joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47caa0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004729b0
and dword [ebp - 4], 0
cmp dword [0x4b111c], 0
mov ebx, eax
jne 0x47cb51
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x47cc02
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x47cc02
push eax
call fcn.0047293e
mov dword [esp], 0x499e18
push edi
mov dword [0x4b111c], eax
call esi
push eax
call fcn.0047293e
mov dword [esp], 0x499e04
push edi
mov dword [0x4b1120], eax
call esi
push eax
call fcn.0047293e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b1124], eax
call esi
push eax
call fcn.0047293e
pop ecx
mov dword [0x4b112c], eax
test eax, eax
je 0x47cb51
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047293e
pop ecx
mov dword [0x4b1128], eax
mov eax, dword [0x4b1128]
cmp eax, ebx
je 0x47cba9
cmp dword [0x4b112c], ebx
je 0x47cba9
push eax
call fcn.004729b9
push dword [0x4b112c]
mov esi, eax
call fcn.004729b9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x47cba9
test edi, edi
je 0x47cba9
call esi
test eax, eax
je 0x47cba0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x47cba0
test byte [ebp - 0xc], 1
jne 0x47cba9
or dword [ebp + 0x10], 0x200000
jmp 0x47cbe2
mov eax, dword [0x4b1120]
cmp eax, ebx
je 0x47cbe2
push eax
call fcn.004729b9
pop ecx
test eax, eax
je 0x47cbe2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x47cbe2
mov eax, dword [0x4b1124]
cmp eax, ebx
je 0x47cbe2
push eax
call fcn.004729b9
pop ecx
test eax, eax
je 0x47cbe2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b111c]
call fcn.004729b9
pop ecx
test eax, eax
je 0x47cc02
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47cc04
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40120f
pop dword [ebp - 0x48]
mov eax, 0x40120f
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xc57ace2a
add dword [ebp - 0x58], 0x88d77721
mov dword [ebp - 0x54], 0x2bafa0bb
sub dword [ebp - 0x54], 0xf97c5476
mov dword [ebp - 0x50], 0xe7022658
sub dword [ebp - 0x50], 0x9ab5e22a
mov dword [ebp - 0x4c], 0x95fa875b
add dword [ebp - 0x4c], 0x6a0578a5
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6fcb39b6
add dword [ebp - 0x58], 0x4a72fa0
mov dword [ebp - 0x54], 0x84b6d105
add dword [ebp - 0x54], 0xbcb59070
mov dword [ebp - 0x50], 0xad8a2646
add dword [ebp - 0x50], 0xb5e54626
mov dword [ebp - 0x4c], 0xac12ad2d
add dword [ebp - 0x4c], 0x53ed52d3
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x5d55a5c4
sub eax, 0x5d14d594
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x37bfa
push 0
call eax
mov ecx, 0x4312
xor edx, edx
add edx, eax
mov edi, 0xd29946a1
sub edi, 0xd25736a1
add edi, dword [ebp - 0x48]
mov esi, 0x9f43f466
xor dword [ebp - 0x3c], ecx
mov ebx, dword [edi]
mov dword [ebp - 0x20], 0xbc304771
sub ebx, esi
mov dword [ebp - 4], 0xbee7143e
mov dword [edx], ebx
xor dword [ebp - 0x28], edi
add edx, 0x67922313
add edx, 0x986ddcf1
add edi, 4
loop 0x40131d
add eax, 0x34fee118
sub eax, 0x34fde1fd
mov ebx, eax
add eax, 0xf2caf81a
add eax, 0xd3507eb
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret
Function at 0x10001000
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
je 0x1000102e
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001125
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push str.cmd.exe__c_SC.cmd
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov dword [ebp - 0x458], 0x44
xor eax, eax
mov dword [ebp - 0x42c], 1
mov word [ebp - 0x416], ax
xorps xmm0, xmm0
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x458]
movlpd qword [ebp - 0x454], xmm0
push eax
lea eax, [ebp - 0x20c]
movlpd qword [ebp - 0x44c], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x414]
movlpd qword [ebp - 0x444], xmm0
push eax
push 0
movlpd qword [ebp - 0x43c], xmm0
movlpd qword [ebp - 0x434], xmm0
movlpd qword [ebp - 0x426], xmm0
movlpd qword [ebp - 0x41e], xmm0
movups xmmword [ebp - 0x468], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10001113
push 0xffffffffffffffff
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10001125
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100045c7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10004606
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10004606
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10004606
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10004606
cmp dword [ecx + 0x74], 0xe
jbe 0x10004606
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000728f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000732c
push ebx
push esi
call fcn.10007258
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100071ec
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100072d9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000732b
push edi
push eax
call fcn.1000824a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100072f9
call fcn.10005d34
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000732a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100071ec
add esp, 0x20
test eax, eax
jne 0x10007318
push edi
call fcn.10005d34
jmp 0x10007320
push ebx
call fcn.10005d34
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10007599
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e4f8
push 0x1000e4f0
push str.FlsAlloc
push 0x1f
call fcn.100074b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100075cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d11c]
call esi
jmp 0x100075d3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007617
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e508
push 0x1000e500
push str.FlsGetValue
push 0x21
call fcn.100074b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000764e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d11c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10007656
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e510
push 0x1000e508
push str.FlsSetValue
push 0x22
call fcn.100074b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007690
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000d11c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000cd20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000cd4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000cd4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4088a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x44a068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x408942
xor eax, eax
lea ecx, [ebp - 0x218]
mov word [esi], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408920
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404540
mov eax, esi
jmp 0x408975
push 7
xor eax, eax
mov ecx, esi
push str.Unknown
mov word [esi], ax
call fcn.00404540
mov eax, esi
jmp 0x408975
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00419004
mov esp, ebp
pop ebp
ret 4
Function at 0x40e900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435dc0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44a068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00419215
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0041719c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4121c0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x44a068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
cmp ecx, eax
jne 0x412221
push 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x4442ed
mov byte [esi], 0
call fcn.00404860
jmp 0x412374
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push edx
push 0
push 1
sub eax, ecx
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
push 0
test eax, eax
jne 0x41225d
mov dword [esi + 0x10], eax
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x4442ed
mov byte [esi], al
call fcn.00404860
jmp 0x412374
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00404720
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, dword [edi]
mov eax, dword [edi + 4]
lea edi, [ebp - 0x2c]
cmp dword [ebp - 0x14], 0x10
push edi
cmovae edx, dword [ebp - 0x28]
sub eax, ecx
push edx
push 1
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x4122f9
push eax
mov dword [esi + 0x10], eax
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x4442ed
mov byte [esi], al
call fcn.00404860
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x412374
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4122ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412391
push edx
push ecx
call fcn.00419245
add esp, 8
jmp 0x412374
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x412355
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
cmp edx, 0x10
cmovae eax, edi
cmp byte [ecx + eax - 1], 0xa
jne 0x412330
dec ecx
lea eax, [ebp - 0x28]
cmp edx, 0x10
mov dword [ebp - 0x18], ecx
cmovae eax, edi
mov byte [eax + ecx], 0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
test ecx, ecx
je 0x412355
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edi
cmp byte [ecx + eax - 1], 0xd
jne 0x412355
dec ecx
lea eax, [ebp - 0x28]
cmp edx, 0x10
mov dword [ebp - 0x18], ecx
cmovae eax, edi
mov byte [eax + ecx], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419004
mov esp, ebp
pop ebp
ret
call fcn.0041f2d0
int3
Function at 0x417c53
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x44a068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x417c78
xor eax, eax
jmp 0x417cd4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x417ca5
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x417ca5
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x417d59
cmp dword [edi + 0x4c], 0
je 0x417cce
mov ecx, edi
call fcn.00417918
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x417ce4
push dword [edi + 0x4c]
push ebx
call fcn.0041758a
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x417cd3
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00419004
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x43822c]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x417cce
cmp eax, 1
jle 0x417d2c
cmp eax, 3
jne 0x417cce
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x417cc0
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x417d49
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.00420fe1
add esp, 0x10
cmp esi, eax
jne 0x417cce
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x417cce
mov ax, bx
jmp 0x417cd3

Function at 0x42938d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042903e

Function at 0x429398
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004291c8
Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000149c
pop dword [ebp - 0x28]
mov eax, 0xcdf4d85a
sub eax, 0xbdf4c3be
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x8a8beeaa
sub dword [ebp - 0x38], 0x3c39a95f
mov dword [ebp - 0x34], 0xbe965afb
add dword [ebp - 0x34], 0x739cf14a
mov dword [ebp - 0x30], 0x3717702e
add dword [ebp - 0x30], 0x1534d400
mov dword [ebp - 0x2c], 0x142f2a0a
add dword [ebp - 0x2c], 0xebd0d5f6
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x7b2a75b2
add dword [ebp - 0x38], 0xf947f3a4
mov dword [ebp - 0x34], 0xf2b68b9e
sub dword [ebp - 0x34], 0xb14a2a29
mov dword [ebp - 0x30], 0x271c7a5d
add dword [ebp - 0x30], 0x3c52f20f
mov dword [ebp - 0x2c], 0x35efe321
add dword [ebp - 0x2c], 0xca101cdf
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xf3eeeeae
add eax, 0x1c112192
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36a4b
push 0
call eax
mov ecx, 0x48a8
xor esi, esi
add esi, eax
mov edi, 0x6a17000
add edi, 0x95ee200
add edi, dword [ebp - 0x28]
mov ebx, 0x9df22bdd
add dword [ebp - 0x1c], 0x751c38f4
mov edx, dword [edi]
add dword [ebp - 0x18], edi
sub edx, ebx
xor dword [ebp - 0x24], 0xd49a23e7
mov dword [esi], edx
add dword [ebp - 0x24], edi
add esi, 4
add edi, 4
loop 0x100015af
add eax, 0x3ad47a0f
add eax, 0xc52c9b64
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2d1c8ac3
sub ecx, 0x1d1c8ac3
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b625
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
add eax, 1
sub eax, esi
call fcn.0043b664
sub eax, eax
xor dword [edx], ecx
inc eax
mov esi, esi
sub eax, eax
inc edx
mov eax, eax
cmp edx, ebx
jne fcn.0043b625
sub esp, 4
mov dword [esp], eax
pop eax
sub esp, 4
mov dword [esp], eax
pop esi
add esi, 0x2f9519e8
ret
Function at 0x70cb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp + 8], eax
mov eax, dword [0x70c0ac]
push esi
push edi
test eax, eax
jne 0x70cbcd
mov esi, 0x70c284
mov edx, dword [esi]
lea eax, [ebp - 0x24]
mov cl, byte [edx]
test cl, cl
je 0x70cb8b
lea edi, [ebp - 0x24]
sub edx, edi
xor cl, 0x55
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x70cb7d
lea ecx, [ebp - 0x24]
mov byte [eax], 0
push ecx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov edx, dword [esi - 4]
add esi, 8
cmp esi, 0x70c29c
mov dword [edx], eax
jl 0x70cb6d
mov ecx, dword [0x70c0ac]
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
push 0
push 0x70c2ac
push ecx
mov dword [0x70c0a4], eax
call fcn.0070cd80
add esp, 0xc
mov dword [0x70c0a8], eax
mov dword [ebp - 4], 0
mov esi, 0x70c284
mov edx, dword [esi]
mov cl, byte [edx]
test cl, cl
je 0x70cc16
mov eax, dword [ebp + 8]
mov al, byte [eax]
test al, al
je 0x70cc16
cmp al, 0x5a
jg 0x70cc02
cmp al, 0x41
jl 0x70cc02
movsx edi, al
add edi, 0x20
movsx ebx, cl
xor edi, 0x55
cmp ebx, edi
je 0x70cc08
xor al, 0x55
cmp cl, al
jne 0x70cc16
mov ecx, dword [ebp + 8]
inc edx
inc ecx
mov dword [ebp + 8], ecx
mov cl, byte [edx]
test cl, cl
jne 0x70cbe1
cmp byte [edx], 0
je 0x70cc36
mov edx, dword [ebp - 4]
add esi, 8
inc edx
cmp esi, 0x70c29c
mov dword [ebp - 4], edx
jl 0x70cbd9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov edx, dword [ecx*8 + 0x70c280]
mov eax, dword [edx]
mov esp, ebp
pop ebp
ret
Function at 0xf1c909
Capabilities:
Encode data using xor

Disassembly:
push edi
lea esp, [esp + 0xc]
jae 0xeff859
lea ebx, [edi - 0x44d51c83]
mov ebx, eax
sar di, cl
bsr cx, di
pushal
movzx ecx, al
mov edi, eax
stc
test al, 0xdc
mov ecx, 0x104
pushfd
sub al, al
call fcn.01ac7429
sbb ch, byte [esi + esi*4]
outsd dx, dword [esi]
sal dword [ecx], 0x85
mov ah, 0x85
xchg ebx, eax
cmp bl, dh
or eax, 0x1d1fb48a
sal ah, cl
outsd dx, dword [esi]
sub ah, byte gs:[ecx]
pop es
insb byte es:[edi], dx
pop esi
sub ebx, dword [ecx - 4]
push es
mov dword [0x229062ad], eax
xor esi, dword [0x9dda720e]
mov bl, 0x32
push eax
shrd dword [ebx - 4], ebp, cl
cmp eax, 0xc2adf691
clc
bnd jecxz 0xef99ad
and eax, 0x74682833
hlt
push 0xc6bdc37b
cmp eax, dword [ebp - 0x10]
jmp 0x1ac8e3e
jmp 0xef9958

Function at 0x186c206
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jb 0xf1c3b1
pushfd
push edx
jmp 0x1ac4844
pop es
int1
pop edx
mov ch, 0xdb
ret
sub esp, dword [eax + 0x266b6996]
xor al, 0xd7
jmp 0xdd7d7605
lodsd eax, dword [esi]
nop
adc eax, 0x835b563d
mov dword [edx + 0x48], eax
mov ch, byte [esi + esi*4 - 0x62ef0d38]
stosd dword es:[edi], eax
pop eax
dec esi
daa
sub esi, ebp
clc
lodsd eax, dword [esi]
rcl dword [eax + 0x6a], cl
dec dword [0xc0a96624]
jg 0x1ac47c9
test ax, 0x7fc0
cmp byte [edi - 1], 0
jg 0x1ac484a
inc dword [eax]
add byte [eax - 0x73], ah
and al, 0x28
pushal
lea esp, [esp + 0x28]
jne 0xf1b6e5
sbb di, 0xd739
adc di, 0x5971
btc di, dx
mov edi, dword [edx + 0x24]
call fcn.00f041db
mov edi, 0x10126bc1
jb 0x1ac47f8
adc byte [edx - 0x7c], dh
jbe 0x1ac48a9
push ebp
rcr dl, 1
test dword [ebx - 0x729c5150], esp
in al, 0xf2
xchg dword [ecx - 0x2c52cfea], ebp
cmp byte [edx], dh
std
rol dh, 1
push esp
shr al, cl
mov ah, 0xa6
jo 0x1ac4871
or dl, byte [edx]
loope 0x1ac4825
dec edx
cmp al, 0x53
leave
mov eax, dword [edi]
sub eax, 0xbbea7b04
rol dword [ebp + edx + 0x1b], 1
rol dh, 0x79
invalid
jns 0x1ac483a
adc al, 0x26
retf