joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16a9fe4
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x3530ba10
dec edx
neg dword [esp + ecx - 0x307438d4]
sbb ecx, dword [esp + ecx*2 - 0x60e871a8]
shl al, cl
bswap edx
sbb eax, dword [esp + ecx - 0x60e871a7]
setb cl
xchg dword [esp + ecx - 0x60e87100], eax
inc edx
shl ecx, 0x9b
not edx
shr eax, 9
push eax
xor ebx, edx
sal cx, 0xa5
adc edi, edx
mov dword [esp + ecx], edi
ret 4
mov dword [esp], edi
mov edi, 0x301b1883
push edi
movzx edi, byte [ecx + edi - 0x301b1883]
xor edi, eax
and edi, 0xff
sal dword [esp], 0xaf
mov edi, dword [edi*4 + 0x17a0c10]
shr eax, 8
xor eax, edi
and dword [esp], 0x7789d423
inc ecx
xor eax, 0xf510a497
dec edx
lea esp, [esp + 4]
jne 0x16a9fe7
mov ecx, 0x4c8d2c0e
pop edi
push 0xcf8bc72c
not eax
neg dword [esp]
mov dword [ebp], eax
mov edx, dword [esp]
lea esi, [esi + edx*2 - 0x60e871ac]
push edx
setb dl
movzx ecx, dl
mov edx, dword [edx + esi - 0x30743801]
pop ecx
xor edx, ebx
movsx eax, byte [esp + ecx - 0x307438d4]
jmp 0x12758d4

Function at 0x1748984
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x17465dc
mov eax, 0x5a4d
clc
stc
cmp word [edx], ax
jmp 0x17465d6
je 0x17465dc
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x12973de
je 0x1227290
push ebp
add bp, bp
movsx edx, ax
bswap dx
mov ebp, esp
ror dl, 0xa7
inc dx
rcl dx, cl
mov edx, dword [ebp + 8]
cmp ebx, 0x419958bb
clc
lea esp, [esp - 0x114]
cmp ecx, edx
cmc
push esi
test sp, di
test edx, edx
jmp 0x12b7170

Function at 0x1749cc5
Capabilities:
Get number of processors

Disassembly:
lea esi, [edx + esi - 0x4a1f93a9]
neg esi
rol esi, 1
inc eax
movzx eax, bh
not eax
inc ecx
xor dh, 0x2d
xor esi, 0xfca2229e
sub esi, 0xda819296
inc ecx
pop esp
dec eax
mov dword [esp + edx + 8], ecx
inc ecx
and edi, 0x1c25538b
dec eax
mov dword [esp + edx + 0x10], ebx
sal al, cl
xor dword [esp + edx + 0x10], esi
dec eax
sal ecx, 2
setae byte [esp + edx*4 + 0xc]
dec eax
mov ebx, dword [esp + ebp*2 - 0x36]
dec eax
arpl si, si
setbe cl
call fcn.016754a6
dec esp
mov dword [esp + ebp - 0x791bb318], esi
inc esp
xor bl, bl
dec eax
mov dword [esp + ebp - 0x791bb338], ebp
mov ecx, 0xdf35941e
xchg word [esp + ebp - 0x791bb306], di
inc ecx
ror bl, 1
dec eax
xadd dword [esp + ebp - 0x791bb320], ecx
inc ecx
xchg al, dh
inc ecx
neg bl
inc ecx
neg dh
or cx, 0xfe2e
inc ecx
inc bl
inc edx
inc esp
xor bl, bh
call fcn.016885be

Function at 0x1749d74
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
inc edx
lea edi, [edi - 0x3bc2c2f]
mov ecx, 0x481fbb19
xor edi, 0x58278181
not edi
inc ecx
pop edi
inc esi
xadd byte [esp - 0x1a], bl
neg edi
dec esp
lea esi, [ecx - 0x7f541159]
dec esi
xchg dword [esp - 0x20], eax
inc edx
lea edi, [edi + esi*4 - 0xeb836a2]
inc esi
xchg byte [esp - 0xc], bl
inc esi
mov byte [esp - 0x1c], al
inc ecx
movzx esi, si
neg edi
inc edx
xor byte [esp - 0x19], 0x3c
inc dx
or ebp, dword [esp - 0xf]
dec ecx
add esi, ebx
inc edx
lea edi, [edi + esi - 0x48d90cff]
inc si
adc eax, dword [esp - 0xd]
neg edi
not ebp
inc ecx
push eax
call fcn.01276f19
jge 0x1749dec
test al, 0xf6
imul esp, dword [edx], 0x10
xchg edi, eax
lodsd eax, dword [esi]
sal byte [edx], cl
add al, 0x37
Function at 0x174bade
Capabilities:
Parse pe header

Disassembly:
push 0x77bca824
xor eax, eax
test edx, edx
lea esp, [esp + 0xc]
je 0x17d0248
push esi

Function at 0x175ab97
Capabilities:
Encode data using xor

Disassembly:
rol edx, 2
sub al, 0x97
and ecx, ecx
bswap edx
add ecx, ecx
shr al, 0x62
rol edx, 2
sub edx, 0xc681d52b
not edx
dec edx
dec cx
call fcn.012596a9
sti
test al, 0x15
or byte [esi + ebx - 0x81fc2b2], dh
pop eax
enter 0x5fb1, 0x16
aad 0x81
invalid
push ds
dec esi
cmp eax, 0xc858f7e0
mov cl, 0x5f
push ss
or byte [esi], al
jle 0x175abc5
pop edi
push ss
or ah, al
xor bh, byte [ebp + 0x3e08165f]
xor byte [ecx + 0x3c08165f], ah
mov word [esi], ds
cmp al, 0x8c
push ds
loopne 0x175ac01
fcom dword [edi - 0x46]
adc al, 0x91
push edx
ror byte [ecx + ebx*4 + 0x58483f36], 1
mov dl, 0xf9
pop edi
inc ebp
mov ebx, dword [eax]
xor eax, 0xad3614a0
aas
dec edx
adc ebp, dword [eax + 0x1c]
jge 0x175abab
jle 0x175abbe
mov ah, 0xef
loop 0x175abdb
je 0x175ac75
sub eax, ebx
dec edi
mov esp, 0xced7a7c3
inc esp
push cs
lcall 0xdc37, 0x8afedd02
xor eax, 0xb2764e7a
add dword [ecx], ebx
lcall 0xa247, 0x53d36ef6
loop 0x175ac0c
fist word [ebx + 0x47]
mov byte [0x53d30e7e], al
inc edi
mov byte [0x53a70ab2], al
inc edi
mov byte [0x7f6f5fa6], al
add dword [esi - 0x75], esp
mov cx, word [ebp]
add ebp, 2
sub esi, 1
call 0x168519c
add edi, eax
sar ecx, 0xc3
Function at 0x17a86da
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
dec eax
mov dword [esp], 0x2a330581
dec ebp
test eax, eax
dec eax
lea esp, [esp + 8]
je 0x12ad2a8
mov ecx, 0x2c125813
inc ecx
push ebp
neg cx
jp 0x12ad259
dec eax
lea ecx, [0xfff86bf8]
inc esp
movzx ebp, byte [edi]
push 0x2c957418
inc esp
xor ebp, edx
inc ecx
and ebp, 0xff
inc esi
mov ebp, dword [ecx + ebp*4]
shr edx, 8
inc ecx
xor edx, ebp
dec eax
inc edi
xor edx, 0x1424eab3
dec eax
neg dword [esp]
dec ecx
dec eax
dec eax
lea esp, [esp + 8]
jne 0x12ad260
inc ecx
mov eax, 0x57893ebe
inc ecx
movsx ecx, al
inc ebp
movsx esp, al
inc ecx
pop ebp
mov ecx, 0xdd31e28e
call fcn.016803bd
mov edx, 0x360d2f3c
movsx ecx, dx
mov ecx, dword [ebp + edx - 0x360d2f3c]
shr dx, 0xc9
sal edx, 0x61
mov dl, byte [ebp + edx - 0x6c1a002a]
mov eax, 0xb21f82a
dec ax
dec ecx
add ecx, 0xc
jmp 0x12620f8

Function at 0x17b4385
Capabilities:
Encode data using xor

Disassembly:
inc ecx
inc eax
dec ebp
arpl si, si
neg bp
movzx eax, bp
inc cx
dec edi
dec ebp
add edx, esi
inc esp
movzx esi, bp
inc ecx
sal bl, cl
inc ecx
neg eax
dec ebp
mov ebx, dword [ecx + edi - 0x1ffeef]
inc cx
shr esi, 7
xor bp, ax
jge 0x1248cab
neg eax
dec eax
mov edx, ecx
neg eax
fadd st(1)
loop 0x1791911
shl edx, 0xfd
xor ebx, eax
call fcn.012347b5
inc ecx
imul ecx, dword [edx + 0x31a4b61f], 0x41f8ad0
call 0x2103e995
mov word [eax], gs
inc ecx
ror byte [edx + 0x35a4781f], 1
fldenv [esi - 0x3ea2e213]
sbb ch, bh
je 0x1791910
and al, 0x13
and dword [esi + 0x17582fe4], eax
mov bl, 0x86
aaa
push ds
aad 0x79
enter 0x4ed0, 0xffffffffffffff86
movsd dword es:[edi], dword [esi]
wait
invalid
inc ecx
ror esi, 2
inc ecx
mov ebx, 0xac174999
dec eax
mov dword [esp + edi*4 - 0x7ffbbc], ebx
dec ecx
bswap edi
shr cl, 0x45
inc esp
xor dword [esp + edi*2 - 0x3ffdde], esi
dec esp
lea eax, [ecx + edi*2 - 0x67d51979]
pop ebx
jmp 0x17918d7
Function at 0x17b72e9
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + edi*4 - 0x34], eax
dec edi
lea ebp, [edi + ebp - 9]
call fcn.0167ca18
scasd eax, dword es:[edi]
outsb dx, byte [esi]
lds ecx, [ecx - 0x4c]
loopne 0x17b72f3
arpl word [ecx - 0x4c], bx
dec ebx
push esi
xor cl, byte [ebx + 0x59]
mov ah, 0x4b
loop 0x17b7355
sub ebx, dword [ecx - 0x4c]
dec ebx
test byte [esi + 0x4bb4593f], ah
xchg edx, eax
pushfd
or ebx, dword [ecx - 0x4c]
dec ebx
cmpsb byte [esi], byte es:[edi]
inc eax
and byte [ecx - 0x73b77aae], dl
test dword [edx - 0x49836abf], ecx
popfd
and al, bl
stosd dword es:[edi], eax
push edx
pop es
std
pop ss
jnp 0x17b738e
lds ecx, [ebp + edx - 0x237e6664]
mov word [ecx - 0x5e], cs
xchg ebp, eax
add eax, 0xa2498cb8
std
xor eax, 0xa2498ce8
and eax, 0x498caca9
mov byte [0x71b0340d], al
add dword [ebx - 0x81a0c4e], esp
mov dword [0xf7e5f3b2], eax
or dword [edx - 0x64e5f1d2], ecx
ja 0x17b7344
push cs
sbb bh, byte [ecx + 0x5d]
ret 0xe2e
mov edi, 0x9c158c69
xchg ebp, eax
stc
jl 0x17b7323
dec ecx
mov byte [0x8c147195], al
dec ecx
mov byte [0x8c000d25], al
dec ecx
mov byte [0x8c7441b5], al
dec ecx
mov byte [0x71b0d091], al
add dword [edx - 0x3e], eax
mov byte [ecx], cl
mov byte [0x13aa8432], al
jne 0x17b73e4
mov dword [0x58a7e12f], eax
xchg edx, eax
cmp eax, 0x2521dcad
enter 0x3e01, 0xfffffffffffffffb
mov ch, 0xb6
int 0x19
fnsave dword [edx]
invalid
pop edi
lcall 0x207, 0xc01c2203
and esp, edi
into
mov ah, 0x38
inc esi
lodsb al, byte [esi]
pop ss
push ds
popfd
push ss
bound esp, qword [edx]
cdq
test eax, 0xfc6110e4
pushal
cmp eax, 0x6bd5f887
daa
pushfd
hlt
Function at 0x131562b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4000]
push edi
or ebp, 0xffffffff
jmp 0x131562d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x131562d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x131562c8
mov eax, 1
add ebx, ebx
jne 0x131562eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x131562e0
jne 0x131562fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x131562e0
xor ecx, ecx
sub eax, 3
jb 0x13156310
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x13156382
mov ebp, eax
add ebx, ebx
jne 0x1315631b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x13156328
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1315634c
inc ecx
add ebx, ebx
jne 0x13156338
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1315632d
jne 0x13156349
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1315632d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1315636c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1315635d
jmp 0x131562ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1315636c
add edi, ecx
jmp 0x131562ce
pop esi
mov edi, esi
mov ecx, 0x4e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1315638a
cmp byte [edi], 1
jne 0x1315638a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1315638f
lea edi, [esi + 0x4000]
mov eax, dword [edi]
or eax, eax
je 0x131563fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x131563bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6068]
or eax, eax
je 0x131563f8
mov dword [ebx], eax
add ebx, 4
jmp 0x131563d9
call dword [esi + 0x6078]
mov ebp, dword [esi + 0x606c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x13156432
sub esp, 0xffffff80
jmp 0x131523ab
Function at 0x4dffe0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x89000]
push edi
jmp 0x4dfffa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e0001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dfff0
mov eax, 1
add ebx, ebx
jne 0x4e0013
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e0024
jne 0x4e0043
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e0043
dec eax
add ebx, ebx
jne 0x4e0030
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e0008
add ebx, ebx
jne 0x4e003f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e0095
xor ecx, ecx
sub eax, 3
jb 0x4e005b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e00ca
sar eax, 1
mov ebp, eax
jmp 0x4e0066
add ebx, ebx
jne 0x4e0066
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e0034
inc ecx
add ebx, ebx
jne 0x4e0074
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e0034
add ebx, ebx
jne 0x4e0081
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e0076
jne 0x4e0092
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e0076
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e00b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e00a6
jmp 0x4dfff6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e00b4
add edi, ecx
jmp 0x4dfff6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e00d2
cmp byte [edi], 0x11
jne 0x4e00d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e00d7
lea edi, [esi + 0xd8000]
mov eax, dword [edi]
or eax, eax
je 0x4e014f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe6bc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe6d3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e0104
mov ecx, edi
jns 0x4e0133
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe6d40]
or eax, eax
je 0x4e0149
mov dword [ebx], eax
add ebx, 4
jmp 0x4e0121
call dword [esi + 0xe6d50]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e0180
cmp al, 0xef
ja 0x4e0173
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e0155
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e0162
mov ebp, dword [esi + 0xe6d44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e01b4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x401407
Capabilities:
Terminate process

Disassembly:
push ebx
mov eax, 0x5765e6
mov ebx, 0x12345678
mov ecx, 0x12345678
mov edx, 0x12345678
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
jmp loc.0047b432
Function at 0x109b3310
Capabilities:
Encode data using xor

Disassembly:
into
push esp
fisubr dword [ebx - 0x92089c0]
das
ja 0x109b330f
add bl, ch
or byte [eax], al
add ax, word [eax]
add byte [eax], al
add byte [eax], al
jmp 0x109b331a
pushal
call 0x109b3320
pop ebp
sub ebp, 0x10
sub ebp, 0x9b3310
mov al, byte [esp + 0x28]
cmp al, 1
je 0x109b3344
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x109b334d
mov eax, 0x9b3310
add eax, ebp
add eax, 0x63
mov ecx, 0x5e1
mov edx, 0x99b48881
xor byte [eax], dl
inc eax
dec ecx
jne 0x109b3364
jmp 0x109b3377
or cl, byte [edx + ecx + 8]
mov ebp, 0x818181
inc eax
jns 0x109b3304
add dword [ecx - 0x7ac6b37e], 0x3b818181
test eax, 0x76818181
arpl word [edx - 0x72fff5b7], ax
add dword [ecx + 0xc448281], 0x87da5e5
test dword [ebp + 0x7da5e50c], esp
or byte [ebp - 0x6c06165b], al
mov al, byte [0xa117e981]
sti
add dword [eax - 0x4f165a53], 0x69f6aeaf
test byte [ecx - 0x4a977e7f], al
add dword [ecx - 0x5a1af37f], 0xa5ad087d
aad 0xdc
or al, byte [ecx + ecx*4]
add dword [ecx - 0x72ebf57f], 0xa818181
or al, 0x91
add dword [ecx - 0x7c97bf7f], 0x430283b0
test eax, ecx
mov es, word [esi*2 + 0xa7e7e7e]
lodsd eax, dword [esi]
movsd dword es:[edi], dword [esi]
or al, 0xe5
movsd dword es:[edi], dword [esi]
test dword [ebx - 0x73], eax
or dword [edx], 0x8185a50d
add dword [ecx - 0x5f6c0617], 0xa117e981
sti
add dword [eax + 0x69d0a5ad], 0x81818184
push 0x818183cc
or al, 0xe5
movsd dword es:[edi], dword [esi]
jge 0x109b3427
lodsd eax, dword [esi]
movsd dword es:[edi], dword [esi]
or al, 0xed
movsd dword es:[edi], dword [esi]
cmp dword [esi - 0xc], 0x89f47e8d
imul edi, ecx, 0xa818181
cmp al, 0x89
add dword [ecx + 0x48b281], 0xb56173
lea edi, [esi - 0xc]
mov dword [ecx - 7], ebp
add dword [ecx - 0x76c3f57f], 0xb2818181
dec eax
add byte [ebx + 0x61], dh
mov ch, 0
or dword [eax], eax
jae 0x109b34a2
mov ch, 0
or dword [edx - 0x7b96fdad], esi
leave
mov es, word [0x818181cf]
mov cs, word [ecx]
leave
add dword [ecx - 0x62f5187f], 0x697a01b8
mov es, word [0x8181819b]
add dword [edx + 0x68], edi
mov es, word [0x81818190]
out 0, eax
jp 0x109b34ee
movsb byte es:[edi], byte [esi]
mov es, word [0x81818194]
shr byte [eax + 0x4d], 0x7e
jle 0x109b34fb
test al, 0xcd
mov eax, 0x84400280
add ch, byte [ecx - 0x7b]
push 0x7e7e7e3c
test al, 0xd5
mov eax, 0x87400283
add ch, byte [ebx - 0x7b]
add ch, byte [ecx - 0x7c]
push 0x7e7e7e2a
or ch, byte [ebp - 0x5a1af35b]
in eax, 0xa5
test dword [ebx - 0x73], eax
adc esp, 0xd6d76d0a
aam 0xa
hlt
jmp 0x109b3471
or dword [ebx], 0x5393c797
mov es, word [edx]
stosd dword es:[edi], eax
add byte [ecx - 0x71ac7c7f], 4
test byte [ecx - 0x68f47e7f], al
invalid

Function at 0xae89f4
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae89f4
ret
Function at 0x401c6f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
add eax, 0x40
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
shl eax, 6
add dword [ebp - 0x10], eax
cmp dword [ebp + 8], 1
jg 0x401ca3
cmp dword [ebp + 8], 0
jns 0x401cb1
jmp 0x401d0b
cmp dword [ebp + 8], 2
jne 0x401d0b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x401d0c
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x40
je 0x401d03
mov dword [esp + 4], 0x145
mov dword [esp], str.ERR_L_d_:
call fcn.0041ce30
mov dword [esp], str.Fail_to_read_item_head_n
call fcn.0041ce30
mov eax, 0
jmp 0x401d42
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x401d0c
nop
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, 0x27051956
je 0x401d3f
mov dword [esp + 4], 0x150
mov dword [esp], str.ERR_L_d_:
call fcn.0041ce30
mov dword [esp], str.Item_magic_error._n
call fcn.0041ce30
mov eax, 0
jmp 0x401d42
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x402b24
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0xff
ja 0x402b82
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 7
ja 0x402b6f
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x402b66
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x402b69
shr dword [ebp - 4], 1
add dword [ebp - 0xc], 1
jmp 0x402b47
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x42b060], edx
add dword [ebp - 8], 1
jmp 0x402b31
nop
leave
ret

Function at 0x402bcb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x4034
call fcn.0040cad0
sub esp, eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x402c1e
mov dword [esp], 2
mov eax, dword [fcn.00416eb0]
call eax
mov dword [esp + 4], str.bad_param___n
mov dword [esp], eax
call fcn.0041ce6c
mov eax, 0
jmp 0x402d7e
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004114b0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
jne 0x402c5b
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
jmp 0x402c99
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jbe 0x402c99
mov dword [esp], 2
mov eax, dword [fcn.00416eb0]
call eax
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], str.checkSz__u___max__u_n
mov dword [esp], eax
call fcn.0041ce6c
mov eax, 0
jmp 0x402d7e
call fcn.00402b24
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004114b0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jae 0x402d7b
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, 0x4000
cmp dword [ebp - 0x18], 0x4000
cmovbe eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x4020]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jns 0x402d51
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov ebx, eax
mov dword [esp], 2
mov eax, dword [fcn.00416eb0]
call eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x55
mov dword [esp + 4], str._d:read__s._n
mov dword [esp], eax
call fcn.0041ce6c
mov eax, 0
jmp 0x402d7e
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x4020]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00402b85
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x10], eax
jmp 0x402cb8
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40be20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00416eb0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00416eb0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40be80
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x42b490]
test esi, esi
jle 0x40bfa0
mov eax, dword [0x42b494]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40beb4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40bf37
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40bea0
mov dword [esp], ebx
call fcn.0040c800
mov edi, eax
test eax, eax
je 0x40bfc7
mov eax, dword [0x42b494]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040c940
mov edx, dword [0x42b494]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40bfa7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40bf30
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40bf40
add dword [0x42b490], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x42b494]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40bf30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040be20
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40bebe
mov eax, dword [0x42b494]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040be20
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040be20
lea esi, [esi]
nop