joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401eae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov dword [esp + 4], 0x40a129
mov dword [esp], str.estkme.app.bin
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401eea
mov dword [esp], str.estkme.app.bin_fopen___failed_r_n
call sym._printf
mov eax, 0xffffffff
jmp 0x402132
mov dword [esp], str.init_fwupd
call sym._printf
mov dword [esp], 1
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp], eax
call sym._fflush
call sym._card_poweron
call sym._card_poweroff
call sym._card_poweron
test eax, eax
jns 0x401f35
mov dword [esp], str.reset_1_failed_r_n
call sym._printf
mov eax, 0xffffffff
jmp 0x402132
call sym._fwupd_enter
call sym._card_poweroff
call sym._card_poweron
test eax, eax
jns 0x401f5e
mov dword [esp], str.reset_2_failed_r_n
call sym._printf
mov eax, 0xffffffff
jmp 0x402132
mov dword [esp], str.done_r_n
call sym._printf
mov dword [esp], str.unlocking
call sym._printf
mov dword [esp], 1
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp], eax
call sym._fflush
call sym._fwupd_unlock_part
test eax, eax
jns 0x401fab
mov dword [esp], str.failed_r_n
call sym._printf
mov eax, 0xffffffff
jmp 0x402132
mov dword [esp], str.done_r_n
call sym._printf
mov dword [ebp - 0xc], 0
jmp 0x4020cf
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x80d
mov dword [esp + 4], 1
lea eax, [ebp - 0x821]
mov dword [esp], eax
call sym._fread
test eax, eax
je 0x4020ca
cmp eax, 0x80d
je 0x402001
mov eax, 0xffffffff
jmp 0x402132
nop
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.program_block__d
call sym._printf
mov dword [esp], 1
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp], eax
call sym._fflush
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 4
jle 0x402060
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 4], str.send_failed_r_n
mov dword [esp], eax
call sym._fprintf
mov eax, 0xffffffff
jmp 0x402132
lea eax, [ebp - 0x821]
mov dword [esp], eax
call sym._fwupd_block_write
test eax, eax
jne 0x402086
lea eax, [ebp - 0x821]
mov dword [esp], eax
call sym._fwupd_block_verify
test eax, eax
je 0x40208d
jmp 0x402087
nop
add dword [ebp - 0x10], 1
jmp 0x402032
nop
call sym._fwupd_block_flash
test eax, eax
je 0x4020bc
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 4], str.flash_failed_r_n
mov dword [esp], eax
call sym._fprintf
mov eax, 0xffffffff
jmp 0x402132
mov dword [esp], str.done_r_n
call sym._printf
jmp 0x4020cb
nop
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._feof
test eax, eax
je 0x401fc3
call sym._fwupd_exit
test eax, eax
jns 0x402110
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 4], str.fwupd_exit_failed_r_n
mov dword [esp], eax
call sym._fprintf
mov eax, 0xffffffff
jmp 0x402132
mov dword [esp], 5
call dbg.sleep
call sym._card_poweroff
mov dword [esp], str.fwupd_done_r_n
call sym._printf
mov eax, 0
leave
ret
Function at 0x402400
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402460
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d080]
test esi, esi
jle 0x402580
mov eax, dword [0x40d084]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x402494
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x402517
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402480
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4025a7
mov eax, dword [0x40d084]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40d084]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402587
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402510
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x402520
add dword [0x40d080], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d084]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402510
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40249e
mov eax, dword [0x40d084]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x402ac0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d09c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d094]
sub esp, 4
test ebx, ebx
je 0x402b15
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x402b0e
test esi, esi
je 0x402b0e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402af0
mov dword [esp], 0x40d09c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402e50
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402e75
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402e80
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402e75
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402ec8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x402ebe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402eca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402eb0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4b1e90
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [esi]
sahf
insd dword es:[edi], dx
mov word [eax], cs
xor al, byte [ebp - 0x7424f68c]
jo 0x4b1df1
int3
jecxz 0x4b1e74
call 0xfded2b71
jbe 0x4b1deb
test dword [ecx], edx
aaa
xchg esp, eax
rcl dword [ecx + edx*2 + 0x35815068], 0xc
test byte [ebp + 0x5f], cl
sbb al, 0x22
xchg edx, eax
xor dword [0x5f4d840c], 0x9222d880
mov al, byte [0x82c5cca3]
dec edx
insd dword es:[edi], dx
out 0xa, eax
mov esi, 0xb9d4c3b
pop esp
int3
rol byte [edx + eax*4 + 0x1f], 0x23
or al, 0xe4
jmp 0x4b1e62

Function at 0x4bd6d0
Capabilities:
Encode data using xor

Disassembly:
push edx
dec eax
mov bh, 0x3d
sub byte [esi + edi*4], 0x38
push eax
dec esp
test dword [edi*2 - 0x29a428cb], ecx
scasd eax, dword es:[edi]
add byte [ebx], 3
imul edi, dword [eax], 0xd8529f0d
xchg ebp, eax
and byte [ebx - 0x7fb10f7b], bh
cld
pop ecx
in al, dx
pop ebp
inc eax
cmpsb byte [esi], byte es:[edi]
push cs
push edx
pop esi
push ebx
pop ecx
or esp, ebx
and al, 0x47
or al, 0xe8
push edi
or al, 0xb2
dec ebx
mov ds, word [eax + 0x500a595a]
mov ch, 0x80
pop esi
xor al, ch
pop ecx
adc byte [ebx - 0x84fe7b3], cl
lcall 0xde63, 0xc351fce8
neg byte [ebx + edx]
inc esi
addps xmm3, xmmword [ebp + 0x57]
push 0x67e62395
pop ebp
adc dword [ecx], ebp
and al, 0xe8
sahf
add edx, dword [esi]
sub dword [edx], ebx
in al, 0x55
pop es
or edx, dword [ebx - 0x1d]
nop
jne 0x4bd747
movsb byte es:[edi], byte [esi]
jb 0x4bd797
inc esp
pop ebx
pop esi
sbb al, 0x91
xchg ecx, eax
cld
in al, 0x99
sbb byte [eax], dl
sbb byte [ebx + 0xaa60845], cl
add al, 0x2a
inc esp
push edi
test eax, 0x5788dc0b
sbb al, 0x51
push edx
xor dword [eax], eax
push cs
sub dword [edx - 0x29e7ebaa], esp
xchg edx, eax
test byte [esi + 0x1d], ah
jnp 0x4bd75e
or esp, esp
aaa
sbb dword [eax - 0x72eb8c01], eax
jae 0x4bd7e3
out dx, al
adc ah, byte [ecx - 0x1d3e47b5]
add eax, 0x9a7a91e4
cmpsd dword [esi], dword es:[edi]
push ebx
inc ebx
and byte [ebx - 0xc], bh
lcall 0x5389, 0x7243ea2
push esp
adc edx, esi
aaa
dec ecx
invalid
aaa
out dx, eax
sal dword [ebx + 0xc], cl
jmp 0x4bd850
push ecx
or dword [ebp + 0x3d], esp
sbb edi, edi
mul dword [ecx]
popal
pop es
sbb dword [eax], 0x408ac003
mov edx, 0xe231fe3
jno 0x4bd8d3
ret 0xc5f0
xchg byte [esi], bl
cli
invalid
push cs
inc ebp
jge 0x4bd8cd
wait
adc eax, 0xbd1434b0
retf 0x15f8
Function at 0x4c5a80
Capabilities:
Encode data using xor

Disassembly:
int1
and esi, 0x33b204c7
fld dword [ecx - 0x38651b1d]
jg 0x4c5a62
retf
or al, 0x10
fldcw word [esi - 0x75]
xchg ecx, eax
js 0x4c5a7f
push esi
pop ebx
sbb esi, dword [edx + 0x48]
dec esi
dec esi
je 0x4c5a6c
add al, 0x26
cmp dword [edx + 0x58], 0
mov edx, 0x723266ef
jae 0x4c5a17
pop ebx
dec edx
mov edx, 0x91890c96
xor al, 0x68
inc ecx
sub bl, bl
fidiv word [ebp - 0x53]
push 0xdedb2841
jne 0x4c59f2
stc
adc al, 0xef
outsd dx, dword [esi]
pop esi
mov al, 0x81
sub ecx, dword [eax + 0x3e]
xor al, byte [ebx + 0x465fb3bf]
xchg ebp, eax
and dword [ecx + 0x28], 0
cmp ecx, dword [esi]
sub ax, 0x6f63
popal
add ah, al
jl 0x4c5a3e
loopne 0x4c5ae0
invalid
mov word [edi], ss
pop eax
cmc
cmovp eax, dword [ecx - 0x7c]
in al, 0x42
test ah, ah
inc edx
xor al, 0x8b
dec edx
imul ebx, dword [edx + 0x4215b5b6], 0x3cdc0a38
int3
lcall 0x9abc, 0x44c840a6
cmpsb byte [esi], byte es:[edi]
inc eax
enter 0xffffffffffffbc44, 0xffffffffffffff9a
or al, 0xdf
test byte [eax], 0x51
shl edi, cl
dec esi
add al, 0xd3
loopne 0x4c5a1d
pop edx
fcomp qword [edi - 0x6174ffdf]
dec edi
dec eax
mov ecx, 0xd35a69ac
inc esp
dec esi
push eax
mov ah, 0x14
or al, ah
sub byte [esi - 0x2f596597], ah
and al, 0xec
sub al, 0xe0
add dword [ebx], ecx
pushal
lcall 0xc6a8, 0x7d86c030
jne 0x4c5acb
invalid
hlt
retf 0xb6a8
Function at 0x4e6e40
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100d6068
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1010b334]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x40]
mov esi, ecx
lea edi, [esi + 0x10]
push edi
mov dword [esp + 0x44], edi
call dword [0x100e3050]
mov dword [esp + 0x34], 0
cmp dword [esi + 0x30], 0
je 0x4e6f6e
cmp dword [esp + 0x3c], 0
je 0x4e6f6e
test ebp, ebp
je 0x4e6f6e
cmp dword [esp + 0x44], 1
jb 0x4e6f6e
cmp dword [ebp + 4], 0
je 0x4e6f6e
cmp dword [esp + 0x50], 0
je 0x4e6f6e
add esi, 0x28
lea ebx, [esp + 0x3c]
lea eax, [esp + 0x20]
call fcn.004e9440
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esi + 4]
mov dword [esp + 0x20], esi
lea esi, [esp + 0x20]
lea edi, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
call fcn.00502e60
test al, al
je 0x4e6f54
mov esi, edi
call fcn.00508670
mov eax, dword [eax + 4]
xor ecx, ecx
cmp eax, ecx
je 0x4e6f54
mov edx, dword [esp + 0x3c]
mov dword [eax + 0x44], edx
mov edx, dword [ebp]
mov dword [eax + 0x48], edx
mov edx, dword [ebp + 4]
mov dword [eax + 0x4c], edx
mov edx, dword [esp + 0x44]
mov dword [eax + 0x60], edx
mov edx, dword [esp + 0x48]
mov dword [eax + 0x64], edx
mov edx, dword [esp + 0x4c]
mov dword [eax + 0x68], edx
mov edx, dword [esp + 0x50]
mov dword [eax + 0x6c], edx
mov edx, dword [esp + 0x54]
mov dword [eax + 0x70], edx
mov edx, dword [eax + 0x84]
add dword [eax + 0x80], edx
mov dword [eax + 0x74], ecx
mov dword [eax + 0x84], ecx
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x40]
push eax
call dword [0x100e3058]
mov eax, 1
jmp 0x4e6f7f
mov dword [esp + 0x34], 0xffffffff
push edi
call dword [0x100e3058]
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x1c
Function at 0x4e6fa0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100d6038
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1010b334]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
mov dword [esp + 0x18], ebx
call dword [0x100e3050]
xor edi, edi
mov dword [esp + 0x34], edi
cmp dword [esi + 0x30], edi
je 0x4e709d
cmp dword [esp + 0x3c], edi
je 0x4e709d
cmp dword [esp + 0x40], edi
je 0x4e709d
cmp dword [esp + 0x44], 1
jl 0x4e709d
add esi, 0x28
lea ebx, [esp + 0x3c]
lea eax, [esp + 0x20]
call fcn.004e9440
mov ecx, dword [eax]
cmp ecx, edi
mov ebx, dword [eax + 4]
mov ebp, dword [esi + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
je 0x4e702d
cmp ecx, esi
je 0x4e7032
call 0x536640
cmp ebx, ebp
je 0x4e7083
lea esi, [esp + 0x18]
call fcn.00508670
mov eax, dword [eax + 4]
cmp eax, edi
je 0x4e7083
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x44], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 0x4c], edx
mov edx, dword [eax + 0x84]
add dword [eax + 0x80], edx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x60], 1
mov dword [eax + 0x64], edi
mov dword [eax + 0x68], edi
mov dword [eax + 0x6c], edi
mov dword [eax + 0x70], edi
mov dword [eax + 0x74], edi
mov dword [eax + 0x84], edi
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
call dword [0x100e3058]
mov eax, 1
jmp 0x4e70ae
mov dword [esp + 0x34], 0xffffffff
push ebx
call dword [0x100e3058]
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x4eb090
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x100d8060
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1010b334]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1010b334]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x68]
xor ebx, ebx
mov eax, 7
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
mov byte [esp + 0x60], 1
mov eax, 0x100ebcc8
lea edx, [eax + 2]
jmp 0x4eb100
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4eb100
sub eax, edx
sar eax, 1
mov edi, eax
mov dword [esp + 0x18], edi
call fcn.004eab40
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], eax
call fcn.004eab40
mov esi, dword [eax + 8]
cmp esi, ebx
je 0x4eb1f8
cmp ebp, ebx
je 0x4eb1f8
push 0x208
push ebp
call dword [0x100e3064]
test eax, eax
jne 0x4eb1f8
mov ecx, 0x104
mov eax, ebp
cmp word [eax], bx
je 0x4eb166
add eax, 2
sub ecx, 1
jne 0x4eb154
jmp 0x4eb1f8
cmp ecx, ebx
je 0x4eb1f8
mov eax, 0x104
sub eax, ecx
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x4eb1f8
cmp eax, edi
jbe 0x4eb1ac
push edi
push 0x100ebcc8
push ebp
call 0x536c7b
add esp, 0xc
test eax, eax
jne 0x4eb1ac
mov edi, dword [esi]
xor ecx, ecx
call 0x50f7a0
mov edx, dword [esp + 0x18]
push eax
lea eax, [ebp + edx*2]
push eax
jmp 0x4eb1f2
call fcn.004eab40
lea ecx, [esp + 0x38]
call fcn.0050ded0
test eax, eax
je 0x4eb1f8
call fcn.004eab40
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebp
call fcn.004ebb70
test eax, eax
je 0x4eb1f8
cmp dword [esp + 0x34], 8
mov ebp, dword [esp + 0x20]
jae 0x4eb1e7
lea ebp, [esp + 0x20]
mov edi, dword [esi]
xor ecx, ecx
call 0x50f7a0
push eax
push ebp
mov edx, dword [edi]
mov ecx, esi
call edx
mov byte [esp + 0x60], bl
mov esi, 8
cmp dword [esp + 0x34], esi
jb 0x4eb214
mov eax, dword [esp + 0x20]
push eax
call 0x5352f4
add esp, 4
mov edi, 7
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
mov dword [esp + 0x60], 0xffffffff
cmp dword [esp + 0x50], esi
jb 0x4eb241
mov ecx, dword [esp + 0x3c]
push ecx
call 0x5352f4
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call 0x5361f8
add esp, 0x50
ret 4
Function at 0x4f3fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10105fc0
push 0x100b75a0
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x1010b334]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
xor ebx, ebx
mov dword [ebp - 0x274], ebx
push 0x24c
push ebx
lea ecx, [ebp - 0x270]
push ecx
call 0x53b4c0
add esp, 0xc
mov dword [ebp - 0x27c], ebx
cmp esi, ebx
jne 0x4f4052
xor eax, eax
jmp 0x4f415b
lea edx, [ebp - 0x274]
push edx
push esi
call dword [0x100e3288]
cmp eax, 0xffffffff
je 0x4f404b
push eax
call dword [0x100e3284]
mov edi, dword [ebp - 0x254]
cmp edi, 1
jb 0x4f404b
push 0
push 0x80
push 3
push 0
push 7
push 0x80000000
push esi
call dword [0x100e3060]
mov dword [ebp - 0x278], eax
cmp eax, 0xffffffff
je 0x4f404b
push edi
call 0x52e8d2
add esp, 4
mov esi, eax
mov dword [ebp - 0x284], esi
test esi, esi
je 0x4f414c
push edi
push 0
push esi
call 0x53b4c0
add esp, 0xc
push 0
lea eax, [ebp - 0x27c]
push eax
push edi
push esi
mov ecx, dword [ebp - 0x278]
push ecx
call dword [0x100e3074]
test eax, eax
je 0x4f413f
cmp dword [ebp - 0x27c], edi
jne 0x4f413f
xor eax, eax
test edi, edi
jbe 0x4f40fb
lea ebx, [ebx]
xor byte [eax + esi], 0x4e
add eax, 1
cmp eax, edi
jb 0x4f40f0
mov dword [ebp - 4], ebx
mov edx, dword [ebp - 0x280]
push edx
push edi
mov ecx, esi
call fcn.004f3b20
add esp, 8
mov ebx, eax
mov dword [ebp - 0x288], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x4f413f
test esi, esi
je 0x4f414c
push esi
call 0x536511
add esp, 4
mov eax, dword [ebp - 0x278]
push eax
call dword [0x100e3264]
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call 0x5361f8
mov esp, ebp
pop ebp
ret
Function at 0x4fc340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100e0e48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1010b334]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x1010b334]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], esi
mov word [esp + 0xc], si
mov dword [esp + 0x30], esi
push 0x15
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004fc520
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x4fc3b3
mov ecx, dword [esp + 0xc]
push ecx
call 0x5352f4
add esp, 4
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], esi
mov word [esp + 0xc], si
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call 0x5361f8
add esp, 0x2c
ret 4
Function at 0x50d890
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x50d8d2
cmp edi, 0xb
jl 0x50d8d2
push edi
push esi
call dword [0x100e3064]
test eax, eax
jne 0x50d8d2
mov eax, edi
call fcn.0050d560
test eax, eax
je 0x50d8d2
push 0x100f1cf8
push esi
call 0x537fb0
add esp, 8
test eax, eax
je 0x50d8d2
pop esi
lea ecx, [eax + 4]
pop ebx
jmp fcn.0050d7e0
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x401290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._10
call sym._9
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._7
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp], 0xea60
call sub.KERNEL32.dll_Sleep
sub esp, 4
call sym._rand
mov ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
add eax, edx
sub ecx, eax
mov eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._8
jmp 0x4012d7
Function at 0x4016c6
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
mov dword [esp], 0x3a98
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
cmp dword [eax*4 + section..data], 0
je 0x4016cf
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax*4 + section..data]
mov dword [esp + 4], eax
lea eax, [ebp - 0x378]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax*4 + section..data]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.
lea eax, [ebp - 0x268]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
lea eax, [ebp - 0x268]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
je 0x4017fb
cmp dword [ebp - 0x148], 0x20
jne 0x40175f
mov eax, dword [ebp - 0x48c]
mov dword [esp + 4], 0x404000
mov eax, dword [eax*4 + section..data]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4017bb
lea eax, [ebp - 0x148]
add eax, 0x2c
mov dword [esp], eax
call sym._6
jmp 0x40175f
lea eax, [ebp - 0x148]
add eax, 0x2c
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x378]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sym._6
jmp 0x40175f
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea eax, [ebp - 0x48c]
inc dword [eax]
jmp 0x4016e8