joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000c3df
pop dword [ebp - 0x28]
mov eax, 0x37246587
add eax, 0xd8dc5e58
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x7011329f
add dword [ebp - 0x38], 0xde4112ac
mov dword [ebp - 0x34], 0xdeafa8da
sub dword [ebp - 0x34], 0xac7c5c95
mov dword [ebp - 0x30], 0x28f75f3e
add dword [ebp - 0x30], 0x2354e4f0
mov dword [ebp - 0x2c], 0x7d91d75f
sub dword [ebp - 0x2c], 0x7d91d75f
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x5ac172ee
sub dword [ebp - 0x38], 0xe64f0998
mov dword [ebp - 0x34], 0x181b3cfd
sub dword [ebp - 0x34], 0xd6aedb88
mov dword [ebp - 0x30], 0xabfeb371
sub dword [ebp - 0x30], 0x488f4705
mov dword [ebp - 0x2c], 0x71e7d77e
add dword [ebp - 0x2c], 0x8e182882
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x4ab2c
push 0
call eax
mov ecx, 0x42d9784
add ecx, 0xfbd2c152
xor edx, edx
add edx, eax
mov edi, 0xe6824a6c
add edi, 0x29885394
add edi, dword [ebp - 0x28]
mov esi, 0xf379a448
add esi, 0x269bb860
add dword [ebp - 0x10], edx
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0x61c149e8
add ebx, esi
add dword [ebp - 0xc], 0xd6c01dcc
mov dword [edx], ebx
xor dword [ebp - 0x1c], edi
add edx, 4
add edi, 0xc4f560ac
add edi, 0x3b0a9f58
loop 0x1000c4f9
add eax, 0xd9fd6c00
add eax, 0x2603ea2b
mov ebx, eax
add eax, 5
mov ecx, 0x7ee7f2be
add ecx, 0x91180d42
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x1001b1f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066c15
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScScript::ScopeInfo.0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::SparseArray::constructor_void_]
mov dword [esi + 0x2c], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 4], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0x10000
mov dword [esi + 0x14], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002cef
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
add ebx, esi
push 0x40
lea eax, [ebx + 0x18]
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 4], ecx
push 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
call dword [0x15c605c]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x10002e59
push 0x40
mov edx, esi
mov ecx, edi
call fcn.10003ba0
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.10003ba0
mov eax, dword [ebp - 8]
lea ebx, [esi + 0x18]
movzx ecx, word [eax + 0x14]
movzx esi, word [esi + 0x14]
lea edx, [eax + 0x18]
movzx eax, word [eax + 6]
add ecx, edx
add esi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x10002db7
mov ebx, ecx
sub ebx, esi
mov edi, eax
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
call fcn.10003ba0
add esi, 0x28
dec edi
jne 0x10002d75
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x10002db7
lea esi, [ecx + 0x14]
mov ebx, eax
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call fcn.10003ba0
lea esi, [esi + 0x28]
dec ebx
jne 0x10002d9c
mov ebx, dword [ebp - 0xc]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10004350
push dword [ebp - 0x18]
mov ecx, dword [0x15c7004]
mov edx, edi
call fcn.10004430
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10002e56
cmp dword [ebx + 0x64], 0
je 0x10002e56
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10002dfe
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
mov ecx, eax
xor eax, eax
jmp 0x10002e02
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 4]
push 2
mov dword [edx + 4], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10002e2b
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
mov ecx, eax
xor eax, eax
jmp 0x10002e2d
mov ecx, eax
mov edx, dword [ebp - 4]
push 3
mov dword [edx + 8], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10002e50
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10002ea4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
push 0x40
add ebx, esi
push 0x3000
lea eax, [ebx + 0x18]
mov dword [ebp - 0x1c], ecx
push dword [eax + 0x38]
mov dword [ebp - 0x18], eax
push 0
call dword [0x15c605c]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x10002fad
push 0x40
mov edx, esi
mov ecx, edi
call fcn.10003ba0
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.10003ba0
movzx ecx, word [ebx + 0x14]
lea eax, [esi + 0x18]
movzx esi, word [esi + 0x14]
lea edx, [ebx + 0x18]
movzx ebx, word [ebx + 6]
add ecx, edx
add esi, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x10002f5c
mov edi, ecx
sub edi, esi
push 0x28
lea edx, [edi + esi]
mov ecx, esi
call fcn.10003ba0
add esi, 0x28
dec ebx
jne 0x10002f22
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
test ebx, ebx
je 0x10002f5c
lea esi, [ecx + 0x14]
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call fcn.10003ba0
lea esi, [esi + 0x28]
dec ebx
jne 0x10002f44
mov ebx, dword [ebp - 0x14]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10004350
push dword [ebp - 0x18]
mov ecx, dword [0x15c7004]
mov edx, edi
call fcn.10004430
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10002faa
cmp dword [ebx + 0x64], 0
je 0x10002faa
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10002fa2
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
jmp 0x10002fa4
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10004250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [0x15c7000]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [0x15c607c]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x10004294
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x10004283
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x100042af
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x100042a4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x100042f1
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x100042d4
test esi, esi
je 0x100042fd
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x100042f5
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x15c7000]
call dword [0x15c607c]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call fcn.10001d1b
push ebx
push 0
push dword [0x15c7000]
call dword [0x15c6080]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4032d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push esi
push 0x44
mov esi, eax
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00403e80
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], 8
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
jb 0x40331b
mov esi, dword [esi + 4]
jmp 0x40331e
add esi, 4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40334c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
add esp, 0x60
ret
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov eax, dword [esp + 4]
pop esi
add esp, 0x60
ret

Function at 0x40338c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e028]
jne 0x403396
repz ret
jmp fcn.004039af
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80e030]
jne 0x401116
repz ret
jmp fcn.00401d31

Function at 0x409100
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040587e
and dword [ebp - 4], 0
cmp dword [0x810790], 0
mov ebx, eax
jne 0x4091b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409262
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409262
push eax
call fcn.0040580c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x810790], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x810794], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x810798], eax
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x8107a0], eax
test eax, eax
je 0x4091b1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x81079c], eax
mov eax, dword [0x81079c]
cmp eax, ebx
je 0x409209
cmp dword [0x8107a0], ebx
je 0x409209
push eax
call fcn.00405887
push dword [0x8107a0]
mov esi, eax
call fcn.00405887
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409209
test edi, edi
je 0x409209
call esi
test eax, eax
je 0x409200
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409200
test byte [ebp - 0xc], 1
jne 0x409209
or dword [ebp + 0x10], 0x200000
jmp 0x409242
mov eax, dword [0x810794]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409242
mov eax, dword [0x810798]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x810790]
call fcn.00405887
pop ecx
test eax, eax
je 0x409262
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409264
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011c5
Capabilities:
Terminate process

Disassembly:
xchg esi, eax
add cl, ch
push esi
jecxz 0x4011bf
add byte [ecx], bh
sbb eax, 0x163820
add ch, al
test byte [eax + 0x50f900b4], ch
add ch, al
test byte [eax + 0x50f900b4], ch
mov ah, 0
stc
push eax
call dword [sym.imp.MSVCRT.dll_exit]
cmp dword [0x41029c], ebx
je 0x4011e8
push 0x4000a0
call fcn.00401750
add esp, 4
mov edx, dword [ebp - 4]
xlatb
call fcn.00404730
add esp, 4
jge 0x4011b9
jne 0x4011c9
mov dword [0x340260], 0xb70002
jle 0x401213
add eax, dword [eax]
add byte [ecx], bh
sbb eax, 0x99412b20
je 0xdd0d16
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov dh, byte [edi - 0x48]
add dh, byte [ebx + 0x29000100]
push eax
jmp 0x40151b
cld
lea edx, [ebp - 5]
push ecx
push edx
sbb byte [edx + edi*2], dl
insd dword es:[edi], dx
add byte [eax - 0x45], dl
inc esp
inc esi
add byte [eax], al
test dword [edi - 0x6f937bf1], eax
call [edi + 0x17]
inc ebp
hlt

Function at 0x406fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
cmpsd dword [esi], dword es:[edi]
push ecx
push eax
push esi
push edx
call fcn.00406fa0
mov al, byte [0x5e4518c4]
pop ebp
ret 0xfd
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
jo 0x406f88
fstp xword [ebx]
push edi
cmp esi, ebx
push edi
mov dword [eax - 0x41fa740c], esp
loopne 0x406fac
inc eax
add byte [edx + 0xf300606], cl
invalid
Function at 0x402d00
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x434516
call fcn.0041d834
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402d20
xor eax, eax
call fcn.0041d8b7
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x402d48
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x402d48
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x402d18
cmp dword [esi + 0x54], edi
jne 0x402d52
or eax, 0xffffffff
jmp 0x402d18
mov eax, esi
call fcn.00403b7c
cmp dword [esi + 0x44], edi
jne 0x402d74
push dword [esi + 0x54]
movsx eax, bl
push eax
call dword [sym.imp.MSVCR100.dll_fputc]
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x402d4d
jmp 0x402d44
push edi
push 8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.00407796
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402e31
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2d]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x402e59
cmp eax, 1
jg 0x402e39
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402de0
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x402e07
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402df3
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x402e59
lea eax, [ebp - 0x2d]
mov byte [esi + 0x49], 1
cmp dword [ebp - 0x38], eax
jne 0x402e55
test edi, edi
jne 0x402d93
cmp dword [ebp - 0x1c], 0x20
jae 0x402e59
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00407796
jmp 0x402d93
mov ecx, dword [ebp - 0x2c]
jmp 0x402da5
cmp eax, 3
jne 0x402e59
movsx eax, byte [ebp - 0x2d]
push dword [esi + 0x54]
push eax
call dword [sym.imp.MSVCR100.dll_fputc]
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x402e5c
mov esi, ebx
jmp 0x402e5c
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407796
mov eax, esi
jmp 0x402d18
Function at 0x403a82
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x434700
call fcn.0041d834
xor edi, edi
cmp dword [esi + 0x44], edi
je 0x403b74
cmp byte [esi + 0x49], 0
je 0x403b74
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x403ab8
xor al, al
jmp 0x403b76
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.00407796
mov dword [ebp - 4], edi
lea ebx, [esi + 0x4c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b16
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x403b1b
dec eax
je 0x403b1f
dec eax
dec eax
je 0x403b70
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407796
mov al, bl
jmp 0x403b76
mov ecx, dword [ebp - 0x2c]
jmp 0x403ae5
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b2b
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x403b52
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b3e
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403b04
cmp byte [esi + 0x49], 0
je 0x403b70
test edi, edi
jne 0x403ad7
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00407796
jmp 0x403ad7
mov bl, 1
jmp 0x403b06
mov al, 1
call fcn.0041d8b7
ret
Function at 0x407796
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4077a5
pop dword [ebp - 0x18]
mov eax, 0xf98892c1
sub eax, 0xf9481b1c
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe6404abd
add dword [ebp - 0x28], 0x6811fa8e
mov dword [ebp - 0x24], 0x2d891aee
sub dword [ebp - 0x24], 0xfb55cea9
mov dword [ebp - 0x20], 0x29f475ce
sub dword [ebp - 0x20], 0xdda831a0
mov dword [ebp - 0x1c], 0x6deceedf
add dword [ebp - 0x1c], 0x92131121
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xa7b1e61d
sub dword [ebp - 0x28], 0x333f7cc7
mov dword [ebp - 0x24], 0x1d82e68c
add dword [ebp - 0x24], 0x23e97ae9
mov dword [ebp - 0x20], 0x44eff784
add dword [ebp - 0x20], 0x1e7f74e8
mov dword [ebp - 0x1c], 0xc04421c6
add dword [ebp - 0x1c], 0x3fbbde3a
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x56cb53bf
sub eax, 0x5687d387
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x43c13
push 0
call eax
mov ecx, 0x5a7f
mov esi, eax
mov edi, 0x452800
add edi, dword [ebp - 0x18]
mov ebx, 0x1efb0a96
sub ebx, 0xd227d2b1
xor dword [ebp - 0x14], 0x543affff
mov edx, dword [edi]
sub dword [ebp - 0xc], 0x2d1d185d
sub edx, ebx
mov dword [ebp - 4], 0x7e161c71
mov dword [esi], edx
xor dword [ebp - 8], 0x9865336d
add esi, 4
add edi, 0x65760443
add edi, 0x9a89fbc1
loop 0x4078b6
add eax, 0x2addbd31
add eax, 0xd5239f9e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4be982ef
add ecx, 0xb4567d11
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x408295
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x434516
call fcn.0041d834
mov ebx, 0xffff
mov esi, ecx
cmp bx, word [ebp + 8]
jne 0x4082b5
xor eax, eax
jmp 0x408439
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x4082e6
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x4082e6
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov word [eax], cx
mov ax, cx
jmp 0x408439
cmp dword [esi + 0x54], edi
je 0x408437
mov eax, esi
call fcn.00408f51
cmp dword [esi + 0x44], edi
jne 0x40831b
push dword [esi + 0x54]
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fputwc]
pop ecx
cmp ax, bx
movzx eax, word [ebp + 8]
pop ecx
jne 0x408439
jmp 0x408437
movzx eax, word [ebp + 8]
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.00407796
mov dword [ebp - 4], edi
jmp 0x408342
xor edi, edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4083e0
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::out_int___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
cmp eax, edi
jl 0x40842c
cmp eax, 1
jg 0x4083e8
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40838f
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x4083b6
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4083a2
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408416
lea eax, [ebp - 0x30]
mov byte [esi + 0x4a], 1
cmp dword [ebp - 0x38], eax
jne 0x40841a
test edi, edi
jne 0x408340
cmp dword [ebp - 0x1c], 0x20
push edi
lea ecx, [ebp - 0x2c]
jae 0x408430
push 8
call fcn.00407796
jmp 0x408340
mov ecx, dword [ebp - 0x2c]
jmp 0x408354
cmp eax, 3
jne 0x40842c
push dword [esi + 0x54]
push dword [ebp - 0x30]
call dword [sym.imp.MSVCR100.dll_fputwc]
movzx esi, word [ebp + 8]
pop ecx
pop ecx
cmp ax, bx
jne 0x408406
mov esi, ebx
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407796
mov ax, si
jmp 0x408439
push 0
jmp 0x40842d
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407796
mov ax, word [ebp + 8]
jmp 0x408439
push edi
lea ecx, [ebp - 0x2c]
push 1
call fcn.00407796
mov eax, ebx
call fcn.0041d8b7
ret 4
Function at 0x408e53
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x434700
call fcn.0041d834
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x408f49
cmp byte [esi + 0x4a], bl
je 0x408f49
mov eax, dword [esi]
mov edi, 0xffff
push edi
mov ecx, esi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x408e8f
xor al, al
jmp 0x408f4b
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00407796
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408eeb
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x408ef0
dec eax
je 0x408ef4
dec eax
dec eax
je 0x408f45
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407796
mov al, bl
jmp 0x408f4b
mov ecx, dword [ebp - 0x2c]
jmp 0x408eb8
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408f00
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x408f27
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408f13
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408ed9
cmp byte [esi + 0x4a], 0
je 0x408f45
cmp edi, ebx
jne 0x408eaa
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00407796
jmp 0x408eaa
mov bl, 1
jmp 0x408edb
mov al, 1
call fcn.0041d8b7
ret