joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439180
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x677e70]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
push esi
mov word [esp + 8], cx
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
call fcn.004303f0
cmp dword [esp + 0x18], 8
lea eax, [esp + 4]
cmovae eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x18]
cmp ecx, 8
jb 0x4391ea
inc ecx
push ecx
push dword [esp + 8]
lea ecx, [esp + 0xc]
call fcn.00430840
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x439800
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x2c]
mov dword [ebp - 4], 0
mov ecx, dword [eax]
mov eax, dword [0x695a78]
cmp eax, dword [ecx + 4]
jle 0x439858
push 0x695a78
call fcn.0053e619
add esp, 4
cmp dword [0x695a78], 0xffffffff
jne 0x439858
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x5b7930
mov dword [0x695a7c], eax
call fcn.0053e98d
push 0x695a78
call fcn.0053e5da
add esp, 8
push esi
push dword [0x695a7c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
test eax, eax
jle 0x439892
xor ecx, ecx
push 0x20
mov word [esi], cx
mov ecx, esi
push eax
call fcn.00439760
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, esi
push eax
push 0x64f9cc
mov word [esi], ax
call fcn.004303f0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x44d050
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x677e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x200
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], 0
mov dword [esi + 4], 0x200
call fcn.0058fe8a
mov dword [esi], eax
lea edi, [ebp - 0x204]
mov ecx, 0x3f
add esp, 4
mov byte [eax], 0
mov eax, dword [esi]
mov dword [esi + 8], eax
mov eax, 0x80808080
rep stosd dword es:[edi], eax
mov dword [esi + 0xc], 0
mov ecx, 0x41
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ecx - 0x41]
mov byte [ebp + ecx - 0x204], al
inc ecx
cmp ecx, 0x5a
jle 0x44d0c1
mov ecx, 0x61
nop word [eax + eax]
lea eax, [ecx - 0x47]
mov byte [ebp + ecx - 0x204], al
inc ecx
cmp ecx, 0x7a
jle 0x44d0e0
mov ecx, 0x30
lea eax, [ecx + 4]
mov byte [ebp + ecx - 0x204], al
inc ecx
cmp ecx, 0x39
jle 0x44d0f5
xor edi, edi
mov byte [ebp - 0x1d9], 0x3e
mov byte [ebp - 0x1d5], 0x3f
mov byte [ebp - 0x1c7], 0
lea ecx, [edi + 1]
nop
xor esi, esi
mov eax, dword [ebp - 0x210]
movsx ebx, byte [eax]
inc eax
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x214]
inc eax
cmp eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x214], eax
cmovg edi, ecx
call fcn.0059482e
add esp, 4
mov ecx, 1
test eax, eax
jne 0x44d122
cmp ebx, 0xa
je 0x44d122
cmp ebx, 0xd
je 0x44d122
test edi, edi
jne 0x44d252
mov al, byte [ebp + ebx - 0x204]
test al, al
jns 0x44d177
dec esi
jmp 0x44d185
mov byte [ebp + esi - 0x218], bl
mov byte [ebp + esi - 0x20c], al
inc esi
cmp esi, 4
jl 0x44d122
mov eax, dword [ebp - 0x20c]
mov dl, al
shl dl, 2
mov cl, ah
shr cl, 4
mov al, ah
or dl, cl
shl al, 4
mov byte [ebp - 0x208], dl
mov dl, byte [ebp - 0x20a]
mov cl, dl
shl dl, 6
or dl, byte [ebp - 0x209]
shr cl, 2
or cl, al
mov byte [ebp - 0x206], dl
cmp byte [ebp - 0x216], 0x3d
mov byte [ebp - 0x207], cl
jne 0x44d1e1
mov dword [ebp - 0x21c], 1
xor esi, esi
jmp 0x44d1fc
xor eax, eax
cmp byte [ebp - 0x215], 0x3d
setne al
xor esi, esi
add eax, 2
mov dword [ebp - 0x21c], eax
test eax, eax
jle 0x44d244
mov ebx, dword [ebp - 0x220]
mov ecx, dword [ebx + 8]
mov al, byte [ebp + esi - 0x208]
mov byte [ecx], al
inc dword [ebx + 8]
inc dword [ebx + 0xc]
mov eax, dword [ebx + 4]
cmp dword [ebx + 0xc], eax
jne 0x44d239
add eax, 0x200
push eax
push dword [ebx]
mov dword [ebx + 4], eax
call fcn.005946e9
mov ecx, dword [ebx + 0xc]
add esp, 8
add ecx, eax
mov dword [ebx], eax
mov dword [ebx + 8], ecx
mov eax, dword [ebp - 0x21c]
inc esi
cmp esi, eax
jl 0x44d202
mov ecx, 1
cmp eax, 3
jge 0x44d120
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret
Function at 0x44d270
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x677e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x200
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], ebx
mov dword [esi + 4], 0x200
call fcn.0058fe8a
mov dword [esi], eax
add esp, 4
xor ecx, ecx
mov byte [eax], bl
mov eax, dword [esi]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
lea eax, [ecx + 0x41]
mov byte [ebp + ecx - 0x44], al
lea eax, [ecx + 0x61]
mov byte [ebp + ecx - 0x2a], al
inc ecx
cmp ecx, 0x1a
jl 0x44d2b4
xor ecx, ecx
nop word [eax + eax]
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xa
jl 0x44d2d0
mov word [ebp - 6], 0x2f2b
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov word [ebp - 0x4f], 0
mov byte [ebp - 0x50], 0
cmp ebx, dword [ebp + 0x10]
jge 0x44d30e
movsx eax, byte [ecx]
inc ebx
mov byte [ebp + edi - 0x50], al
inc ecx
inc edi
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x54], ebx
cmp edi, 3
jl 0x44d2f2
jmp 0x44d315
mov dword [ebp - 0x58], 1
test edi, edi
jle 0x44d408
movzx ecx, byte [ebp - 0x50]
movzx edx, byte [ebp - 0x4f]
mov eax, ecx
shr eax, 2
and ecx, 3
shl ecx, 4
movzx eax, byte [ebp + eax - 0x44]
mov byte [ebp - 0x48], al
mov eax, edx
shr eax, 4
and edx, 0xf
or eax, ecx
shl edx, 2
movzx ecx, byte [ebp - 0x4e]
movzx eax, byte [ebp + eax - 0x44]
mov byte [ebp - 0x47], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
or eax, edx
mov dl, byte [ebp + eax - 0x44]
movzx eax, byte [ebp + ecx - 0x44]
mov byte [ebp - 0x46], dl
mov byte [ebp - 0x45], al
cmp edi, 3
jge 0x44d384
cmp edi, 2
movzx eax, dl
mov ecx, 0x3d
mov byte [ebp - 0x45], 0x3d
cmovl eax, ecx
mov byte [ebp - 0x46], al
xor edi, edi
lea ebx, [edi + 0x48]
nop dword [eax]
mov ecx, dword [esi + 8]
mov al, byte [ebp + edi - 0x48]
mov byte [ecx], al
inc dword [esi + 8]
inc dword [esi + 0xc]
mov eax, dword [esi + 4]
cmp dword [esi + 0xc], eax
jne 0x44d3c4
add eax, 0x200
push eax
push dword [esi]
mov dword [esi + 4], eax
call fcn.005946e9
mov ecx, dword [esi + 0xc]
add esp, 8
add ecx, eax
mov dword [esi], eax
mov dword [esi + 8], ecx
mov eax, dword [esi + 0xc]
cdq
idiv ebx
test edx, edx
jne 0x44d3ff
mov eax, dword [esi + 8]
mov byte [eax], 0xa
inc dword [esi + 8]
inc dword [esi + 0xc]
mov eax, dword [esi + 4]
cmp dword [esi + 0xc], eax
jne 0x44d3ff
add eax, 0x200
push eax
push dword [esi]
mov dword [esi + 4], eax
call fcn.005946e9
mov ecx, dword [esi + 0xc]
add esp, 8
add ecx, eax
mov dword [esi], eax
mov dword [esi + 8], ecx
inc edi
cmp edi, 4
jl 0x44d390
mov ebx, dword [ebp - 0x54]
cmp dword [ebp - 0x58], 0
je 0x44d2e3
mov eax, dword [esi + 8]
mov byte [eax], 0xa
inc dword [esi + 8]
inc dword [esi + 0xc]
mov eax, dword [esi + 4]
cmp dword [esi + 0xc], eax
jne 0x44d443
add eax, 0x200
push eax
push dword [esi]
mov dword [esi + 4], eax
call fcn.005946e9
mov ecx, dword [esi + 0xc]
add esp, 8
add ecx, eax
mov dword [esi], eax
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret
Function at 0x44dee0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x677e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
nop dword [eax + eax]
movzx ecx, byte [edx + str.80_]
mov eax, ecx
and ecx, 7
shr eax, 3
movzx eax, byte [eax + esi]
test byte [ecx*2 + 0x676650], al
movzx ecx, byte [edx + 0x6766c1]
setne al
mov byte [ebp + edx - 0x3c], al
mov eax, ecx
shr eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*2 + 0x676650], al
movzx ecx, byte [edx + 0x6766c2]
setne al
mov byte [ebp + edx - 0x3b], al
mov eax, ecx
shr eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*2 + 0x676650], al
movzx ecx, byte [edx + 0x6766c3]
setne al
mov byte [ebp + edx - 0x3a], al
mov eax, ecx
shr eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*2 + 0x676650], al
setne al
mov byte [ebp + edx - 0x39], al
add edx, 4
cmp edx, 0x38
jl 0x44df00
xor ebx, ebx
mov edi, 0x1e
cmp word [ebp + 0xc], 1
mov esi, edi
je 0x44dfa3
lea esi, [ebx + ebx]
movzx eax, byte [ebx + 0x6766f8]
xor edx, edx
mov dword [ebp + esi*4 - 0xf0], 0
mov ecx, eax
mov dword [ebp + esi*4 - 0xf4], 0
mov dword [ebp - 0xf8], eax
nop word [eax + eax]
cmp ecx, 0x1c
jge 0x44dfdb
mov al, byte [ebp + ecx - 0x3c]
jmp 0x44dfdf
mov al, byte [ebp + ecx - 0x58]
mov byte [ebp + edx - 0x74], al
inc ecx
inc edx
cmp edx, 0x1c
jl 0x44dfd0
mov ecx, dword [ebp - 0xf8]
mov edx, 0x1c
add ecx, edx
cmp ecx, 0x38
jge 0x44e002
mov al, byte [ebp + ecx - 0x3c]
jmp 0x44e006
mov al, byte [ebp + ecx - 0x58]
mov byte [ebp + edx - 0x74], al
inc ecx
inc edx
cmp edx, 0x38
jl 0x44dff7
xor eax, eax
nop dword [eax]
nop word [eax + eax]
movzx ecx, byte [eax + 0x676708]
cmp byte [ebp + ecx - 0x74], 0
je 0x44e03c
mov ecx, dword [eax*4 + 0x676660]
or dword [ebp + esi*4 - 0xf4], ecx
movzx ecx, byte [eax + 0x676720]
cmp byte [ebp + ecx - 0x74], 0
je 0x44e058
mov ecx, dword [eax*4 + 0x676660]
or dword [ebp + esi*4 - 0xf0], ecx
inc eax
cmp eax, 0x18
jl 0x44e020
sub edi, 2
inc ebx
cmp edi, 0xfffffffe
jg 0x44df97
lea eax, [ebp - 0xf4]
push eax
call fcn.0044d460
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret
Function at 0x454a50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1b3b
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.0053f090
mov eax, dword [0x677e70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x201c], 0
test edi, edi
jne 0x454aa2
push 0x64f9cc
jmp 0x454b4a
push 0x2000
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.0057ee10
add esp, 0xc
lea ecx, [ebp - 0x2018]
push 0x5bc8ec
call fcn.00404ca0
push edi
push eax
lea eax, [ebp - 0x2014]
mov dword [ebp - 4], 0
push eax
call fcn.00413ba0
add esp, 0xc
lea ecx, [ebp - 0x2010]
push dword [ebx + 0x64]
push 0x1000
push ecx
push 0x64f9cc
push dword [eax]
push str.LOG_CONFIG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, dword [ebp - 0x2014]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454b21
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2018]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x454b43
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x2010]
push eax
mov ecx, esi
call fcn.00404ca0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 8

Function at 0x454b80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push 0x2c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], 0x30
push 0
push eax
mov esi, ecx
call fcn.0057ee10
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], str.LOG_MSG_WINDOW
mov dword [ebp - 0x28], 0x455730
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x454be7
push 0x5bcab4
call fcn.00478ed0
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x1c]
push 0
push 0xfffffffffffffffd
push 0x64
push 0x64
push 0
push 0
push 0
push str.TimerWin
push dword [ebp - 8]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0x78], eax
test eax, eax
jne 0x454c25
push 0x5bcadc
call fcn.00478ed0
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5bcaf0
call fcn.00478ed0
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x458f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x677e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x458f97
push ebx
push ebx
push 0x16f
push 0x5bcc48
call fcn.0043bc90
add esp, 0x10
mov eax, 0x80070057
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 0x40], 0
je 0x458faa
cmp dword [edi + 0x24], 0
je 0x458faa
mov ecx, edi
call fcn.00459170
mov eax, dword [edi + 0x28]
xor ecx, ecx
mov edx, 2
push esi
lea eax, [eax*2 + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0053e9a2
mov edx, dword [edi + 0x24]
xor esi, esi
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x310030
mov dword [ebp - 0x20], 0x330032
mov dword [ebp - 0x1c], 0x350034
mov dword [ebp - 0x18], 0x370036
mov dword [ebp - 0x14], 0x390038
mov dword [ebp - 0x10], 0x420041
mov dword [ebp - 0xc], 0x440043
mov dword [ebp - 8], 0x460045
cmp dword [edi + 0x28], esi
jbe 0x45903d
movzx ecx, byte [edx]
lea edx, [edx + 1]
shr ecx, 4
inc esi
movzx ecx, word [ebp + ecx*2 - 0x24]
mov word [eax], cx
movzx ecx, byte [edx - 1]
and ecx, 0xf
movzx ecx, word [ebp + ecx*2 - 0x24]
mov word [eax + 2], cx
add eax, 4
cmp esi, dword [edi + 0x28]
jb 0x459013
mov esi, dword [ebp - 0x28]
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push esi
mov dword [ebx], eax
call fcn.0053eac5
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop edi
pop ebx
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 8

Function at 0x459070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b319b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x677e70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
xorps xmm0, xmm0
movups xmmword [edi + 8], xmm0
movq qword [edi + 0x18], xmm0
mov byte [edi + 0x20], 0
mov dword [edi + 0x24], 0
lea esi, [edi + 0x30]
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
push 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.0053ea92
add esp, 4
test eax, eax
jne 0x45910a
call fcn.00581ed5
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4606c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x677e70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x28]
push edi
mov edi, dword [ebp + 0x2c]
test esi, esi
jne 0x4606f6
pop edi
mov eax, 0x80070057
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 0x28
test edi, edi
je 0x4606df
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00592f52
lea eax, [ebp - 0x828]
push eax
push 0x6546a8
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.00592ca9
push dword [ebp + 0x1c]
mov ecx, 0x3ff
push str.._03d
sub ecx, eax
push 0xffffffffffffffff
push ecx
lea ecx, [ebp - 0x804]
lea eax, [ecx + eax*2]
push eax
call fcn.0043bd00
add esp, 0x2c
call fcn.00404520
mov ecx, eax
test ecx, ecx
je 0x4607f6
mov eax, dword [ecx]
call dword [eax + 0xc]
movzx ecx, word [esi]
add eax, 0x10
mov dword [ebp - 0x82c], eax
test cx, cx
push edi
mov edx, 0x64f9cc
mov eax, 0x5bc660
cmove eax, edx
push eax
push esi
mov eax, 0x5bcfd4
cmove eax, edx
push eax
push dword [ebp + 0x20]
lea eax, [ebp - 0x804]
push dword [ebp + 0x24]
push eax
lea eax, [ebp - 0x82c]
push str._s__d___04x__s_s_s__s_n
push eax
call fcn.00405150
mov esi, dword [ebp - 0x82c]
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4607e2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0053e4b1
mov esp, ebp
pop ebp
ret 0x28
push 0x80004005
call fcn.00404b10
int3

Function at 0x461180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2596
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x677e70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
xorps xmm0, xmm0
movups xmmword [edi + 8], xmm0
movq qword [edi + 0x18], xmm0
mov byte [edi + 0x20], 0
xor eax, eax
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
call fcn.00404520
mov ecx, eax
test ecx, ecx
jne 0x4611ee
push 0x80004005
call fcn.00404b10
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi + 0x30], eax
lea esi, [edi + 0x58]
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov ecx, esi
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0xffffffff
mov dword [edi + 0x48], 0xffffffff
mov dword [edi + 0x4c], 0xffffffff
mov dword [edi + 0x50], 0xffffffff
mov dword [edi + 0x54], 0xffffffff
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00462ae0
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x461430
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2646
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x677e70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
xorps xmm0, xmm0
movups xmmword [esi + 0xc], xmm0
movq qword [esi + 0x1c], xmm0
mov byte [esi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea eax, [esi + 0x3c]
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
push 0
movups xmmword [eax], xmm0
push eax
mov byte [ebp - 4], 1
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x4614d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4614ca
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x4614d2
push eax
call fcn.00404b10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x461600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aab80
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x677e70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x58]
lea ecx, [edi + 0x58]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.00462dc0
push dword [edi + 0x58]
call fcn.0053e4ac
mov edx, dword [edi + 0x30]
add esp, 4
sub edx, 0x10
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46165f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [edi + 0x20], 0
lea eax, [edi + 8]
je 0x461673
push eax
mov byte [eax + 0x18], 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4628b0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
test ecx, ecx
jne 0x4628d6
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4628c7
sub ecx, edx
sar ecx, 1
cmp dword [esi + 0x30], 0
lea edi, [ecx + ecx]
je 0x4629e4
mov ch, byte [ebp + 0x10]
xor eax, eax
test ch, ch
mov edx, 4
cmovne eax, edx
add eax, edi
mov dword [ebp + 0xc], eax
cmp dword [esi + 0x6c], eax
jae 0x46291a
push dword [esi + 0x68]
add eax, eax
mov dword [esi + 0x6c], eax
call fcn.0053eac5
push dword [esi + 0x6c]
call fcn.0053e9a2
mov ch, byte [ebp + 0x10]
add esp, 8
mov dword [esi + 0x68], eax
xor edx, edx
test edi, edi
je 0x462939
mov eax, edx
and eax, 7
mov cl, byte [eax + str.baidu_log_duan_]
mov eax, dword [esi + 0x68]
xor cl, byte [edx + ebx]
mov byte [edx + eax], cl
inc edx
cmp edx, edi
jb 0x462920
test ch, ch
je 0x46298f
mov eax, edx
and eax, 7
mov cl, byte [eax + str.baidu_log_duan_]
mov eax, dword [esi + 0x68]
xor cl, 0xd
mov byte [edx + eax], cl
lea eax, [edx + 1]
mov ecx, dword [esi + 0x68]
and eax, 7
movzx eax, byte [eax + str.baidu_log_duan_]
mov byte [edx + ecx + 1], al
lea eax, [edx + 2]
and eax, 7
mov cl, byte [eax + str.baidu_log_duan_]
mov eax, dword [esi + 0x68]
xor cl, 0xa
mov byte [edx + eax + 2], cl
lea eax, [edx + 3]
mov ecx, dword [esi + 0x68]
and eax, 7
movzx eax, byte [eax + str.baidu_log_duan_]
mov byte [edx + ecx + 3], al
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp + 0x10]
push 0
push eax
push 4
lea eax, [ebp + 0xc]
mov dword [ebp + 0x10], 0
push eax
push dword [esi + 0x60]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4629d0
call edi
test eax, eax
jle 0x4629c7
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x4629d6
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
add dword [esi + 0x64], eax
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push dword [esi + 0x68]
jmp 0x462a3a
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push edi
push ebx
push dword [esi + 0x60]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x462a21
call edi
test eax, eax
jle 0x462a18
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x462a27
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
add dword [esi + 0x64], eax
cmp byte [ebp + 0x10], 0
je 0x462a69
push 0
lea eax, [ebp + 0x10]
push eax
push 4
push 0x5ba2a0
push dword [esi + 0x60]
mov dword [ebp + 0x10], 0
call ebx
test eax, eax
jne 0x462a63
call edi
test eax, eax
jle 0x462a5a
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x462a69
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
add dword [esi + 0x64], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc