joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466874
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46688b
add esp, 0xfffffff0
call fcn.00403c18
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f09c
mov eax, dword [0x4a2444]
cmp word [eax + 2], 0
jne 0x4668b3
mov eax, dword [0x4a2444]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00467fdc
mov eax, dword [0x4a258c]
cmp word [eax + 2], 0
jne 0x4668cd
mov eax, dword [0x4a258c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004681d4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415e04]
call fcn.004038c4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415e04]
call fcn.004038c4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x421698]
call fcn.004293e8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x466a54
mov eax, dword [0x4a22b8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004297b8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x468784
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4a22b8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d260
test eax, eax
je 0x4669c2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409330
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d288
test eax, eax
je 0x4669d6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404938
mov eax, dword [0x4a2068]
cmp byte [eax], 0
jne 0x466a0a
mov eax, ebx
call fcn.00466b7c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00468960
mov eax, ebx
call fcn.00469324
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x466a4a
call fcn.00403c70
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466dfc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a3be4]
cmp dword [eax + 0x30], 0
je 0x466ea6
cmp dword [ebx + 0x94], 0
jne 0x466ea0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x466d8c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x466ea0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x466e66
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x466ea0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004184bc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x466e75
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x467a08
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x467a3d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047b8
jmp 0x467a4a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040471c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x468b3c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x468b7d
mov eax, esi
call fcn.0044e168
test al, al
je 0x468b7d
mov eax, dword [ebx + 0x84]
call fcn.0044de64
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x468b7d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044de64
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x46c244
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46c272
mov eax, ebx
call fcn.0046ccf8
cmp dword [ebx + 0x40], 0
je 0x46c26b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46c2e3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46c2d5
cmp dword [ebx + 8], 0
je 0x46c294
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46c2a6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46c2d5
cmp dword [ebx + 8], 0
je 0x46c287
cmp eax, 3
je 0x46c2b9
dec eax
jne 0x46c287
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46c287
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46c287
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46c301
cmp dword [ebx + 0x14], 0xcc
je 0x46c301
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046c30c
pop ebx
ret
Function at 0x48ac28
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48ac30
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48ae22
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x48ae38
mov eax, esi
call fcn.00488ab4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040471c
lea ecx, [ebp - 0x10]
mov edx, 0x48ae4c
mov eax, esi
call fcn.00488ab4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040471c
lea ecx, [ebp - 0x14]
mov edx, 0x48ae64
mov eax, esi
call fcn.00488ab4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040471c
lea ecx, [ebp - 0x18]
mov edx, 0x48ae80
mov eax, esi
call fcn.00488ab4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040471c
lea ecx, [ebp - 0x1c]
mov edx, 0x48ae9c
mov eax, esi
call fcn.00488ab4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040471c
lea ecx, [ebp - 0x24]
mov edx, 0x48aeb4
mov eax, esi
call fcn.00488ab4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408990
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408d70
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x48aecc
mov eax, esi
call fcn.00488ab4
mov eax, dword [ebp - 0x28]
call fcn.0048258c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x48aedc
mov eax, esi
call fcn.00488ab4
mov eax, dword [ebp - 0x2c]
call fcn.0048258c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x48aef4
mov eax, esi
call fcn.00488ab4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408d70
inc eax
je 0x48adc5
lea ecx, [ebp - 0x34]
mov edx, 0x48aef4
mov eax, esi
call fcn.00488ab4
mov eax, dword [ebp - 0x34]
call fcn.00408d34
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a2a0
fstp qword [ebp - 0x3c]
wait
call fcn.0040a604
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48ade0
lea ecx, [ebp - 0x40]
mov edx, 0x48aef4
mov eax, esi
call fcn.00488ab4
mov eax, dword [ebp - 0x40]
call fcn.0048258c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x48af04
mov eax, esi
call fcn.00488ab4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040471c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ae29
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004046ec
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004046ec
ret
Function at 0x491bb4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x491c0e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00491ba4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004810fc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00480cfc
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491c15
lea eax, [ebp - 4]
call fcn.004046c8
ret

Function at 0x49b418
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x49b550
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov ecx, dword [ebp - 4]
mov dl, 0x5c
mov eax, ebx
call fcn.0049b3b4
mov ebx, eax
test ebx, ebx
jle 0x49b532
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404be8
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404b88
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x49b532
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404988
mov ecx, eax
sub ecx, ebx
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.00404be8
cmp dword [ebp - 0xc], 0
jne 0x49b4b7
xor esi, esi
jmp 0x49b4c1
mov eax, dword [ebp - 0xc]
call fcn.00404b88
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49b529
mov eax, dword [ebp - 0x18]
call fcn.0040276c
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49b522
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
jne 0x49b519
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov byte [ebp - 5], 1
jmp 0x49b529
mov eax, ebx
call fcn.0040278c
jmp 0x49b529
mov eax, ebx
call fcn.0040278c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b557
lea eax, [ebp - 0xc]
call fcn.004046c8
lea eax, [ebp - 4]
call fcn.004046c8
ret
Function at 0x49b60c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x49b71b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov ecx, dword [ebp - 4]
mov dl, 0x5c
mov eax, ebx
call fcn.0049b3b4
mov ebx, eax
test ebx, ebx
jle 0x49b6fd
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404be8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404b88
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x49b6fd
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404988
mov ecx, eax
sub ecx, ebx
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.00404be8
cmp dword [ebp - 0xc], 0
jne 0x49b6ce
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 5]
jmp 0x49b6f4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404b88
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 5]
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b722
lea eax, [ebp - 0xc]
call fcn.004046c8
lea eax, [ebp - 4]
call fcn.004046c8
ret
Function at 0x88a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x88a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88a06a
add dl, dl
jne 0x88a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88a0dc
xor eax, eax
add dl, dl
jne 0x88a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88a17d
add dl, dl
jne 0x88a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x88a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x88a075
mov eax, 1
add dl, dl
jne 0x88a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88a0e1
sub eax, ebx
mov ebx, 1
jne 0x88a128
mov ecx, 1
add dl, dl
jne 0x88a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88a136
cmp eax, 0x7d00
jae 0x88a16d
cmp eax, 0x500
jb 0x88a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88a075
cmp eax, 0x7f
ja 0x88a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x88a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x930208
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x93020e
pop ebp
sub ebp, 6
sub ebp, 0x530208
jmp 0x93026c
jmp 0x930275
mov eax, 0x530208
add eax, ebp
add eax, 0x93
mov ecx, 0x641
mov edx, 0x8bbf0ba5
xor byte [eax], dl
inc eax
dec ecx
jne 0x93028c
jmp 0x93029f
iretd
Function at 0x11c4a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.11c4a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x11c4a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11c4a06a
add dl, dl
jne 0x11c4a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11c4a0dc
xor eax, eax
add dl, dl
jne 0x11c4a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11c4a17d
add dl, dl
jne 0x11c4a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11c4a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11c4a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11c4a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11c4a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11c4a075
mov eax, 1
add dl, dl
jne 0x11c4a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11c4a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11c4a0e1
sub eax, ebx
mov ebx, 1
jne 0x11c4a128
mov ecx, 1
add dl, dl
jne 0x11c4a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11c4a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11c4a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11c4a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x11c4a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11c4a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11c4a136
cmp eax, 0x7d00
jae 0x11c4a16d
cmp eax, 0x500
jb 0x11c4a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11c4a075
cmp eax, 0x7f
ja 0x11c4a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11c4a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x11c4a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11c4a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x4421ac], 1
mov dword [0x4421b0], 1
mov dword [0x4421b4], 1
mov dword [0x4421a0], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401415
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401438
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x40145a
cmp eax, 0x20b
je 0x40147f
jmp 0x4014aa
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x40146c
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401497
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, 0
leave
ret
Function at 0x4061c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, 0x7fffffff
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x60]
mov ebp, dword [esp + 0x64]
cmp eax, esi
mov eax, 0
sbb eax, ebp
jb 0x4062c0
mov ebx, ecx
mov ecx, esi
call sym._mnewString_4
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x38], edx
mov eax, edx
mov dword [esp + 0x3c], ecx
test edx, edx
jle 0x406300
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
add eax, 4
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._fread
mov edi, eax
cmp esi, eax
je 0x406243
mov dword [esp], ebx
call sym._ferror
test eax, eax
jne 0x406318
mov dword [esp], 0x4331ac
call sym.___emutls_get_address
cmp byte [eax], 0
mov dword [esp + 0x20], eax
jne 0x4062a3
mov dword [esp], ebx
call sym._fgetc
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0x2c], eax
call sym._ungetc
mov eax, dword [esp + 0x20]
cmp byte [eax], 0
jne 0x4062a3
mov edx, dword [esp + 0x2c]
test edx, edx
jns 0x406328
mov eax, edi
cdq
cmp edi, esi
mov ebx, edx
sbb ebx, ebp
jge 0x4062a3
test edi, edi
js 0x4063b0
mov edx, edi
lea ecx, [esp + 0x38]
call sym._setLengthStrV2_8
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 0x4c
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
ret 8
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], edx
call sym._raiseRangeErrorI
mov edx, dword [esp + 0x20]
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8
sub eax, 1
mov dword [esp], 0
mov dword [esp + 4], eax
call sym._raiseIndexError2
jmp 0x4062a3
mov ecx, ebx
call sym._checkErr__stdZsyncio_u162_4.part.0
jmp 0x406243
mov ecx, ebx
call sym._readAllBuffer__stdZsyncio_u516_4
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, edx
cmp byte [eax], 0
jne 0x406387
mov edx, ebx
lea ecx, [esp + 0x38]
call sym._prepareAdd_8
test ebx, ebx
jle 0x406387
mov eax, ebx
add eax, 1
jo 0x4063e1
test eax, eax
js 0x4063f0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov dword [esp + 8], eax
lea edx, [ecx + edx + 4]
lea ecx, [esi + 4]
mov dword [esp + 4], ecx
mov dword [esp], edx
call sym._memcpy
add ebx, dword [esp + 0x38]
jo 0x4063e1
mov dword [esp + 0x38], ebx
test esi, esi
je 0x4062a3
test dword [esi], 0x40000000
jne 0x4062a3
mov dword [esp], esi
call sym._deallocShared
jmp 0x4062a3
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp], edi
mov dword [esp + 4], edx
call sym._raiseRangeErrorI
jmp 0x4062a3
call sym._raiseOverflow
jmp 0x406387
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0x80000000
mov dword [esp + 4], 0xffffffff
call sym._raiseRangeErrorI
jmp 0x406387
Function at 0x4066d0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x14
test edx, edx
je 0x4066e7
mov dword [esp], edx
call sym._strlen
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
call sym._fwrite
mov dword [esp], esi
call sym._fflush
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40d270
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x10
mov eax, dword [0x442098]
test eax, eax
je 0x40d2f0
test ecx, ecx
je 0x40d2d0
mov dword [esp], ecx
call sym._strlen
mov ecx, ebx
mov edx, eax
call sym._toNimStr_8
mov dword [esp], eax
mov ebx, edx
mov dword [esp + 4], edx
call dword [0x442098]
sub esp, 8
test ebx, ebx
je 0x40d2b4
test dword [ebx], 0x40000000
je 0x40d330
mov dword [esp], 0x4331ac
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x40d350
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0
mov dword [esp + 4], 0
call eax
sub esp, 8
jmp 0x40d2b4
mov esi, edx
mov dword [esp], 2
call dword [0x4332d8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov edi, eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
call sym._fwrite
mov dword [esp], edi
call sym._fflush
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0x4331bc
call sym.___emutls_get_address
mov edx, ebx
mov ecx, eax
call sym._rawDealloc__system_u6963_8
jmp 0x40d2b4
mov byte [eax], 0
mov dword [esp], 0x43314c
call sym.___emutls_get_address
mov ecx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov dword [esp], 0
call sym._eqcopy___stdZtypedthreads_u169_12
sub esp, 4
jmp 0x40d2c9

Function at 0x40e2d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
test eax, eax
jle 0x40e320
lea ebx, [eax + edx + 4]
lea ecx, [edx + 4]
xor eax, eax
lea esi, [esi]
lea esi, [esi]
movzx edx, byte [ecx]
add ecx, 1
add edx, eax
mov eax, edx
shl eax, 0xa
add eax, edx
mov edx, eax
shr edx, 6
xor eax, edx
cmp ebx, ecx
jne 0x40e2f0
lea eax, [eax + eax*8]
pop ebx
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 0xf
add eax, edx
ret 8
xor eax, eax
pop ebx
ret 8