cmpsb byte [esi], byte es:[edi]
mov edi, 0xbf27f891
push ebx
rcl byte [edi + 0x20ad7a8d]
sar byte [eax], 1
or byte [edx], dh
cmp eax, 0xc8959df5
retf

Function at 0x587c4a
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
cwde
dec esi
wrmsr
and dword [ecx], eax
push edi
and al, 0x67
pop ecx
mov esi, dword [ebx]
nop
and dword [esi], eax
fnsave dword [edi + 0x783b19b]
xchg ecx, eax
fcomp st(6)
sub cl, byte [ecx + ebp*8]
xchg edi, eax
sbb al, 0x63
push esp
mov cl, 0xab
xor esi, dword [esi + ebp*2 + 0x3128b15a]
aad 0x48
je 0x587c53
jle 0x587c49
dec eax
mov ebp, 0xdc32f48b
sub bl, al
and al, 0x22
in al, 0x3a
in al, 0x43
mov eax, 0xc826327f
invalid

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401d80
Capabilities:
Encode data using xor
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa2b30
call fcn.0040c710
mov eax, dword [0x414054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
jmp 0x401dab
jmp 0x401dbd
push str..Maininfo.ini
push 0
push str.EncryptEffect
push str.Encrypt
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x401f67
push 0xa2b20
lea eax, [ebp - 0xa2b28]
push 0
push eax
call fcn.00405240
add esp, 0xc
push 0x452d58
call fcn.00401850
push 0x470220
call fcn.00401b00
push 0x41c0b8
call fcn.004012b0
push 0x415350
call fcn.00401030
push 0x451c20
call fcn.00401560
push 0x5773a0
call fcn.00402dc0
call fcn.00402770
push 0x1d4c0
lea ecx, [ebp - 0xa2b28]
push 0x452d5c
push ecx
call fcn.00409c80
add esp, 0xc
push 0x35b60
lea edx, [ebp - 0x85668]
push 0x470224
push edx
call fcn.00409c80
add esp, 0xc
push 0x35b60
lea eax, [ebp - 0x4fb08]
push 0x41c0bc
push eax
call fcn.00409c80
add esp, 0xc
push 0x6d60
lea ecx, [ebp - 0x19fa8]
push 0x415354
push ecx
call fcn.00409c80
add esp, 0xc
push 0x101d0
mov ecx, 0x2bc
mov esi, 0x451c24
lea edi, [ebp - 0x13248]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x12118]
push 0x5773a4
mov ecx, 0x190
mov esi, 0x452714
lea edi, [ebp - 0x12758]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00409c80
add esp, 0xc
push 0x1f40
lea eax, [ebp - 0x1f48]
push 0x5be3d0
push eax
call fcn.00409c80
add esp, 0xc
xor eax, eax
nop
mov dl, byte [ebp + eax - 0xa2b28]
mov ecx, eax
xor dl, al
shr ecx, 8
xor cl, 0x85
xor dl, 0xfa
sub dl, cl
mov byte [ebp + eax - 0xa2b28], dl
inc eax
cmp eax, 0xa2b20
jb 0x401ef0
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str._OB__Client_Data_Local_EffectTRSData.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401f67
push 0
lea eax, [ebp - 0xa2b2c]
push eax
push 0xa2b20
lea ecx, [ebp - 0xa2b28]
push ecx
push esi
mov dword [ebp - 0xa2b2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x401f79
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040375a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401f91
jmp 0x401fa8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040375a
mov esp, ebp
pop ebp
ret
Function at 0x401fd0
Capabilities:
Encode data using xor
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10314c
call fcn.0040c710
mov eax, dword [0x414054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
jmp 0x401ffa
jmp 0x40200c
push str..Maininfo.ini
push 0
push str.EncryptTooltip
push str.Encrypt
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x40218c
push 0x103140
lea eax, [ebp - 0x103148]
push 0
push eax
call fcn.00405240
add esp, 0xc
push 0
push 0x587578
mov ecx, str._OB__Custom_BuffEffect_eng.txt
call fcn.00403450
push 1
push 0x587578
mov ecx, str._OB__Custom_BuffEffect_spn.txt
call fcn.00403450
push 2
push 0x587578
mov ecx, str._OB__Custom_BuffEffect_por.txt
call fcn.00403450
push 1
push 0x4a63d0
mov ecx, str._OB__CustomItem_ItemToolTip.txt
call fcn.00402430
push 2
push 0x4a63d0
mov ecx, str._OB__Custom_TextTooltip.txt
call fcn.00402430
push 0x12000
lea ecx, [ebp - 0x103148]
push 0x58757c
push ecx
call fcn.00409c80
add esp, 0xc
push 0x12000
lea edx, [ebp - 0xf1148]
push 0x59957c
push edx
call fcn.00409c80
add esp, 0xc
push 0x12000
lea eax, [ebp - 0xdf148]
push 0x5ab57c
push eax
call fcn.00409c80
add esp, 0xc
push 0x4e200
lea ecx, [ebp - 0xcd148]
push 0x4a63d4
push ecx
call fcn.00409c80
add esp, 0xc
push 0x7ef40
lea edx, [ebp - 0x7ef48]
push 0x4f45d4
push edx
call fcn.00409c80
add esp, 0xc
xor eax, eax
mov dl, byte [ebp + eax - 0x103148]
mov ecx, eax
xor dl, al
shr ecx, 8
xor cl, 0x85
xor dl, 0xfa
sub dl, cl
mov byte [ebp + eax - 0x103148], dl
inc eax
cmp eax, 0x103140
jb 0x402115
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str._OB__Client_Data_Local_TooltipTRSData.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40218c
push 0
lea eax, [ebp - 0x10314c]
push eax
push 0x103140
lea ecx, [ebp - 0x103148]
push ecx
push esi
mov dword [ebp - 0x10314c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x40219d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040375a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4021b5
jmp 0x4021cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040375a
mov esp, ebp
pop ebp
ret