joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44081b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d4268]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
push edi
je 0x440882
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.00473b80
mov ebx, esp
test ebx, ebx
je 0x440882
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x134
call fcn.0042aeb0
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0042de5f
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472031
leave
ret 0x10

Function at 0x44bf02
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3b4], ebx
je 0x44bf6a
cmp dword [ebp + 8], 0x100
jne 0x44bf59
cmp word [ebp + 0xc], 0xd
jne 0x44bf59
cmp byte [esi + 0x3ba], bl
je 0x44bf40
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44bf59
cmp byte [esi + 0x3bb], bl
jne 0x44bf59
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x44bf55
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.0042de5f
xor eax, eax
jmp 0x44bf6d
mov eax, dword [esi + 0x3b4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x44d0e2
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4d4268]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
mov ebx, dword [ebp + 0x19c]
push esi
push edi
mov edi, dword [ebp + 0x198]
mov esi, ecx
push 0
lea eax, [esi + 0x48]
push eax
push edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], 1
call fcn.0044cf8c
add esp, 0xc
test eax, eax
jl 0x44d23c
lea eax, [esi + 0xbc]
push eax
push edi
call fcn.0044a6dc
pop ecx
pop ecx
test eax, eax
jl 0x44d23c
mov ecx, edi
mov dword [esi + 0x14], 4
call fcn.0044b278
movzx eax, al
shl eax, 3
xor eax, dword [esi + 0x18]
and eax, 8
xor dword [esi + 0x18], eax
mov edx, dword [esi + 0x18]
call fcn.0044b415
mov dword [esi + 0x20], eax
test ebx, ebx
je 0x44d185
mov eax, dword [ebx + 0x20]
mov dword [esi + 0x14], eax
test eax, 0x100080
jne 0x44d185
or edx, 2
mov dword [esi + 0x18], edx
mov eax, dword [esi + 0x14]
test al, 1
je 0x44d190
push 3
jmp 0x44d196
test al, 2
je 0x44d19e
push 2
pop eax
mov word [esi + 0xd4], ax
or dword [esi + 0x18], 0x20
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.00472c30
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Riched20.dll
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
push eax
call fcn.0040c5f3
mov dword [esi + 4], eax
test eax, eax
je 0x44d23c
push str.CreateTextServices
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44d23c
lea ecx, [ebp - 0x80]
push ecx
push esi
push 0
call eax
test eax, eax
jl 0x44d23c
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
add esi, 0x10
push esi
push 0x4b5974
push eax
call dword [ecx]
mov edi, eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test edi, edi
jl 0x44d23c
test ebx, ebx
je 0x44d240
mov ebx, dword [ebx + 0x24]
test ebx, ebx
je 0x44d240
mov ecx, dword [esi]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x38]
test eax, eax
jge 0x44d240
xor eax, eax
jmp 0x44d243
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472031
add ebp, 0x190
leave
ret 8
Function at 0x472031
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d4268]
jne 0x47203b
repz ret
jmp fcn.0047ccbd

Function at 0x49a2b9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047ce4f
and dword [ebp - 4], 0
cmp dword [0x4d8598], 0
mov ebx, eax
jne 0x49a36a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x49a41b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x49a41b
push eax
call fcn.0047cddd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d8598], eax
call esi
push eax
call fcn.0047cddd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d859c], eax
call esi
push eax
call fcn.0047cddd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d85a0], eax
call esi
push eax
call fcn.0047cddd
pop ecx
mov dword [0x4d85a8], eax
test eax, eax
je 0x49a36a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047cddd
pop ecx
mov dword [0x4d85a4], eax
mov eax, dword [0x4d85a4]
cmp eax, ebx
je 0x49a3c2
cmp dword [0x4d85a8], ebx
je 0x49a3c2
push eax
call fcn.0047ce58
push dword [0x4d85a8]
mov esi, eax
call fcn.0047ce58
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x49a3c2
test edi, edi
je 0x49a3c2
call esi
test eax, eax
je 0x49a3b9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49a3b9
test byte [ebp - 0xc], 1
jne 0x49a3c2
or dword [ebp + 0x10], 0x200000
jmp 0x49a3fb
mov eax, dword [0x4d859c]
cmp eax, ebx
je 0x49a3fb
push eax
call fcn.0047ce58
pop ecx
test eax, eax
je 0x49a3fb
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x49a3fb
mov eax, dword [0x4d85a0]
cmp eax, ebx
je 0x49a3fb
push eax
call fcn.0047ce58
pop ecx
test eax, eax
je 0x49a3fb
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d8598]
call fcn.0047ce58
pop ecx
test eax, eax
je 0x49a41b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x49a41d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d15a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407e6b
mov dword [ebp - 0x14], eax
cmp dword [0x813e7c], esi
jne 0x40d24d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d1da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d32d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d32d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d32d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813e7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813e80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813e84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813e8c], eax
test eax, eax
je 0x40d24a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813e88], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d272
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d265
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d287
push 4
pop eax
jmp 0x40d32f
cmp dword [ebp - 0x14], esi
je 0x40d287
push dword [0x813e7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d26c
mov eax, dword [0x813e88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d2e5
cmp dword [0x813e8c], edi
je 0x40d2e5
push eax
call ebx
push dword [0x813e8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d2e5
test eax, eax
je 0x40d2e5
call ecx
test eax, eax
je 0x40d2da
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d2da
test byte [ebp - 8], 1
jne 0x40d2e5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d315
mov eax, dword [0x813e80]
cmp eax, edi
je 0x40d312
push eax
call ebx
test eax, eax
je 0x40d312
call eax
mov esi, eax
test esi, esi
je 0x40d312
mov eax, dword [0x813e84]
cmp eax, edi
je 0x40d312
push eax
call ebx
test eax, eax
je 0x40d312
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813e7c]
call ebx
test eax, eax
je 0x40d32d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d32f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004043b8
mov esp, ebp
pop ebp
ret
Function at 0x1003f043
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.1003d76e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1003d723
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.1003d75e
jns 0x1003f063
jae 0x1003f0e7
lea eax, [ebp - 0x6f4]
push eax
call fcn.1003d76e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
sbb bh, bh
jne 0x1003f0ff
call fcn.1003d723
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
add byte [edx + 1], ch
pop eax
test eax, eax
je 0x1003f804
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x1003f2d9
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
invalid
invalid
cmpsd dword [esi], dword es:[edi]
clc
invalid
Function at 0x40c7a0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
mov al, byte [eax + 0x4c]
mov byte [esp + 0x10], al
mov esi, dword [edi]
cmp esi, dword [esp + 0x18]
je 0x40c923
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x24]
nop word [eax + eax]
mov cl, byte [esi + 5]
test cl, 0x18
je 0x40c8d8
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x40c7f7.11
movzx eax, byte [eax + 0x40c950]
jmp dword [eax*4 + 0x40c928]
push esi
push ebx
call fcn.0040a100
add esp, 8
jmp case.0x40c7f7.11
lea eax, [esi + 0x10]
cmp dword [esi + 8], eax
je 0x40c81e
push esi
call fcn.0040a3f0
add esp, 4
push 0x20
push esi
push ebx
call fcn.0040eeb0
add esp, 0xc
jmp case.0x40c7f7.11
movzx eax, byte [esi + 6]
lea eax, [eax*4 + 0x10]
push eax
push esi
push ebx
call fcn.0040eeb0
add esp, 0xc
jmp case.0x40c7f7.11
movzx eax, byte [esi + 6]
inc eax
shl eax, 4
push eax
push esi
push ebx
call fcn.0040eeb0
add esp, 0xc
jmp case.0x40c7f7.11
push esi
push ebx
call fcn.00415160
add esp, 8
jmp case.0x40c7f7.11
push esi
push ebx
call fcn.00413f30
add esp, 8
jmp case.0x40c7f7.11
movzx eax, word [esi + 6]
test ax, ax
jne 0x40c890
mov ecx, 0x10
jmp 0x40c898
mov ecx, eax
shl ecx, 4
add ecx, 0x18
mov eax, dword [esi + 8]
add eax, ecx
push eax
push esi
push ebx
call fcn.0040eeb0
add esp, 0xc
jmp case.0x40c7f7.11
push esi
push ebx
call fcn.00414c30
movzx eax, byte [esi + 7]
add eax, 0x11
push eax
push esi
push ebx
call fcn.0040eeb0
add esp, 0x14
jmp case.0x40c7f7.11
mov eax, dword [esi + 0xc]
add eax, 0x11
push eax
push esi
push ebx
call fcn.0040eeb0
add esp, 0xc
jmp case.0x40c7f7.11
test cl, 7
jne 0x40c8ec
and cl, 0xc1
and al, 0x18
or cl, al
or cl, 1
mov byte [esi + 5], cl
jmp 0x40c90f
movzx eax, cl
and cl, 0xf8
and eax, 7
or cl, byte [eax + 0x462120]
mov byte [esi + 5], cl
and cl, 7
cmp cl, 3
jne 0x40c90f
cmp dword [ebp], 0
jne 0x40c90f
mov dword [ebp], esi
mov edi, esi
mov esi, dword [edi]
mov al, byte [esp + 0x18]
cmp esi, dword [esp + 0x20]
jne 0x40c7d0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x40fed0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xd8
mov eax, dword [0x470d10]
xor eax, esp
mov dword [esp + 0xd4], eax
push ebx
push ebp
mov ebp, dword [esp + 0xe8]
lea eax, [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xec]
push eax
push edi
call fcn.0040f3d0
mov esi, eax
add esp, 8
test esi, esi
je 0x40ff24
mov ecx, dword [esp + 0x10]
sub esi, edi
mov edx, dword [esp + 0x14]
mov al, 3
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov byte [ebp + 8], al
lea eax, [esi + 1]
jmp 0x40ff44
push 0x462558
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x40ff5d
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x40ff5f
xor eax, eax
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045f421
add esp, 0xd8
ret
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0040f350
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40fffc
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
test esi, esi
je 0x40ff42
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ff90
sub ecx, edx
cmp ecx, 0xc8
ja 0x40ff42
lea edx, [esp + 0x18]
mov ecx, edi
sub edx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x40ffb0
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x1c], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0040f350
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40ff42
mov eax, edi
lea ecx, [esp + 0x18]
sub eax, ecx
add esi, eax
test esi, esi
je 0x40ff42
movsd xmm0, qword [esp + 0x10]
sub esi, edi
mov al, 0x13
movsd qword [ebp], xmm0
mov byte [ebp + 8], al
lea eax, [esi + 1]
jmp 0x40ff44
Function at 0x4100c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push esi
push edi
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
mov ecx, dword [esp + 0x1c]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x461d29], 8
je 0x410115
mov al, byte [ecx + 1]
inc ecx
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x461d29], 8
jne 0x410101
mov al, byte [esp + 0x1f]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x41012a
mov dword [esp + 0xc], 1
jmp 0x410133
cmp al, 0x2b
mov dword [esp + 0xc], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x410279
mov al, byte [edx + 1]
cmp al, 0x78
je 0x41014b
cmp al, 0x58
jne 0x410279
movsd xmm2, qword [0x4625c0]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov byte [esp + 0x1f], al
cmp ecx, dword [esp + 8]
jne 0x410177
cmp dword [esp + 0x14], 0
jne 0x4101cc
mov dword [esp + 0x14], 1
inc edx
jmp 0x410156
movzx eax, al
test byte [eax + 0x461d29], 0x10
je 0x4101cc
test edi, edi
jne 0x410194
cmp byte [esp + 0x1f], 0x30
jne 0x410194
inc dword [esp + 0x10]
jmp 0x4101c1
inc edi
cmp edi, 0x1e
jg 0x4101c0
test byte [ecx + 0x461d29], 2
je 0x4101a8
add ecx, 0xffffffd0
jmp 0x4101ae
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x4101c1
inc esi
cmp dword [esp + 0x14], 0
je 0x4101c9
dec esi
inc edx
jmp 0x410156
mov eax, dword [esp + 0x10]
add eax, edi
je 0x410279
mov eax, dword [esp + 0x20]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x4101eb
cmp al, 0x50
jne 0x410253
mov al, byte [edx + 1]
xor ecx, ecx
mov byte [esp + 0x1f], al
cmp al, 0x2d
jne 0x410200
lea edi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x41020d
xor eax, eax
xor edi, edi
cmp byte [esp + 0x1f], 0x2b
sete al
inc eax
add edx, eax
mov al, byte [edx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x461d29], 2
je 0x410279
movsx eax, byte [esp + 0x1f]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x461d29], 2
jne 0x410221
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [esp + 0x20]
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x410261
xorps xmm1, xmmword [0x4625d0]
push esi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
fldz
pop edi
pop esi
add esp, 0x10
ret
Function at 0x414660
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
mov edx, ebx
push ebp
push esi
mov esi, dword [eax + 0x10]
push edi
mov dword [esp + 0x10], esi
mov ebp, dword [esi + 0x48]
xor ebp, ebx
test ebx, ebx
je 0x41469f
mov edi, dword [esp + 0x20]
movzx ecx, byte [edi + edx - 1]
mov eax, ebp
shl eax, 5
add ecx, eax
mov eax, ebp
shr eax, 2
add ecx, eax
xor ebp, ecx
sub edx, 1
jne 0x414685
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
dec ecx
and ecx, ebp
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [esp + 0x14], eax
test edi, edi
je 0x41471e
movzx eax, byte [edi + 7]
cmp ebx, eax
jne 0x414713
mov ecx, dword [esp + 0x20]
lea edx, [edi + 0x10]
mov esi, ebx
sub esi, 4
jb 0x4146e1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4146e6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4146d0
cmp esi, 0xfffffffc
je 0x41474f
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x414713
cmp esi, 0xfffffffd
je 0x41474f
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x414713
cmp esi, 0xfffffffe
je 0x41474f
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x414713
cmp esi, 0xffffffff
je 0x41474f
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x41474f
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4146b6
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jl 0x4147f1
mov edi, dword [esp + 0x1c]
cmp eax, 0x7fffffff
jne 0x41476f
push 1
push edi
call fcn.0040b3c0
add esp, 8
cmp dword [esi + 0x1c], 0x7fffffff
je 0x41483e
jmp 0x41476f
mov ecx, dword [esp + 0x10]
mov al, byte [edi + 5]
mov cl, byte [ecx + 0x4c]
xor cl, 0x18
test al, cl
je 0x414765
xor al, 0x18
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov esi, dword [esi + 0x20]
cmp esi, 0x1fffffff
jg 0x4147db
mov ebx, dword [edi + 0x10]
add esi, esi
mov edi, dword [ebx + 0x20]
cmp esi, edi
jge 0x414793
push esi
push edi
push dword [ebx + 0x18]
call fcn.00414cf0
add esp, 0xc
lea eax, [esi*4]
push eax
lea eax, [edi*4]
push eax
push dword [ebx + 0x18]
mov eax, dword [esp + 0x28]
push eax
call fcn.0040efc0
add esp, 0x10
test eax, eax
jne 0x4147c2
cmp esi, edi
jge 0x4147d7
push edi
push esi
push dword [ebx + 0x18]
jmp 0x4147cf
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x20], esi
cmp esi, edi
jle 0x4147d7
push esi
push edi
push eax
call fcn.00414cf0
add esp, 0xc
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x10]
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
dec ecx
and ecx, ebp
lea eax, [eax + ecx*4]
mov dword [esp + 0x14], eax
jmp 0x4147f5
mov edi, dword [esp + 0x10]
lea eax, [ebx + 0x11]
push eax
push 4
push dword [esp + 0x24]
call fcn.0040b480
mov esi, eax
push ebx
push dword [esp + 0x30]
lea ecx, [esi + 0x10]
mov dword [esi + 8], ebp
mov byte [esi + 6], 0
push ecx
mov byte [esi + ebx + 0x10], 0
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x2c]
add esp, 0x18
mov byte [esi + 7], bl
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov eax, esi
mov dword [ecx], esi
inc dword [edi + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 4
push edi
call fcn.00408a70
int3
Function at 0x414940
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
xor eax, dword [esp + 0x10]
test esi, esi
je 0x41496f
push edi
mov edi, dword [esp + 0xc]
movzx edx, byte [edi + esi - 1]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub esi, 1
jne 0x414954
pop edi
pop esi
ret
Function at 0x421cb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x2c]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
movlpd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
push edi
mov edi, 0xff
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x10], eax
xor ebp, edx
xor edi, ebx
mov ebx, dword [esp + 0x14]
xor ecx, esi
xor ebx, dword [esp + 0x10]
mov eax, ebp
mov ebp, dword [esp + 0x38]
xor esi, ebx
xor edx, edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edx
mov dword [ebp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [ebp], edx
xor esi, eax
mov edx, dword [esp + 0x14]
mov dword [ebp + 8], esi
xor edx, ecx
mov dword [ebp + 0xc], edx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
shld dword [esp + 0x10], ebp, 0x11
xor dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], edi
shl dword [esp + 0x10], 0xd
shrd edi, ebx, 0x13
shl ebp, 0x11
xor ebp, eax
mov dword [esp + 0x14], 0
or dword [esp + 0x14], edi
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
shr ebx, 0x13
or edi, ebx
mov dword [esp + 0x18], esi
sub dword [esp + 0x1c], 1
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [eax + 0x1c], edi
mov edi, esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 0x10], ebp
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ebx
jne 0x421cf5
push dword [esp + 0x40]
mov esi, dword [esp + 0x38]
push dword [esp + 0x40]
push esi
call sym.wluart_static.exe_lua_pushinteger
push dword [esp + 0x54]
push dword [esp + 0x54]
push esi
call sym.wluart_static.exe_lua_pushinteger
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret