joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47aefd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x495400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0xc], 0
je 0x406e52
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x76]
inc edx
xor byte [ecx], al
cmp edx, 0xb
jb 0x406e40
mov byte [esi + 0xc], 0
push ecx
lea eax, [esi + 0xb]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x406e72
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00413700
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x406eeb
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406ee1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406ee1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00479834
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408380
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b1d5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x495400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, closesocket
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 0x2d
jb 0x408539
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
push ecx
cmova eax, dword [ebp + 8]
push eax
push 0x2d
push str.start_cmd__C__color_b__title_Error__echo
push ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.00412a90
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebp - 0x30]
sub eax, ecx
push 0x11
push str.__timeout__t_5_
cmp eax, 0x11
jb 0x40841e
cmp edx, 0xf
lea esi, [ebp - 0x40]
lea eax, [ecx + 0x11]
cmova esi, dword [ebp - 0x40]
add esi, ecx
mov dword [ebp - 0x30], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x11], 0
lea eax, [ebp - 0x40]
jmp 0x40842b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
push 0x11
call fcn.00411050
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 0xf
jbe 0x4084a7
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40849d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4084df
push ecx
push edx
call fcn.00479834
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x4084ef
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4084e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4084e5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00479834
add esp, 8
xor ecx, ecx
int 0x29
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x408529
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40851f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40851f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00479834
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00401510
int3
Function at 0x408880
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b2c7
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x495400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
push str.ALLUSERSPROFILE
mov dword [ebp - 0x38], 0
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edx, eax
add esp, 4
test edx, edx
je 0x408907
mov ecx, edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4088f0
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.004111b0
jmp 0x408a40
mov dword [ebp - 4], 1
xorps xmm0, xmm0
push ecx
xor eax, eax
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
push 0x104
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 0x38], 4
call fcn.0040d100
nop
cmp dword [ebp - 0x1c], 7
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
cmova eax, dword [ebp - 0x30]
push eax
push ecx
mov dword [ebp - 0x14], ecx
call fcn.004219b2
mov ecx, dword [ebp - 0x20]
mov esi, eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x40], ecx
cmp esi, ecx
ja 0x40897d
cmp dword [ebp - 0x1c], 7
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], esi
cmova eax, dword [ebp - 0x30]
xor ecx, ecx
mov word [eax + esi*2], cx
jmp 0x4089d2
mov edi, dword [ebp - 0x1c]
mov edx, esi
mov eax, edi
sub edx, ecx
sub eax, ecx
cmp edx, eax
ja 0x4089c1
cmp edi, 7
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x30]
cmova eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
lea edi, [eax + ecx*2]
test edx, edx
je 0x4089b3
xor eax, eax
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x40]
lea eax, [ecx + edx]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x4089cf
push ecx
push edx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
push edx
call fcn.00411750
mov edx, dword [ebp - 0x34]
cmp esi, dword [ebp - 0x14]
jae 0x408940
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x495470
mov dword [ebp - 0x38], 2
test edx, edx
jne 0x408a5d
mov esi, dword [ebp - 0x3c]
push ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.00410330
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x408a40
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x408a36
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x408a36
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00479834
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004794f0
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x18]
call fcn.00404360
int3
Function at 0x40af40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x40af62
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x40af50
mov byte [esi + 5], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push esi
call fcn.00410550
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40af80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x40afa2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x40af90
mov byte [esi + 0xb], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xa]
push eax
push esi
call fcn.00410550
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x40b192
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x40b180
mov byte [esi + 8], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 7]
push eax
push esi
call fcn.00410550
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x40b1d2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x40b1c0
mov byte [esi + 0x10], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xf]
push eax
push esi
call fcn.00410550
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40b5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40b5dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x40b604
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40b60a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x40b672
jg 0x40b621
test esi, esi
je 0x40b672
test ecx, ecx
jl 0x40b66d
jg 0x40b62b
test eax, eax
je 0x40b66d
cmp edi, ecx
jg 0x40b63f
jl 0x40b635
cmp esi, eax
jae 0x40b63f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x40b675
mov ecx, dword [ebp + 8]
jmp 0x40b67f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x40b699
jg 0x40b67f
test esi, esi
je 0x40b699
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40b699
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40b6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x40b6dc
jl 0x40b6d0
test ecx, ecx
jne 0x40b6dc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40b6f5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x40b73d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x40b743
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x40b743
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x40b7b6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40b76c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x40b7a4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x40b7b6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x40b780
test edi, edi
je 0x40b7b6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40bb30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x495400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40bb60
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004794f0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40bb9c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40bb9c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004794f0
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40bc73
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40bbc4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40bbd0
movsx eax, bl
jmp 0x40bc08
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x40bc32
sub eax, 1
je 0x40bc32
sub eax, 2
jne 0x40bc73
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004794f0
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40bc50
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40bc73
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004794f0
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004794f0
mov esp, ebp
pop ebp
ret 4

Function at 0x40be50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x40be72
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x40be60
mov byte [esi + 9], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 8]
push eax
push esi
call fcn.00410550
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40be90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x40beb2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x40bea0
mov byte [esi + 6], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 5]
push eax
push esi
call fcn.00410550
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40bed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x40bef2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x40bee0
mov byte [esi + 0xa], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 9]
push eax
push esi
call fcn.00410550
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40e7f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x495400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40e8ac
cmp byte [esi + 0x3d], 0
je 0x40e8ac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40e89a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40e861
sub eax, 1
je 0x40e865
sub eax, 2
jne 0x40e89a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004794f0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40e883
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40e89a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004794f0
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004794f0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004794f0
mov esp, ebp
pop ebp
ret
Function at 0x412dc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c00c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x495400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x412e74
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.0040f9e0
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.00413b20
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x412eb8
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x41c720
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x495400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x108], eax
mov esi, edx
mov eax, dword [ebp + 0x10]
mov edi, ecx
push 0x40
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x40
lea eax, [ebp - 0x44]
push 0x36
push eax
call sub.VCRUNTIME140.dll_memset
push 0x40
lea eax, [ebp - 0x84]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
lea eax, [ebp - 0x104]
cmp esi, 0x40
jbe 0x41c798
push 0x40
push eax
mov edx, esi
mov ecx, edi
call fcn.0041c8d0
add esp, 8
jmp 0x41c7a3
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
nop word [eax + eax]
movups xmm1, xmmword [ebp + eax - 0x104]
movups xmm0, xmmword [ebp + eax - 0x44]
xorps xmm0, xmm1
movups xmmword [ebp + eax - 0x44], xmm0
movups xmm0, xmmword [ebp + eax - 0x84]
xorps xmm0, xmm1
movups xmmword [ebp + eax - 0x84], xmm0
add eax, 0x10
cmp eax, 0x40
jl 0x41c7b0
mov esi, dword [ebp + 0xc]
lea ebx, [esi + 0x40]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movups xmm0, xmmword [ebp - 0x44]
mov edi, eax
push esi
push dword [ebp - 0x108]
movups xmmword [edi], xmm0
lea eax, [edi + 0x40]
movups xmm0, xmmword [ebp - 0x34]
push eax
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [edi + 0x30], xmm0
call sub.VCRUNTIME140.dll_memcpy
lea eax, [ebp - 0xa4]
mov edx, ebx
push 0x20
push eax
mov ecx, edi
call fcn.0041c8d0
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call edi
push 0x60
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movups xmm0, xmmword [ebp - 0x84]
mov esi, eax
mov edx, 0x60
lea eax, [ebp - 0xc4]
mov ecx, esi
push 0x20
push eax
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x74]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x64]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x54]
movups xmmword [esi + 0x30], xmm0
movups xmm0, xmmword [ebp - 0xa4]
movups xmmword [esi + 0x40], xmm0
movups xmm0, xmmword [ebp - 0x94]
movups xmmword [esi + 0x50], xmm0
call fcn.0041c8d0
push esi
call edi
mov esi, dword [ebp + 0x14]
mov eax, 0x20
cmp esi, eax
cmova esi, eax
lea eax, [ebp - 0xc4]
push esi
push eax
push dword [ebp - 0x10c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0x38
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004794f0
mov esp, ebp
pop ebp
ret
Function at 0x41c8d0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x495400]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edx
mov edx, ecx
mov dword [esp + 0x34], 0
lea ecx, [esp + 0xc]
movlpd qword [esp + 0xc], xmm0
mov dword [esp + 0x14], 0x6a09e667
mov dword [esp + 0x18], 0xbb67ae85
mov dword [esp + 0x1c], 0x3c6ef372
mov dword [esp + 0x20], 0xa54ff53a
mov dword [esp + 0x24], 0x510e527f
mov dword [esp + 0x28], 0x9b05688c
mov dword [esp + 0x2c], 0x1f83d9ab
mov dword [esp + 0x30], 0x5be0cd19
call fcn.0041cb80
lea edx, [esp + 0x80]
lea ecx, [esp + 0xc]
call fcn.0041cc30
mov eax, dword [ebp + 0xc]
mov ecx, 0x20
cmp eax, ecx
cmova eax, ecx
push eax
lea eax, [esp + 0x84]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0xac]
add esp, 0x10
pop esi
xor ecx, esp
call fcn.004794f0
mov esp, ebp
pop ebp
ret