joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x620277a0
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7d987ebc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x40be70
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c03e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40be9b
mov eax, 0x7000000
jmp 0x40bea3
test eax, eax
je 0x40c019
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00464140
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x891fa0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40c031
cmp ecx, 0x21
jae 0x40c025
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045d050
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0045d120
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x72fdf8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x72fec8]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40bff4
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x72ff38]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00464220
mov eax, ecx
mov ecx, 0x21
call fcn.004642f0
nop
call fcn.00462d80
jmp fcn.0040be70
Function at 0x415030
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x415254
sub esp, 0x18
mov eax, dword [0x8e76b4]
test eax, eax
jne 0x41523d
nop
lea eax, [0x8e76a0]
mov dword [esp], eax
call fcn.00409c60
mov eax, dword [0x8e76a4]
test eax, eax
je 0x415079
cmp dword [eax + 8], 0xcc
jne 0x4150ef
mov edx, dword [0x8e7698]
test edx, edx
jne 0x4150d1
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x8ec9d0]
mov dword [esp + 8], eax
call fcn.0040c050
mov eax, dword [esp + 0xc]
mov dword [0x8e7698], eax
mov ecx, dword [0x8e765c]
mov dword [eax], ecx
mov eax, dword [0x8e7698]
mov dword [0x8e765c], eax
movzx eax, byte [0x8e7de0]
test al, al
jne 0x4150d1
xor eax, eax
jmp 0x4151e9
mov edx, dword [0x8e7698]
mov ebx, dword [edx + 4]
mov dword [0x8e7698], ebx
mov ebx, dword [0x8e76a4]
mov dword [edx + 4], ebx
mov dword [0x8e76a4], edx
mov edx, dword [0x8e76a4]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4151d1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402180
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x8e7a70]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x41514d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41515a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00464190
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x8e7a70]
test edx, edx
jne 0x415186
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4151a7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00464190
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00464190
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00464190
nop
lea eax, [0x8e76a0]
mov dword [esp], eax
call fcn.00409e60
nop
lea eax, [0x8e769c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402300
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00464220
lea esi, [0x8e7de0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x4150d1
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x415233
lea edx, [0x88b578]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x4151db
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00464210
mov ecx, 5
call fcn.00464210
lea eax, [0x6cfca0]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004368a0
nop
call fcn.00462d80
jmp fcn.00415030
Function at 0x428c40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428d5c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x428cd5
cmp cl, 2
je 0x428c7d
cmp cl, 3
jne 0x428d45
mov byte [eax + 8], 1
jmp 0x428d41
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042de70
nop
lea eax, [0x8cbc58]
mov dword [esp], eax
call fcn.00409c60
nop
mov eax, dword [0x8cbc24]
sub eax, dword [0x8cbc08]
mov dword [0x8cbc24], eax
mov eax, dword [0x8cbc14]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x8cbc14], ecx
nop
lea eax, [0x8cbc58]
mov dword [esp], eax
call fcn.00409e60
jmp 0x428d41
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00415030
nop
lea eax, [0x8cbc58]
mov dword [esp], eax
call fcn.00409c60
nop
mov eax, dword [0x8cbbfc]
sub eax, dword [0x8cbbe0]
mov dword [0x8cbbfc], eax
mov eax, dword [0x8cbbec]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x8cbbec], ecx
nop
nop
lea eax, [0x8cbc58]
mov dword [esp], eax
call fcn.00409e60
add esp, 0x14
ret
lea eax, [0x6cbd99]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004368a0
nop
call fcn.00462d80
jmp fcn.00428c40
Function at 0x464040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x8e7bc0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46280b
je 0x46285e
cmp ebx, 0x20
jbe 0x462864
cmp ebx, 0x40
jbe 0x4628aa
jmp 0x46294b
test ebx, ebx
je 0x462854
add eax, 0x10
test ax, 0xff0
je 0x462840
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x732a40]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x732c40]
jmp 0x462828
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x462828
pxor xmm1, xmmword [0x8e7bd0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x8e7bd0]
pxor xmm2, xmmword [0x8e7be0]
pxor xmm3, xmmword [0x8e7bf0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x8e7bd0]
pxor xmm2, xmmword [0x8e7be0]
pxor xmm3, xmmword [0x8e7bf0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4629aa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x8e7619], 0
je 0x46405a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4627d0
jmp fcn.004085a0
Function at 0x1000a210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000a21f
pop dword [ebp - 0x20]
mov eax, 0xc16aec6f
sub eax, 0xb16a4a50
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3733f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x48ab
mov edi, eax
mov edx, 0x10019800
add edx, dword [ebp - 0x20]
mov esi, 0x1b188080
sub esi, 0x21f47287
xor dword [ebp - 0x10], esi
mov ebx, dword [edx]
add dword [ebp - 0x1c], ecx
xor ebx, esi
add dword [ebp - 0xc], ecx
mov dword [edi], ebx
xor dword [ebp - 0x10], ecx
add edi, 0xd3e80f12
add edi, 0x2c17f0f2
add edx, 4
loop 0x1000a26d
add eax, 0x1157f
mov ebx, eax
add eax, 5
mov ecx, 0xdeefc396
sub ecx, 0xceefc396
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0xd97058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d971a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd9707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd9706a
add dl, dl
jne 0xd97089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd970dc
xor eax, eax
add dl, dl
jne 0xd97096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd9717d
add dl, dl
jne 0xd970a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd970b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd970bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd970c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd970d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd97075
mov eax, 1
add dl, dl
jne 0xd970ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd970f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd970e1
sub eax, ebx
mov ebx, 1
jne 0xd97128
mov ecx, 1
add dl, dl
jne 0xd9710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd97119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd97105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd97075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd9713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd9714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd97136
cmp eax, 0x7d00
jae 0xd9716d
cmp eax, 0x500
jb 0xd97168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd97075
cmp eax, 0x7f
ja 0xd97170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd97075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd9719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd97075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405acf
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x42d118
call fcn.004113f0
mov eax, 0x1010
call fcn.004113c0
push ebx
push esi
push edi
mov esi, ecx
push 1
call fcn.00423095
cmp dword [esi + 0x250], 0
je 0x405b03
lea ecx, [esi + 0x244]
call fcn.00425138
cmp dword [esi + 0x2b4], 0
je 0x405c5a
mov eax, dword [esi + 0x244]
lea edi, [esi + 0x244]
mov ebx, 0x43cd48
push ebx
push eax
call fcn.004114a5
pop ecx
test eax, eax
pop ecx
je 0x405c5a
mov eax, dword [edi]
and dword [ebp - 0x10], 0
push ebx
push eax
call fcn.004114a5
pop ecx
test eax, eax
pop ecx
je 0x405c5a
mov eax, dword [esi + 0x250]
test eax, eax
je 0x405b7d
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x101c]
push ecx
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.00424a57
mov ecx, esi
call fcn.0040598b
cmp eax, 2
je 0x405c5a
jmp 0x405b9a
mov edi, dword [edi]
xor eax, eax
mov ecx, dword [edi - 8]
test ecx, ecx
mov dword [ebp - 0x10], ecx
jle 0x405b9a
mov dl, byte [edi + eax]
mov byte [ebp + eax - 0x101c], dl
inc eax
cmp eax, ecx
jl 0x405b8b
mov eax, dword [ebp - 0x10]
xor edi, edi
test eax, eax
mov dword [esi + 0x22f4], 1
jle 0x405bd7
lea ecx, [ebp - 0x18]
sub eax, edi
push 0
push ecx
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp + edi - 0x101c]
push eax
push dword [esi + 0x2b0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp edi, eax
jl 0x405bad
push eax
lea eax, [ebp - 0x101c]
push eax
mov ecx, esi
call fcn.0040700e
mov ecx, dword [ebp - 0x10]
inc dword [esi + 0x70]
add dword [esi + 0x6c], ecx
mov ecx, dword [0x43af2c]
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
push eax
mov edi, 0x43a698
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0041f191
add esp, 0xc
mov ecx, esi
push 0x426
call fcn.00423a68
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00423b56
push dword [esi + 0x6c]
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0041f191
add esp, 0xc
mov ecx, esi
push 0x428
call fcn.00423a68
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00423b56
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00424ce2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x405c69
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x42d12c
call fcn.004113f0
mov eax, 0x1010
call fcn.004113c0
push ebx
push esi
push edi
mov esi, ecx
push 1
call fcn.00423095
xor ebx, ebx
cmp dword [esi + 0x254], ebx
je 0x405c9e
lea ecx, [esi + 0x248]
call fcn.00425138
cmp dword [esi + 0x2b4], ebx
je 0x405dde
mov eax, dword [esi + 0x248]
lea edi, [esi + 0x248]
push 0x43cd48
push eax
call fcn.004114a5
pop ecx
test eax, eax
pop ecx
je 0x405dde
mov eax, dword [esi + 0x254]
mov dword [ebp - 0x10], ebx
cmp eax, ebx
je 0x405d02
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x101c]
push ecx
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.00424a57
mov ecx, esi
call fcn.0040598b
cmp eax, 2
je 0x405dde
jmp 0x405d1f
mov eax, dword [edi]
xor ecx, ecx
mov edi, dword [eax - 8]
cmp edi, ebx
mov dword [ebp - 0x10], edi
jle 0x405d1f
mov dl, byte [eax + ecx]
mov byte [ebp + ecx - 0x101c], dl
inc ecx
cmp ecx, edi
jl 0x405d10
xor edi, edi
cmp dword [ebp - 0x10], ebx
mov dword [esi + 0x22f4], 1
jle 0x405d5a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
sub eax, edi
push ebx
push ecx
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp + edi - 0x101c]
push eax
push dword [esi + 0x2b0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x18]
cmp edi, dword [ebp - 0x10]
jl 0x405d30
push dword [ebp - 0x10]
lea eax, [ebp - 0x101c]
mov ecx, esi
push eax
call fcn.0040700e
mov ecx, dword [ebp - 0x10]
inc dword [esi + 0x70]
add dword [esi + 0x6c], ecx
mov ecx, dword [0x43af2c]
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x14], ecx
push eax
mov edi, 0x43a698
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 4], ebx
call fcn.0041f191
add esp, 0xc
mov ecx, esi
push 0x426
call fcn.00423a68
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00423b56
push dword [esi + 0x6c]
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0041f191
add esp, 0xc
mov ecx, esi
push 0x428
call fcn.00423a68
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00423b56
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00424ce2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x405e09
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x42d140
call fcn.004113f0
mov eax, 0x1010
call fcn.004113c0
push ebx
push esi
push edi
mov esi, ecx
push 1
call fcn.00423095
xor ebx, ebx
cmp dword [esi + 0x258], ebx
je 0x405e3e
lea ecx, [esi + 0x24c]
call fcn.00425138
cmp dword [esi + 0x2b4], ebx
je 0x405f7e
mov eax, dword [esi + 0x24c]
lea edi, [esi + 0x24c]
push 0x43cd48
push eax
call fcn.004114a5
pop ecx
test eax, eax
pop ecx
je 0x405f7e
mov eax, dword [esi + 0x258]
mov dword [ebp - 0x10], ebx
cmp eax, ebx
je 0x405ea2
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x101c]
push ecx
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.00424a57
mov ecx, esi
call fcn.0040598b
cmp eax, 2
je 0x405f7e
jmp 0x405ebf
mov eax, dword [edi]
xor ecx, ecx
mov edi, dword [eax - 8]
cmp edi, ebx
mov dword [ebp - 0x10], edi
jle 0x405ebf
mov dl, byte [eax + ecx]
mov byte [ebp + ecx - 0x101c], dl
inc ecx
cmp ecx, edi
jl 0x405eb0
xor edi, edi
cmp dword [ebp - 0x10], ebx
mov dword [esi + 0x22f4], 1
jle 0x405efa
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
sub eax, edi
push ebx
push ecx
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp + edi - 0x101c]
push eax
push dword [esi + 0x2b0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x18]
cmp edi, dword [ebp - 0x10]
jl 0x405ed0
push dword [ebp - 0x10]
lea eax, [ebp - 0x101c]
mov ecx, esi
push eax
call fcn.0040700e
mov ecx, dword [ebp - 0x10]
inc dword [esi + 0x70]
add dword [esi + 0x6c], ecx
mov ecx, dword [0x43af2c]
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x14], ecx
push eax
mov edi, 0x43a698
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 4], ebx
call fcn.0041f191
add esp, 0xc
mov ecx, esi
push 0x426
call fcn.00423a68
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00423b56
push dword [esi + 0x6c]
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0041f191
add esp, 0xc
mov ecx, esi
push 0x428
call fcn.00423a68
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00423b56
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00424ce2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4060fa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x2b0]
cmp eax, 0xffffffff
je 0x40615b
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x406155
mov eax, 0x400
cmp ecx, eax
mov dword [ebp - 4], eax
ja 0x406133
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push dword [esi + 0x2b0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x40615b
mov eax, dword [ebp + 0xc]
and dword [eax], 0
pop esi
leave
ret 8