joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
and edx, 0xaf
neg eax
rcl esi, 0x1c
and esi, 0x38
rcl eax, 0x94
imul esi
bswap edx
add ebx, 0x9c
rol edi, 0x13
neg ebx
bswap esi
dec edi
inc ebx
inc edx
rcr edi, 0x1c
neg ebx
neg esi
not ebx
rcr eax, 0x1a
neg eax
rcr ebx, 0xd2
inc esi
add eax, 0xb5
imul edi
dec eax
sbb edx, 0x11
mov esi, 0x1f
ror ebx, 0x22
ror edi, 0x94
dec ebx
imul edi
rcl edx, 0x2f
neg esi
rol edx, 0x5b
neg ebx
sbb ebx, 0x63
not edi
dec edi
imul edx
ror esi, 0x97
rcl ebx, 0xc2
not ebx
or edi, 1
not edx
imul esi
sub ebx, 0x6b
inc edx
and edx, 0xa5
bswap edi
bswap esi
xor ecx, ecx
xor edi, edi
imul edi
neg edx
or edx, 0xa4
mov edx, 0x6f
add edx, 0xcc
sbb ebx, 0xad
inc ebx
rcl edx, 0x3d
ror esi, 0xcc
not esi
inc edx
sub edi, 0xc8
sbb ebx, 0xf7
bswap edx
neg edi
bswap esi
bswap edi
imul esi
mov esi, 0xd
imul edi
mov eax, 0x29
mov ebx, 0xce
rcr esi, 0xff
rcr esi, 0xf5
add edx, 0x9a
rcl esi, 0xa1
inc esi
bswap edi
ror eax, 0x1d
rcr edi, 0xc7
imul edx
sbb ebx, 0xfb
imul edx
not edx
rol edi, 0xbe
ror edi, 0x62
bswap eax
dec edi
bswap ebx
or edx, 0xe6
add edx, 0x9e
add eax, 0xcb
sbb esi, 0x5f
neg eax
ror edi, 0xef
ror edx, 0x25
rcr edi, 0x12
and ebx, 8
mov edx, 0x38
and eax, 0xa6
mov ecx, dword [ebp + 0xc]
neg edi
mov edi, 0x58
inc edx
rcr esi, 0x48
add ebx, 0x8a
add eax, 0x77
bswap ebx
neg edi
mov edx, 0x76
add edi, 0x81
add esi, 0xf1
rol edi, 0x35
dec ebx
not edi
add esi, 0x50
not edi
neg eax
not eax
inc esi
rol edx, 0xa0
bswap edx
and ebx, 0xff
imul ebx
mov ebx, 0x83
dec esi
add ebx, 0x49
ror esi, 0xd6
dec esi
rcl edx, 0xca
inc ebx
rol edx, 0x92
bswap eax
inc eax
inc ebx
sbb esi, 0xa4
dec esi
rcl esi, 0x8d
dec eax
neg ebx
bswap edi
bswap edi
rol esi, 0xc0
rcr ebx, 0xc0
bswap ebx
imul eax
imul edx
sub edx, 0x9a
or esi, 0xbd
not ebx
neg esi
mov edi, dword [ebp + 8]
xor esi, eax
mov ebx, esi
xor ebx, eax
not byte [edi]
xor eax, eax
mov esi, esi
mov esi, eax
sub byte [edi], 0x88
xor eax, esi
xor ebx, esi
mov esi, ebx
add byte [edi], 0x49
xor esi, eax
mov eax, eax
mov esi, eax
imul byte [edi]
inc edi
loop 0x4013b7
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407734
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4108f0]
jne 0x40773e
repz ret
jmp fcn.0040b69c
Function at 0x4080a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004059ca
and dword [ebp - 4], 0
cmp dword [0x4115d4], 0
mov ebx, eax
jne 0x408154
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408205
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408205
push eax
call fcn.00405958
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4115d4], eax
call esi
push eax
call fcn.00405958
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4115d8], eax
call esi
push eax
call fcn.00405958
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4115dc], eax
call esi
push eax
call fcn.00405958
pop ecx
mov dword [0x4115e4], eax
test eax, eax
je 0x408154
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405958
pop ecx
mov dword [0x4115e0], eax
mov eax, dword [0x4115e0]
cmp eax, ebx
je 0x4081ac
cmp dword [0x4115e4], ebx
je 0x4081ac
push eax
call fcn.004059d3
push dword [0x4115e4]
mov esi, eax
call fcn.004059d3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4081ac
test edi, edi
je 0x4081ac
call esi
test eax, eax
je 0x4081a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4081a3
test byte [ebp - 0xc], 1
jne 0x4081ac
or dword [ebp + 0x10], 0x200000
jmp 0x4081e5
mov eax, dword [0x4115d8]
cmp eax, ebx
je 0x4081e5
push eax
call fcn.004059d3
pop ecx
test eax, eax
je 0x4081e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4081e5
mov eax, dword [0x4115dc]
cmp eax, ebx
je 0x4081e5
push eax
call fcn.004059d3
pop ecx
test eax, eax
je 0x4081e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4115d4]
call fcn.004059d3
pop ecx
test eax, eax
je 0x408205
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408207
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100024b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10230cac], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x1000256a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x10230ca8], eax
inc ebx
cmp ebx, 0x100
jb 0x100024d0
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x10002596
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10230ca8]
sub edi, 1
jne 0x10002575
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100025c8
nop dword [eax]
cmp cl, 0x23
jne 0x100025af
cmp byte [esi], cl
jne 0x100025af
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10230ca8]
test cl, cl
jne 0x100025a0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10002990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x100029a2
mov dword [ebx], 0
push 0x1002c4ec
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x100029bb
pop esi
pop ebx
pop ebp
ret
push edi
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002a73
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x10002a73
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002a73
mov ecx, dword [0x10035018]
lea eax, [edi + 1]
push eax
mov eax, dword [ecx + 0xbc]
inc dword [ecx + 0x310]
call eax
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x10002a73
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x10002a55
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10035018]
mov ecx, dword [ebp + 8]
push ecx
dec dword [eax + 0x310]
mov eax, dword [eax + 0xc0]
call eax
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
mov byte [ecx + edi], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x10002a6b
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001c790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002aec6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 2
mov eax, 0x3f
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
call fcn.1001c840
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e6c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1003500c]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [0x10234c6c], 0
push esi
push edi
jne 0x1001e6ed
cmp dword [0x10234c74], 0
je 0x1001e6ed
call fcn.1001e410
mov edi, dword [0x10035018]
lea eax, [esp + 8]
push eax
push dword [0x10234c7c]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
movd xmm1, eax
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [edi + 4], xmm1
movss dword [edi + 8], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x20]
sub ecx, dword [0x10234c80]
mov edx, dword [esp + 0x24]
sbb edx, dword [0x10234c84]
call fcn.1002a9c0
mov edx, dword [0x10234c8c]
mov ecx, dword [0x10234c88]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x18], xmm0
call fcn.1002a9c0
movss xmm1, dword [esp + 0x18]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0xc], xmm1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [0x10234c80], eax
mov dword [0x10234c84], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xe1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xe2], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xe4], 0
cmp byte [edi + 0x320], 0
mov byte [edi + 0xe3], al
je 0x1001e80b
cvttss2si eax, dword [edi + 0xcc]
mov dword [esp + 0x18], eax
cvttss2si eax, dword [edi + 0xd0]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push dword [0x10234c7c]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp byte [edi + 0xe0], 0
je 0x1001e81c
push 0
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.10003a60
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.100294cb
mov esp, ebp
pop ebp
ret
Function at 0x10026eb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10026ef2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0
push dword [ebp + 8]
mov dword [0x102310b8], eax
push sym.testSCC.dll_void___stdcall_OnDllAttach_void__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push dword [ebp + 8]
push 0x10026d90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop ebp
ret 0xc

Function at 0x10028670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1002869c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100286be
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100286c0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10028745
jg 0x100286d5
test esi, esi
je 0x10028745
test ecx, ecx
jl 0x10028728
jg 0x100286df
test eax, eax
je 0x10028728
cmp edi, ecx
jg 0x100286f3
jl 0x100286e9
cmp esi, eax
jae 0x100286f3
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x10028745
jg 0x1002872b
test esi, esi
je 0x10028745
jmp 0x1002872b
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10028745
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10028760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x1002878c
jl 0x10028780
test esi, esi
jne 0x1002878c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100287a5
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov edx, dword [eax]
test edx, edx
je 0x100287df
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x100287df
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x10028860
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10028808
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x1002884c
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10028873
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10028820
test edx, edx
je 0x10028860
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10028bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1003500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10028c00
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100294cb
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10028c30
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10028c30
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100294cb
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10028d06
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10028c59
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10028c65
movsx eax, bl
jmp 0x10028c9d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10028cc7
sub eax, 1
je 0x10028cc7
sub eax, 2
jne 0x10028d06
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100294cb
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10028ce5
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10028d06
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10028d06
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100294cb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100294cb
mov esp, ebp
pop ebp
ret 4
Function at 0x10028f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10028fdc
cmp byte [esi + 0x3d], 0
je 0x10028fdc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10028fca
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10028f91
sub eax, 1
je 0x10028f95
sub eax, 2
jne 0x10028fca
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100294cb
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10028fb3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10028fca
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100294cb
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100294cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100294cb
mov esp, ebp
pop ebp
ret
Function at 0x4013cf
Capabilities:
Encode data using xor

Disassembly:
jmp 0x411f5d
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x412080
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebx, str.Soviet_aristo_baristo
mov ebp, 0x4f9448
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
sub byte [esi + edi], 0x72
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x42
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x96
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x83
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xad
push ebx
push ebp
call fcn.00403490
add esp, 0x44
push eax
call fcn.004013b6
xor byte [esi + edi], 0x42
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xa0
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x88
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x9e
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 1
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x34
add esp, 0x40
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x7e
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x93
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xcc
add esp, 0x24
inc esi
cmp esi, dword [esp + 0x18]
jb 0x411f7b
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x402946
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x412674
sub esp, 0x20
mov eax, dword [0x4f7024]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x78]
add edi, esi
mov ebx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
add ebx, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4126f3
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401e2e
push str.Hardline
push 0x4f9530
call fcn.00402d60
push eax
call fcn.00406082
lea eax, [esp + 0x20]
push 0x36c
push eax
call fcn.00402cc5
add esp, 0x14
cmp eax, dword [esp + 0x38]
je 0x41270d
lea ecx, [esp + 0x14]
add ebx, 4
call fcn.00402982
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x4126a5
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403030
add esp, 0x20
ret 8
mov eax, dword [edi + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402982
jmp 0x4126f5
Function at 0x4042a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40430a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403b60
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e64
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4042f4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404311
lea eax, [ebp - 0x10]
call fcn.004039f4
ret

Function at 0x406b04
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ecx
push ebx
push edx
xor edx, edx
push 0x406ad4
push dword fs:[edx]
mov dword [0x40c7e0], esp
mov dword [0x40c7e4], ebp
mov dword [0x40c7e8], 0x406ba0
mov dword fs:[edx], esp
mov edi, dword [ebp + 8]
mov ecx, 0x96
xor al, al
repne scasb al, byte es:[edi]
mov ecx, edi
sub ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp word [edx], 0x5a4d
jne 0x406ba0
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x406ba0
mov edx, dword [edx + 0x78]
or edx, edx
je 0x406ba0
add edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x20]
add ebx, dword [ebp + 0xc]
xor eax, eax
mov edi, dword [ebx]
add edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ecx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x406b80
add ebx, 4
inc eax
cmp eax, dword [edx + 0x18]
jb 0x406b67
jmp 0x406ba0
shl eax, 1
add eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ax, word [eax]
and eax, 0xffff
shl eax, 2
add eax, dword [edx + 0x1c]
add eax, dword [ebp + 0xc]
mov eax, dword [eax]
add eax, dword [ebp + 0xc]
jmp 0x406ba2
xor eax, eax
xor edx, edx
pop dword fs:[edx]
add esp, 4
pop edx
pop ebx
pop ecx
pop edi
pop esi
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx