joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d38a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41d3c9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41d3c9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d3c9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41d3c9
cmp dword [ecx + 0x74], 0xe
jbe 0x41d3c9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42337f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4786a8
push 0x4786a0
push str.FlsAlloc
push 0x1f
call fcn.0042323e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4233b3
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c144]
call esi
jmp 0x4233b9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4233fd
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4786b8
push 0x4786b0
push str.FlsGetValue
push 0x21
call fcn.0042323e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423434
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42343c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4786c0
push 0x4786b8
push str.FlsSetValue
push 0x22
call fcn.0042323e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423476
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42c144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x424c2e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x424ccb
push ebx
push esi
call fcn.00424bf7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00424b8b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x424c78
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x424cca
push edi
push eax
call fcn.00423641
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x424c98
call fcn.0042368f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x424cc9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00424b8b
add esp, 0x20
test eax, eax
jne 0x424cb7
push edi
call fcn.0042368f
jmp 0x424cbf
push ebx
call fcn.0042368f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42af10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42af3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42af3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4162b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4162ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4162d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4162c0
mov eax, 1
add ebx, ebx
jne 0x4162e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4162d8
jne 0x4162f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4162d8
xor ecx, ecx
sub eax, 3
jb 0x416308
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41637a
mov ebp, eax
add ebx, ebx
jne 0x416313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416344
inc ecx
add ebx, ebx
jne 0x416330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416325
jne 0x416341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416325
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416355
jmp 0x4162c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416364
add edi, ecx
jmp 0x4162c6
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x4163c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1606c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416381
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16074]
or eax, eax
je 0x4163bd
mov dword [ebx], eax
add ebx, 4
jmp 0x41639e
call dword [esi + 0x16070]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4163f4
cmp al, 0xef
ja 0x4163e7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4163c9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4163d6
mov ebp, dword [esi + 0x16078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416428
sub esp, 0xffffff80
jmp 0x405dd2
Function at 0x4063ba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4063de
xor eax, eax
test eax, eax
je 0x4063f1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4063f1
xor ecx, ecx
jmp 0x4063f4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4064db
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x406512
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064ec
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x4064e7
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406543
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x406525
pop edi
not eax
pop esi
ret 0xc

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x100129ec
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002cef1
call fcn.10014f28
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012a09
xor eax, eax
jmp 0x10012adf
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012add
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10012ab3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.100125e1
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.100125e1
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10012b61
lea ecx, [ebp - 0x240]
call fcn.10012b61
push dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
call main
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012abd
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012c52
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10012a36
jmp 0x10012ad6
mov edi, dword [ebp - 0x234]
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10012c52
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10014ed2
ret

Function at 0x1001af50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001af5f
pop dword [ebp - 0x24]
mov eax, 0x1001af5f
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x45fbf
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x53d3494a
add ecx, 0xac2d1646
xor edx, edx
add edx, eax
mov esi, 0x178fede8
sub esi, 0x78b55e8
add esi, dword [ebp - 0x24]
mov ebx, 0x528639de
sub dword [ebp - 0x14], 0x7510acb0
mov edi, dword [esi]
sub dword [ebp - 0xc], ecx
sub edi, ebx
sub dword [ebp - 8], edx
mov dword [edx], edi
xor dword [ebp - 0xc], 0xd519575
add edx, 0x7cabdd5a
add edx, 0x835422aa
add esi, 0x676e8fa9
sub esi, 0x676e8fa5
loop 0x1001afb0
add eax, 0x17113
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10008d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x105520d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
push 0x3ff
mov edi, ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x403]
push esi
push edx
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x408], esi
mov dword [ebp - 0x40c], esi
mov byte [ebp - 0x404], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x408]
push edx
push esi
push 0x400
push ebx
lea eax, [ebp - 0x414]
push eax
mov ecx, edi
call fcn.10008cb0
mov eax, dword [ebp - 0x414]
test ax, ax
jne 0x10008ef7
mov ecx, dword [ebp - 0x410]
push 0x1021caa0
push ecx
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x10008ed4
movzx edx, word [ebp - 0x40c]
push eax
push edx
lea eax, [ebp - 0x404]
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
mov ecx, dword [ebp - 0x408]
add ecx, 0xfffffc00
add esp, 0x10
test ecx, ecx
jle 0x10008ec2
jmp 0x10008e60
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x408]
push ecx
add esi, 0x400
push esi
push 0x400
push ebx
lea edx, [ebp - 0x414]
push edx
mov ecx, edi
call fcn.10008cb0
mov eax, dword [ebp - 0x410]
movzx ecx, word [ebp - 0x40c]
push eax
push ecx
lea edx, [ebp - 0x404]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
mov eax, dword [ebp - 0x408]
sub eax, esi
sub eax, 0x400
add esp, 0x10
test eax, eax
jg 0x10008e60
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
jmp 0x10008f00
mov eax, dword [ebp - 0x418]
pop edi
mov edx, 1
pop esi
mov word [eax], dx
mov al, dl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10203cc8
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x418]
mov word [ecx], ax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10203cc8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
push 0x1021cb20
push edi
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 0
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
mov dword [ebp - 0xc], esi
test esi, esi
je 0x100090f6
push 2
push 0
push esi
call dword [sym.imp.MSVCR100.dll_fseek]
push esi
call dword [sym.imp.MSVCR100.dll_ftell]
mov ecx, dword [ebp + 0x10]
mov esi, eax
cdq
and edx, 0x3ff
lea edi, [edx + eax]
sar edi, 0xa
inc edi
push edi
push esi
push ecx
push str.FTM_AP_WRITE_FILE::Filename__s__size__d__num_of_data_block__d
lea eax, [ebx + 0xa5e4]
push 1
push eax
mov dword [ebp - 0x10], esi
call fcn.10115e20
push esi
call fcn.10203b14
mov edx, dword [ebp - 0xc]
push 0
push 0
push edx
mov ebx, eax
call dword [sym.imp.MSVCR100.dll_fseek]
mov eax, dword [ebp - 0xc]
push eax
push esi
push 1
push ebx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x48
xor esi, esi
test edi, edi
jle 0x100090d7
mov eax, dword [ebp - 8]
push esi
test esi, esi
setne cl
push str.FTM_AP_WRITE_FILE::Transfer_block__d
add eax, 0xa5e4
push 1
push eax
mov byte [ebp + 0x10], cl
call fcn.10115e20
lea eax, [edi - 1]
add esp, 0x10
cmp esi, eax
jne 0x100090a4
mov eax, dword [ebp - 0x10]
and eax, 0x800003ff
jns 0x10009089
dec eax
or eax, 0xfffffc00
inc eax
test eax, eax
jle 0x100090c8
mov ecx, dword [ebp + 0xc]
mov edx, esi
shl edx, 0xa
add edx, ebx
push edx
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push edx
jmp 0x100090bd
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, esi
shl eax, 0xa
add eax, ebx
push eax
mov eax, dword [ebp + 8]
push 0x400
push ecx
push edx
push eax
mov ecx, dword [ebp - 8]
call fcn.10008f20
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x100090d7
inc esi
cmp esi, edi
jl 0x10009050
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll_fclose]
mov al, byte [ebp - 1]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
push str.Failed_to_open__s
push 0x10
add ebx, 0xa5e4
push ebx
call fcn.10115e20
mov al, byte [ebp - 1]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100187d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102055a0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x105520d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, 1
mov edi, eax
cmp dword [esi + 0x10052dc], eax
jb 0x1001883b
mov ebx, dword [sym.imp.MSVCR100.dll_printf]
mov ecx, dword [esi + 0x10052ec]
cmp byte [eax + ecx], 1
je 0x1001882f
movzx edx, byte [esi + 0x10052f0]
push edx
push eax
push str.ERROR:_Pkt_num__u_at_integ_num__u_not_found_in_isf_n
call ebx
add esp, 0xc
inc edi
movzx eax, di
cmp eax, dword [esi + 0x10052dc]
jbe 0x10018810
mov eax, dword [esi]
test eax, eax
je 0x100188a2
movzx edi, word [esi + 0x10052f2]
push eax
mov eax, dword [esi + 0x10052e4]
shl edi, 0xb
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add dword [esi + 0x1007854], edi
mov eax, dword [esi + 0x28c8]
mov ecx, dword [esi + 0x1007854]
add esp, 0x10
test eax, eax
je 0x100188a2
push ecx
push edi
push str.ADC_IQ_Related:_Wrote_Data_into_IQ_file____d_bytes__total_written:__d_bytes
push 8
push eax
call fcn.10115e20
movzx ecx, word [esi + 0x10052f2]
mov edx, dword [esi + 0x28c8]
push ecx
push str.ADC_IQ_Related:_Data_size_calculated_based_on_iqz_PpState.w_SampleCnt1k:__d
push 8
push edx
call fcn.10115e20
add esp, 0x24
cmp dword [esi + 0x28d4], 0xf00000
mov dword [ebp - 4], 0
jae 0x1001898f
cmp dword [esi + 0x28cc], 0
jne 0x100188d5
push 0xf00000
call fcn.10203b14
add esp, 4
mov dword [esi + 0x28cc], eax
cmp dword [esi + 0x28d0], 0
jne 0x100188f1
push 0xf00000
call fcn.10203b14
add esp, 4
mov dword [esi + 0x28d0], eax
cmp dword [esi + 0x28cc], 0
je 0x1001898f
cmp dword [esi + 0x28d0], 0
je 0x1001898f
mov cl, byte [esi + 0xc16]
mov eax, dword [esi + 0x10052e4]
cmp cl, 0xf
je 0x100189a1
cmp cl, 0x10
je 0x100189a1
xor ecx, ecx
jmp 0x10018930
movzx edx, word [esi + 0x10052f2]
shl edx, 0xa
cmp ecx, edx
jae 0x1001898f
movzx ebx, byte [eax]
mov edx, dword [esi + 0x28d4]
mov edi, dword [esi + 0x28cc]
mov byte [edx + edi], bl
movzx ebx, byte [eax + 1]
mov edx, dword [esi + 0x28d4]
mov edi, dword [esi + 0x28d0]
inc eax
mov byte [edx + edi], bl
mov edx, 1
add dword [esi + 0x28d4], edx
add dword [esi + 0x1852], edx
add eax, edx
add ecx, edx
jmp 0x10018930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
movzx edx, word [esi + 0x10052f2]
shl edx, 0xa
shr edx, 1
cmp ecx, edx
jae 0x1001898f
movzx ebx, byte [eax]
mov edx, dword [esi + 0x28d4]
mov edi, dword [esi + 0x28d0]
mov byte [edx + edi + 1], bl
movzx ebx, byte [eax + 1]
mov edx, dword [esi + 0x28d4]
mov edi, dword [esi + 0x28cc]
mov byte [edx + edi + 1], bl
movzx ebx, byte [eax + 2]
mov edx, dword [esi + 0x28d4]
mov edi, dword [esi + 0x28d0]
mov byte [edx + edi], bl
movzx ebx, byte [eax + 3]
mov edx, dword [esi + 0x28d4]
mov edi, dword [esi + 0x28cc]
mov byte [edx + edi], bl
mov edx, 2
add dword [esi + 0x28d4], edx
add dword [esi + 0x1852], edx
add eax, 4
inc ecx
jmp 0x100189a3
Function at 0x10018a20
Capabilities:
Write file on windows

Disassembly:
movzx edx, word [ecx + 0x10052f2]
mov eax, dword [ecx + 4]
push eax
mov eax, dword [ecx + 0x10052e8]
shl edx, 0xb
push edx
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
ret
Function at 0x10021fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1020fff8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x105520d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x100220e7
cmp byte [edi + 0x49], 0
je 0x100220e7
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x100220db
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10022036
lea eax, [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea ebx, [edi + 0x4c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x10022056
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x1002207b
dec eax
je 0x1002207f
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x100220d6
jmp 0x100220e2
mov byte [edi + 0x49], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x1002208f
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x100220b9
cmp edx, 0x10
jae 0x1002209e
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x100220d3
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x100220df
test esi, esi
jne 0x1002204a
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10021d10
jmp 0x10022044
lea ecx, [ebp - 0x2c]
call fcn.101d8f40
xor al, al
jmp 0x100220e9
lea ecx, [ebp - 0x2c]
call fcn.101d8f40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10203cc8
mov esp, ebp
pop ebp
ret
Function at 0x100265d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push ecx
add esi, 0x1413c
push esi
call dword [sym.imp.MSVCR100.dll_vsprintf]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
pop ebp
ret

Function at 0x10029a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ax, word [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], 0
cmp cx, ax
jae 0x10029a2f
mov ecx, dword [ebp + 8]
movzx edx, ax
mov ax, word [ebp - 4]
xor ax, word [ecx]
add ecx, 2
dec edx
jne 0x10029a20
mov esp, ebp
pop ebp
ret 8
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1002aae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
sub ecx, 5
mov eax, 0x4ec4ec4f
mul ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
shr edi, 3
mov eax, edi
imul eax, eax, 0x1a
add esi, 5
xor ebx, ebx
sub ecx, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], edi
je 0x1002ab33
mov ecx, dword [ebp + 0x14]
push str.Incorrect_length_of_OLPC_Cal_Data_n
push ecx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 0x14]
push str.Only_comparing_values_that_dont_vary_per_board_n
push edx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
mov dword [ebp + 0x10], ebx
cmp edi, ebx
jbe 0x1002ac11
mov ebx, esi
sub ebx, dword [ebp + 8]
add ebx, dword [ebp + 0xc]
mov dword [ebp + 0xc], ebx
jmp 0x1002ab66
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov al, byte [esi]
mov cl, byte [ebx]
cmp al, cl
je 0x1002ab93
movzx ecx, cl
push ecx
mov ecx, dword [ebp + 0x14]
movzx edx, al
mov eax, dword [ebp + 0x10]
push edx
push eax
push str.Channel__d_compare_error:_expected__d__got__d_n
push ecx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 0x14
mov dword [ebp - 8], 1
sub ebx, esi
xor edi, edi
inc esi
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], esi
mov edi, edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov edx, dword [ebp - 0xc]
mov al, byte [edx + ebx]
mov cl, byte [ebx]
mov dl, al
xor dl, cl
test dl, 7
je 0x1002abe3
mov edx, dword [ebp + 0x10]
movzx eax, al
movzx ecx, cl
and eax, 7
push eax
mov eax, dword [ebp + 0x14]
and ecx, 7
push ecx
push esi
push edi
push edx
push str.PASetting_Compare_error_for_channel__d___chain__d___calPoint__d___expected__d__got__d_n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 0x1c
mov dword [ebp - 8], 1
inc esi
add ebx, 2
cmp esi, 5
jb 0x1002aba5
add dword [ebp + 8], 0xc
inc edi
cmp edi, 2
jb 0x1002aba0
mov eax, 0x1a
add dword [ebp - 4], eax
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
inc eax
mov dword [ebp + 0x10], eax
cmp eax, dword [ebp - 0x10]
jb 0x1002ab60
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002ac20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 0xc]
xor al, al
test cl, cl
je 0x1002ac38
movzx edx, cl
mov ecx, dword [ebp + 8]
xor al, byte [ecx]
inc ecx
dec edx
jne 0x1002ac32
not al
pop ebp
ret 8
Function at 0x1002cc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dx, word [ebp - 4]
add eax, 8
mov ecx, 0x2a5
push esi
jmp 0x1002cc70
mov si, word [eax - 8]
xor si, word [eax - 6]
add eax, 0xc
xor si, word [eax - 0x10]
xor si, word [eax - 0xe]
xor si, word [eax - 0xa]
xor si, word [eax - 0xc]
xor dx, si
dec ecx
jne 0x1002cc70
mov eax, 0xffff
pop esi
cmp dx, ax
je 0x1002ccb2
push str.qc6174VerifyEepromChksum___error_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov esp, ebp
pop ebp
ret 4