joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52fc70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52fe28
sub esp, 0x34
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.00530500
movzx eax, byte [esp + 0xc]
test al, al
je 0x52fd01
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
test ecx, ecx
je 0x52fd01
cmp ecx, 1
je 0x52fcf4
movzx ebx, byte [edx]
test bl, bl
jne 0x52fce6
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x52fd01
cmp bl, 0xff
jne 0x52fcf4
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x52fd01
cmp ecx, 8
jg 0x52fd0a
mov ebx, dword [esp + 0x3c]
xor eax, eax
jmp 0x52fd21
mov byte [esp + 0x40], 0
add esp, 0x34
ret
jg 0x52fd01
mov byte [esp + 0x40], 1
add esp, 0x34
ret
movzx esi, byte [edx + eax]
or esi, ebp
mov dword [ebx], esi
mov dword [ebx + 4], edi
inc eax
cmp eax, ecx
jge 0x52fd45
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
cmp eax, ecx
jb 0x52fd15
jmp 0x52fe22
mov dword [esp + 0x14], ecx
shl ecx, 3
lea edx, [ecx - 0x40]
neg edx
mov byte [esp + 0x13], dl
cmp dl, 0x20
sbb ebp, ebp
mov dword [esp + 0x24], ebp
add ecx, 0xffffffe0
mov esi, ecx
neg ecx
mov byte [esp + 0x12], cl
cmp cl, 0x20
sbb edi, edi
mov dword [esp + 0x20], edi
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb eax, eax
mov dword [esp + 0x1c], eax
mov edi, dword [ebx]
mov dword [esp + 0x18], edi
mov ebx, dword [ebx + 4]
shl edi, cl
mov ecx, edx
shl ebx, cl
and ebx, ebp
mov ecx, esi
mov ebp, dword [esp + 0x18]
shr ebp, cl
and ebp, eax
or ebp, ebx
mov ebx, dword [esp + 0x20]
and ebx, edi
or ebp, ebx
mov ebx, dword [esp + 0x3c]
mov dword [ebx + 4], ebp
movzx edi, byte [esp + 0x12]
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
shr dl, 5
movzx edx, dl
cmp edx, 1
sbb edx, edx
mov dword [esp + 0x20], edx
movzx ecx, byte [esp + 0x13]
mov edx, dword [esp + 0x18]
shl edx, cl
mov eax, dword [esp + 0x24]
and edx, eax
not ebx
or ebx, edi
mov edi, ecx
mov ecx, esi
mov esi, ebp
shl ebp, cl
mov ecx, edi
shr edx, cl
and edx, eax
mov eax, dword [esp + 0x1c]
and ebp, eax
or edx, ebp
mov ecx, ebx
mov eax, esi
sar esi, cl
mov ebx, dword [esp + 0x20]
xor ebx, 0xffffffff
and ebx, esi
or ebx, edx
mov edx, dword [esp + 0x3c]
mov dword [edx], ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ecx, ecx
not ecx
or ecx, edi
sar eax, cl
mov dword [edx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x52fd0a
call fcn.0045e790
nop
call fcn.0045d2d0
jmp fcn.0052fc70
Function at 0x53d190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53d351
sub esp, 0x34
lea eax, [0x62b300]
mov dword [esp], eax
call fcn.0040b620
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x53d1cf
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ebp, ecx
jle 0x53d2f8
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x53d323
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x53d1c7
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x53d1c7
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x53d1c7
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x53d1c7
add esp, 0x34
ret
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x2c]
cmp esi, edx
jge 0x53d2a2
cmp eax, ebp
jle 0x53d2a2
jbe 0x53d347
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x53d2fc
mov eax, esi
mov ecx, edx
call fcn.0045e790
mov ecx, eax
mov eax, ebp
call fcn.0045e790
nop
call fcn.0045d2d0
jmp fcn.0053d190
Function at 0x5430d0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x543178
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x54312b
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x543162
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.0045d2d0
jmp fcn.005430d0
Function at 0x562d50
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x562ec3
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x562d83
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x562d83
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x562d89
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x562d97
cmp ecx, 4
jne 0x562dc8
cmp al, 0x2c
ja 0x562db0
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x562dc2
cmp al, 0x24
je 0x562dc2
cmp al, 0x26
jae 0x562dc2
jmp 0x562dc8
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x562dc2
cmp al, 0x5b
je 0x562dc2
cmp al, 0x5d
jne 0x562dc8
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x562dff
cmp al, 0x26
ja 0x562de1
cmp al, 0x24
je 0x562e1e
cmp al, 0x26
je 0x562e1e
jmp 0x562ea5
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x562e1e
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x562e9f
cmp al, 0x2f
je 0x562e1e
jmp 0x562ea5
cmp al, 0x3d
ja 0x562e16
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x562e1e
cmp al, 0x3d
je 0x562e1e
jmp 0x562ea5
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x562e95
cmp ecx, 2
jg 0x562e59
cmp ecx, 1
je 0x562e4e
cmp ecx, 2
jne 0x562ea5
cmp al, 0x2f
je 0x562e3c
cmp al, 0x3b
je 0x562e3c
cmp al, 0x2c
jne 0x562e43
mov eax, 1
jmp 0x562e49
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x562e7f
cmp al, 0x40
je 0x562e6d
cmp al, 0x2f
je 0x562e6d
cmp al, 0x3f
jne 0x562e74
mov eax, 1
jmp 0x562e7a
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x562e8f
cmp ecx, 7
jne 0x562ea5
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x562e9f
cmp al, 0x7e
jne 0x562ea5
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x562ebd
cmp al, 0x21
je 0x562eb7
add eax, 0xffffffd8
cmp al, 2
ja 0x562ebd
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.0045d2d0
jmp fcn.00562d50
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x4402dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4402ec
pop dword [ebp - 0x30]
mov eax, 0x888da735
sub eax, 0x8849a449
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x53305
push 0
mov eax, 0x445806bb
add eax, 0xbbecabf5
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x2f2ae8af
add ecx, 0xd0d56ba3
mov edi, eax
mov ebx, 0xc764f2e8
add ebx, 0x38e39b18
add ebx, dword [ebp - 0x30]
mov esi, 0xb1d9b16f
add esi, 0x8a261695
mov dword [ebp - 0x14], 0x61258f53
mov edx, dword [ebx]
xor edx, esi
xor dword [ebp - 0x2c], 0xda053335
mov dword [edi], edx
add edi, 0x6e498a48
add edi, 0x91b675bc
add ebx, 4
loop 0x44034b
add eax, 0x1441b
mov ebx, eax
add eax, 0x9499933b
sub eax, 0x94999336
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x440b7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
and dword [ebp - 4], esi
push ebx
call dword [sym.imp.kernel32.dll_lstrlenA]
mov ecx, dword [0x46b874]
mov dword [ebp + 8], eax
cmp ecx, 0xffffffff
jne 0x440bb8
push edi
push ebx
push 0x46c6e8
call main
mov esi, eax
test esi, esi
js 0x440c0f
xor esi, esi
jmp 0x440c0f
test eax, eax
je 0x440c0f
push 0
lea edx, [ebp - 4]
sub eax, edi
push edx
push eax
lea eax, [edi + ebx]
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x440bed
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440beb
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440bff
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp edi, eax
jae 0x440c0f
mov ecx, dword [0x46b874]
jmp 0x440bbc
push esi
push 0x310
push str.c:_agent_work138_s_srclibsdutillogutil.cpp
call fcn.004038f5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x4103c0
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax + 1], 0x58
shl dword [edi + 0x19f5f636], 0x88
invalid
Function at 0x402c84
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x4022b8], eax
je 0x402ca6
cmp dword [0x4022b8], ebx
jne 0x402d3f
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4022b8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x4022b8], esi
test esi, esi
jne 0x402d15
mov dword [0x4022b8], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x4022b8
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call fcn.00573000
mov eax, dword [0x4022b8]
not eax
mov dword [0x405124], eax
pop esi
pop ebx
leave
ret

Function at 0x402d42
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4022b8]
jne 0x402d4b
ret
jmp fcn.00402fe8
Function at 0x402fde
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x403da0
call fcn.004033b0
xor ebx, ebx
cmp dword [0x4055e8], ebx
jne 0x402dbc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x4055dc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x402df6
cmp eax, esi
jne 0x402de9
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x402df9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402dd0
xor esi, esi
inc esi
mov eax, dword [0x4055d8]
cmp eax, esi
jne 0x402e0c
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x402e47
mov eax, dword [0x4055d8]
test eax, eax
jne 0x402e41
mov dword [0x4055d8], esi
push 0x401138
push 0x40112c
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x402e47
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402f1e
mov dword [0x405288], esi
mov eax, dword [0x4055d8]
cmp eax, esi
jne 0x402e6b
push 0x401128
push 0x401120
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x4055d8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x402e78
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x4055ec], ebx
je 0x402e99
push 0x4055ec
call fcn.004032e0
pop ecx
test eax, eax
je 0x402e99
push ebx
push 2
push ebx
call dword [0x4055ec]
mov eax, dword [0x405270]
mov ecx, dword [sym.imp.MSVCR100.dll___winitenv]
mov dword [ecx], eax
push dword [0x405270]
push dword [0x405274]
push dword [0x40526c]
call fcn.00402ab2
add esp, 0xc
mov dword [0x405284], eax
cmp dword [0x405278], ebx
jne 0x402f04
push eax
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR100.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x405288], ebx
jne 0x402f12
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x405284]
call fcn.004033f5
ret
call fcn.00402c84
jmp 0x402d9b

Function at 0x403824
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4022b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
push esi
mov word [edi], ax
push 0x2b
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x403896
cmp word [ebp - 0x20c], si
je 0x403896
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
push 0x4024e0
push eax
call fcn.00403731
mov esi, eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00402d42
leave
ret 8
Function at 0x409500
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x409522
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x409510
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret

Function at 0x409530
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x409552
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x409540
mov byte [esi + 6], 0
mov eax, esi
pop esi
ret
Function at 0x40a460
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x40a482
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x40a470
mov byte [esi + 3], 0
mov eax, esi
pop esi
ret

Function at 0x40a490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0x526c60]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x21], 0xcfc0dec4
mov dword [ebp - 0x1d], 0xdcded9db
mov word [ebp - 0x19], 0x100
nop word [eax + eax]
lea eax, [ecx - 0x65]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x18
jb 0x40a4c0
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0xf2f9e8f5
mov dword [ebp - 0x13], 0xcec58ef3
mov word [ebp - 0xf], 0xcf
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx - 0x65]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x40a4f0
push ebx
push esi
push edi
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x31]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor edi, edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 4], eax
test eax, eax
je 0x40a5ab
mov esi, dword [0x5354b4]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call ebx
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc0000004
jne 0x40a58c
mov ebx, dword [ebp - 4]
push edi
push 0
push ebx
call eax
add esi, esi
cmp esi, 0x10000000
ja 0x40a5a1
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call dword [ebp - 8]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc0000004
je 0x40a555
test ebx, ebx
jns 0x40a5b1
push edi
push 0
push dword [ebp - 4]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov eax, dword [0x5354b4]
cmp esi, 0x200000
cmovbe eax, esi
mov dword [0x5354b4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a5e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x40a602
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x40a5f0
mov byte [esi + 0xa], 0
mov eax, esi
pop esi
ret

Function at 0x40a610
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x40a632
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x40a620
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
ret
Function at 0x40a750
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x40a772
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x40a760
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret

Function at 0x40a780
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x40a7a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x40a790
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret
Function at 0x40abb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x40abd2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x40abc0
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret
Function at 0x40b8c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x40b8e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x40b8d0
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret

Function at 0x40b8f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x40b912
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x65]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x40b900
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x40b920
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503d86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100fee9
lea eax, [ecx - 0x65]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x40b984
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push edi
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e3680
mov edi, eax
add esp, 8
test edi, edi
je 0x40ba1d
push 2
push 0
push edi
call fcn.004e7456
push edi
call fcn.004e320b
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.004e7456
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x40b9f1
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b9e8
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x40ba00
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00468e40
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40ba0a
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.004ebeff
push edi
call fcn.004e6f08
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 0x10
jb 0x40ba4e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ba44
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba5f
push ecx
push edx
call fcn.004dd831
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004e2ad0
int3