joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f050
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x492388
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x42f089
inc eax
mov dword [esi + 0x10], eax
jmp 0x42f19c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x42f09d
mov eax, 0xffffffc7
jmp 0x42f19e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x42f0ae
cmp dword [esi + 8], eax
jne 0x42f09d
cmp dword [esi + 8], eax
jne 0x42f0c7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x42f0c7
mov eax, 0xffffffc7
jmp 0x42f19e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x42f0db
push eax
mov ecx, ebx
call fcn.0042e880
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00402310
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x42f10c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00402330
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0042dff0
test eax, eax
mov dword [esp + 0x38], eax
je 0x42f13f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x6a2a18
call fcn.00402510
mov eax, dword [esp + 0x38]
jmp 0x42f19e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0042eeb0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x42f183
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0042eed0
mov esi, eax
test esi, esi
jne 0x42f1b3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0042eeb0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x42f155
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x6a2a18
call fcn.00402510
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x6a2a18
call fcn.00402510
mov eax, esi
jmp 0x42f19e

Function at 0x433b90
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x433bf0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x433bf0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x433bf0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x433bf0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x433c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x442330
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x442363
push esi
call fcn.004506f0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44235c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4423e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4423d2
mov eax, dword [esi + 8]
test eax, eax
je 0x442387
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4423ce
cmp eax, 2
je 0x4423d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44237a
cmp eax, 3
je 0x4423ad
cmp eax, 1
jne 0x44237a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44237a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44237a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00442410
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4423f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00442410
add esp, 4
pop esi
ret

Function at 0x442c90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x442cb1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x442cb1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x442cb1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x460160
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x6dcdec]
xor edx, edx
cmp eax, edx
jne 0x460186
xor eax, eax
mov byte [eax + 0x6dccec], al
inc eax
cmp eax, 0x100
jl 0x46016e
mov dword [0x6dcdec], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x6dccec
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x460217
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4601ea
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4601b8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x460290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4602e3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4602ca
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x466c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49322e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004675b0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x6a65c4
call fcn.00484de2
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x466d23
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00484de2
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x466d1c
push 0
mov ecx, eax
call fcn.0045dd90
mov dword [esi + 0xc], eax
jmp 0x466d25
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x466d25
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x487448
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x487480
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004854fc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004854d4
jmp 0x48748c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x488b3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x488b7c
call fcn.0048e5ea
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x488b7c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x488b73
xor eax, eax
jmp 0x488b84
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00488b8a
pop edi
pop esi
pop ebx
ret 4
Function at 0x4030ce
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 8]
mov bl, 1
movzx eax, byte [ecx]
mov esi, dword [ecx + 8]
mov edi, dword [ecx + 4]
mov edx, eax
add edi, esi
shr edx, 1
test al, bl
mov eax, 4
lea edx, [ecx + edx + 1]
lea ecx, [ecx + 1]
cmovne edx, edi
cmovne ecx, esi
sub edx, ecx
cmp edx, eax
jb 0x40312c
mov eax, edx
imul esi, dword [ecx], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add edx, 0xfffffffc
add ecx, 4
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
xor eax, esi
cmp edx, 3
ja 0x403104
jmp 0x40312e
mov eax, edx
cmp edx, 1
je 0x40314f
cmp edx, 2
je 0x403146
cmp edx, 3
jne 0x40315a
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x403e38
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, edx
movzx eax, cx
and edx, 0x1f
shr ecx, 0x10
shr esi, 5
mov dword [ebp - 0x10], edx
test esi, esi
je 0x403f6c
mov edx, esi
mov edi, esi
mov esi, 0xad
mov edi, 0xad
mov dword [ebp - 0x14], edx
movd xmm4, ecx
pxor xmm6, xmm6
mov dword [ebp - 0x18], ebx
cmp edx, esi
cmovb edi, edx
mov edx, eax
mov ecx, edi
imul edx, edi
movd xmm5, edx
shl ecx, 5
mov edx, edi
movdqu xmm1, xmmword [ebx]
movdqu xmm3, xmmword [ebx + 0x10]
movdqa xmm7, xmm6
pxor xmm2, xmm2
add ebx, 0x20
dec edx
paddd xmm5, xmm7
movdqa xmm0, xmm1
movdqa xmm6, xmm3
psadbw xmm0, xmm2
psadbw xmm6, xmm2
movdqa xmm2, xmmword [0x52f610]
paddd xmm6, xmm0
movdqa xmm0, xmmword [0x52f600]
paddd xmm6, xmm7
pmaddubsw xmm3, xmm2
movdqa xmm2, xmmword [0x52f5f0]
pmaddwd xmm3, xmm0
paddd xmm4, xmm3
pmaddubsw xmm1, xmm2
pmaddwd xmm1, xmm0
paddd xmm4, xmm1
jne 0x403e94
pshufd xmm0, xmm6, 0xb1
pslld xmm5, 5
mov ebx, dword [ebp - 0x18]
mov edx, 0x80078071
paddd xmm0, xmm6
paddd xmm4, xmm5
pshufd xmm1, xmm0, 0x4e
paddd xmm1, xmm0
pshufd xmm0, xmm4, 0xb1
movd esi, xmm1
paddd xmm0, xmm4
add ebx, ecx
add esi, eax
pshufd xmm1, xmm0, 0x4e
mov eax, esi
paddd xmm1, xmm0
mul edx
movd ecx, xmm1
shr edx, 0xf
imul eax, edx, 0xfff1
mov edx, 0x80078071
sub esi, eax
mov eax, ecx
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
mov edx, dword [ebp - 0x14]
sub ecx, eax
mov eax, esi
sub edx, edi
jne 0x403e67
jmp 0x403f6e
mov esi, eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x404041
cmp edx, 0x10
jb 0x404011
movzx eax, byte [ebx]
mov edi, ebx
add esi, eax
movzx eax, byte [ebx + 1]
mov ebx, edx
movzx edx, byte [edi + 2]
add ecx, esi
add eax, esi
movzx esi, byte [edi + 0xd]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 3]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 4]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 5]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 6]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 7]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 8]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 9]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 0xa]
add ecx, eax
add edx, eax
movzx eax, byte [edi + 0xb]
add ecx, edx
add eax, edx
movzx edx, byte [edi + 0xc]
add ecx, eax
add edx, eax
add ecx, edx
add esi, edx
movzx edx, byte [edi + 0xe]
add ecx, esi
add edx, esi
movzx esi, byte [edi + 0xf]
add ecx, edx
add esi, edx
mov edx, ebx
add ecx, esi
add edx, 0xfffffff0
je 0x40401e
add edi, 0x10
jmp 0x404013
mov edi, ebx
movzx eax, byte [edi]
inc edi
add esi, eax
add ecx, esi
dec edx
jne 0x404013
lea eax, [esi - 0xfff1]
cmp esi, 0xfff0
mov edx, 0x80078071
cmova esi, eax
mov eax, ecx
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
shl ecx, 0x10
or ecx, esi
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movd xmm0, dword [ebp + 0x10]
mov edx, 0x40
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
add eax, 0xffffffc0
add ecx, edx
cmp eax, edx
pxor xmm0, xmm4
jb 0x404131
movdqa xmm5, xmmword [0x52f630]
movdqa xmm4, xmmword [0x52f620]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [ecx]
add eax, 0xffffffc0
pclmulqdq xmm7, xmm5, 0x11
pclmulqdq xmm6, xmm4, 0
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
movdqa xmm4, xmm3
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm4, xmm5, 0x11
pclmulqdq xmm7, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
movdqu xmm2, xmmword [ecx + 0x20]
pclmulqdq xmm6, xmmword [0x52f620], 0
pxor xmm3, xmm4
movdqa xmm4, xmm1
pclmulqdq xmm4, xmmword [0x52f620], 0
pxor xmm2, xmm6
movdqa xmm6, xmm1
movdqu xmm1, xmmword [ecx + 0x30]
add ecx, 0x40
cmp eax, 0x3f
pclmulqdq xmm6, xmm5, 0x11
pxor xmm2, xmm7
pxor xmm1, xmm4
pxor xmm1, xmm6
ja 0x40408f
movdqa xmm5, xmmword [0x52f650]
movdqa xmm4, xmmword [0x52f640]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm6, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm6
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm3
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm1
pxor xmm0, xmm2
jb 0x4041b5
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
add eax, 0xfffffff0
add ecx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm0, xmm1
pxor xmm0, xmm2
ja 0x40418e
movdqa xmm1, xmmword [0x52f650]
pxor xmm2, xmm2
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
movss xmm2, xmm0
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x52f660], 0
pxor xmm2, xmm0
pxor xmm0, xmm0
movss xmm0, xmm2
pclmulqdq xmm0, xmmword [0x52f670], 0x10
pblendw xmm0, xmm1, 0xfc
pclmulqdq xmm0, xmmword [0x52f680], 0
pxor xmm0, xmm2
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x408600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
lea edi, [ebp - 0x1c]
mov ebx, 4
mov esi, ecx
dec eax
mov dword [edi], esp
mov dword [edi + 0xc], eax
mov dword [edi + 8], 0x409540
mov eax, dword fs:[0]
mov dword [edi + 4], eax
lea eax, [edi + ebx]
mov dword fs:[0], eax
call fcn.00406bde
mov eax, dword [ebp + 8]
mov dword [esi], vtable.std::__1::__stdinbuf_char_.0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
xor eax, eax
add ebx, esi
dec eax
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], 0
push ebx
call fcn.00409f64
mov eax, dword [esi]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [edi + 0xc], 0
push edx
call eax
lea ecx, [ebp - 0x20]
call fcn.0040a0a2
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4086b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
lea edi, [ebp - 0x1c]
mov ebx, 4
mov esi, ecx
mov dword [edi], esp
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 8], 0x409550
mov eax, dword fs:[0]
mov dword [edi + 4], eax
lea eax, [edi + ebx]
mov dword fs:[0], eax
call fcn.00406c56
mov eax, dword [ebp + 8]
mov dword [esi], vtable.std::__1::__stdinbuf_wchar_t_.0
add ebx, esi
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
mov word [esi + 0x30], 0xffff
mov byte [esi + 0x32], 0
push ebx
call fcn.00409f64
mov eax, dword [esi]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [edi + 0xc], 0
push edx
call eax
lea ecx, [ebp - 0x20]
call fcn.0040a0a2
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x409110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp], ecx
lea ecx, [esp + 0x10]
mov eax, dword [0x584fa8]
xor eax, ebp
mov dword [esp + 0x10], eax
xor eax, eax
mov edi, dword [esp]
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov dword [esp + 4], 0xffffffff
lea edx, [esp + 4]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x10]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov esi, dword [esp + 4]
mov ebx, eax
lea eax, [esp + 8]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0051a21b
add esp, 0x10
cmp eax, esi
jne 0x40919e
cmp ebx, 1
je 0x40913a
cmp ebx, 2
mov esi, 0xffffffff
je 0x4091a1
mov eax, dword [esp]
push dword [eax + 0x20]
call fcn.00519d9e
add esp, 4
neg eax
sbb esi, esi
jmp 0x4091a1
xor esi, esi
dec esi
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.005031f1
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4091c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4091e4
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.0051a21b
add esp, 0x14
jmp 0x409213
test esi, esi
jle 0x40920c
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, byte [eax + edi]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x40920e
inc edi
mov eax, ebx
cmp esi, edi
jne 0x4091ed
mov edi, esi
jmp 0x40920e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x409220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x584fa8]
mov edi, ecx
mov ecx, dword [ebp + 8]
xor eax, ebp
xor ebx, ebx
dec ebx
mov dword [esp + 0x18], eax
mov byte [esp + 0xf], 0xff
cmp ecx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
je 0x409310
mov byte [esp + 0xf], cl
cmp byte [edi + 0x2c], 0
je 0x409283
xor esi, esi
lea eax, [esp + 0xf]
inc esi
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.0051a21b
add esp, 0x10
mov ecx, dword [ebp + 8]
cmp eax, esi
je 0x409310
jmp 0x40931d
lea esi, [esp + 0xf]
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
mov dword [ecx], eax
mov dword [esp + 4], 0xffffffff
lea edx, [esp + 8]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x20]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [esp + 4], esi
je 0x40931a
mov ebx, eax
cmp eax, 3
je 0x4092f8
cmp ebx, 1
ja 0x40931a
mov esi, dword [esp + 8]
lea eax, [esp + 0x10]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0051a21b
add esp, 0x10
cmp eax, esi
jne 0x40931a
mov esi, dword [esp + 4]
cmp ebx, 1
je 0x409291
jmp 0x40930d
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.0051a21b
add esp, 0x10
cmp eax, ebx
jne 0x40931a
mov ecx, dword [ebp + 8]
xor ebx, ebx
cmp ecx, 0xffffffff
cmovne ebx, ecx
jmp 0x40931d
xor ebx, ebx
dec ebx
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.005031f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x409370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x409394
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.0051a21b
add esp, 0x14
jmp 0x4093c4
test esi, esi
jle 0x4093bd
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x4093bf
inc edi
mov eax, ebx
cmp esi, edi
jne 0x40939d
mov edi, esi
jmp 0x4093bf
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4093d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x584fa8]
movzx ebx, word [ebp + 8]
xor eax, ebp
mov dword [esp + 0x18], eax
xor eax, eax
dec eax
cmp bx, ax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov word [esp + 0xe], ax
je 0x4094c9
mov word [esp + 0xe], bx
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x409437
xor esi, esi
lea eax, [esp + 0xe]
inc esi
push dword [edi + 0x20]
push esi
push 2
push eax
call fcn.0051a21b
add esp, 0x10
cmp eax, esi
je 0x4094c9
xor ebx, ebx
dec ebx
jmp 0x4094d2
lea esi, [esp + 0xe]
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
mov dword [ecx], eax
mov dword [esp + 4], 0xffffffff
lea edx, [esp + 8]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x20]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [esp + 4], esi
je 0x40942f
mov ebx, eax
cmp eax, 3
je 0x4094ac
cmp ebx, 1
ja 0x40942f
mov esi, dword [esp + 8]
lea eax, [esp + 0x10]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0051a21b
add esp, 0x10
cmp eax, esi
jne 0x40942f
mov esi, dword [esp + 4]
cmp ebx, 1
je 0x409445
jmp 0x4094c5
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.0051a21b
add esp, 0x10
cmp eax, ebx
jne 0x40942f
movzx ebx, word [ebp + 8]
xor eax, eax
cmp bx, 0xffff
cmove ebx, eax
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.005031f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x40d6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x40d6ff
movsx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x40d6e1
pop esi
pop edi
pop ebp
ret 8

Function at 0x40d800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x40d831
movzx esi, word [edx]
shl eax, 4
add edx, 2
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x40d811
pop esi
pop edi
pop ebp
ret 8