joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bda7
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x419
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
jne 0x40bdce
cmp eax, 0x2b
jne 0x40bdce
push dword [ebp + 0x10]
call fcn.0040a6ed
xor eax, eax
inc eax
jmp 0x40bee4
push ebx
push edi
cmp eax, 0x133
jne 0x40be2a
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3e9
push dword [esi + 4]
call edi
cmp dword [ebp + 0x10], eax
jne 0x40bdf3
xor ebx, ebx
cmp byte [esi + 0x2c], bl
jmp 0x40be0b
push 0x3eb
push dword [esi + 4]
call edi
cmp dword [ebp + 0x10], eax
jne 0x40bee0
xor ebx, ebx
cmp byte [esi + 0x2d], bl
jne 0x40be14
push 0x808080
jmp 0x40be15
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SetTextColor]
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x40bee2
cmp eax, 0x4e
jne 0x40beb4
cmp dword [ebp + 0xc], 0x3f2
jne 0x40bee0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 8]
cmp ecx, 0xfffffffd
jne 0x40be78
mov eax, dword [eax + 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x40be5d
push 1
push ebx
push ebx
push dword [esi + 0x43]
jmp 0x40be68
cmp eax, 1
jne 0x40bee0
push eax
push ebx
push ebx
push dword [esi + 0x47]
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40bee0
cmp ecx, 0xffffff65
jne 0x40bea6
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x43
call edi
cwde
mov ebx, SysReAllocString
test ebx, eax
je 0x40bee0
push 0x11
call edi
cwde
test ebx, eax
je 0x40bee0
mov ecx, esi
call fcn.0040a90a
jmp 0x40bee0
cmp ecx, 0xffffff93
jne 0x40bee0
mov ecx, esi
call fcn.0040b771
jmp 0x40bee0
cmp eax, 0x7b
jne 0x40bee0
push 0x3f2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, dword [ebp + 0xc]
jne 0x40bee0
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
push ecx
movzx ecx, word [ebp + 0x10]
push ecx
push eax
mov ecx, esi
call fcn.0040ad42
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x40dfbb
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x423313
call fcn.00421412
mov edi, ecx
mov ecx, dword [edi + 0x48]
xor ebx, ebx
cmp ecx, ebx
je 0x40dfd7
call fcn.0040ec2a
push str.CReportInetSession::SendBugReportFirst_enter
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, 0x436718
push esi
lea ecx, [ebp - 0x18]
call fcn.004040ca
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004040ca
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004040ca
lea eax, [edi + 0x54]
mov ecx, dword [eax]
mov byte [ebp - 4], 2
cmp dword [ecx - 0xc], ebx
je 0x40e022
push eax
lea ecx, [ebp - 0x14]
call fcn.00401d11
jmp 0x40e04e
lea eax, [ebp - 0x1c]
push str.BR_STATICTIS_URL
push eax
call fcn.0040bd0a
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00401d11
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00401171
mov esi, dword [ebp - 0x14]
mov eax, dword [esi - 0xc]
lea eax, [eax + eax + 1]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], eax
call fcn.0040434d
push ebx
push ebx
push dword [ebp - 0x1c]
push eax
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040c758
lea eax, [ebp - 0x10]
push eax
mov ecx, eax
call fcn.00404b7c
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.0040db0c
test al, al
je 0x40e0b0
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x50]
call fcn.00404b7c
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.00401171
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401171
mov al, bl
call fcn.004214ea
ret
Function at 0x40e25f
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x43674c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x2f
lea eax, [ebp - 0x33]
push 0
push eax
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x34], 0
call sub.MSVCR100.dll_memset
push 0x30
pop edi
push edi
lea eax, [ebp - 0x34]
push 0
push eax
call sub.MSVCR100.dll_memset
lea eax, [ebp - 0x34]
push ebx
push eax
mov ecx, 0x428f70
call fcn.0040e1ac
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
add esp, 0x20
xor ecx, ecx
sub esi, eax
lea eax, [ebp + ecx - 0x34]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, edi
jl 0x40e2b4
mov dword [ebp - 0x3c], ebx
xor edi, edi
lea eax, [ebp - 0x33]
movsx edx, byte [eax + 4]
movsx ecx, byte [eax - 1]
movsx esi, byte [eax + 1]
lea ecx, [edx + ecx*2]
movsx edx, byte [eax]
lea edx, [esi + edx*2]
movsx esi, byte [eax + 2]
lea edx, [esi + edx*2]
movsx esi, byte [eax + 3]
add ecx, edi
xor ebx, ebx
lea edx, [esi + edx*2]
add ecx, ecx
lea esi, [edx + ecx*8 + 0x429038]
mov dword [ebp - 0x38], 3
mov cl, byte [ebp - 0x38]
mov dl, byte [esi]
sar dl, cl
mov ecx, dword [ebp - 0x3c]
and dl, 1
mov byte [ebx + ecx], dl
inc ebx
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffff
jg 0x40e301
add dword [ebp - 0x3c], 4
add edi, 4
add eax, 6
cmp edi, 0x20
jl 0x40e2ca
push dword [ebp - 0x40]
mov ecx, 0x428fa0
push dword [ebp - 0x40]
push 0x20
pop edi
call fcn.0040e1ac
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421350
leave
ret

Function at 0x40e34e
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x43674c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
lea eax, [ebp - 0x43]
push ebx
push eax
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x44], bl
call sub.MSVCR100.dll_memset
push 0x40
push dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
call fcn.0040e0d6
lea eax, [ebp - 0x44]
push eax
push eax
push 0x38
pop edi
mov ecx, str.91__
call fcn.0040e1ac
add esp, 0x20
mov dword [ebp - 0x48], ebx
mov ebx, dword [ebp - 0x48]
lea ebx, [ebx + 0x429028]
movsx edi, byte [ebx]
push 0x1c
lea esi, [ebp - 0x44]
call fcn.0040e10d
movsx edi, byte [ebx]
push 0x1c
lea esi, [ebp - 0x28]
call fcn.0040e10d
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x4c]
mov ecx, 0x428ff8
push 0x30
pop edi
call fcn.0040e1ac
add dword [ebp - 0x4c], edi
add esp, 0x10
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x10
jl 0x40e39b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421350
leave
ret
Function at 0x40e3f0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x43674c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x43]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x44], bl
call sub.MSVCR100.dll_memset
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x64], bl
lea edi, [ebp - 0x63]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40
stosb byte es:[edi], al
pop edi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
call fcn.0040e0d6
lea eax, [ebp - 0x44]
push eax
push eax
mov ecx, 0x428ef0
call fcn.0040e1ac
add esp, 0x20
push 0x20
pop edi
cmp dword [ebp + 0x10], ebx
jne 0x40e4a2
mov dword [ebp - 0x68], 0x10
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x64]
push eax
call sub.MSVCR100.dll_memcpy
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.0040e25f
add esp, 0x14
xor eax, eax
mov cl, byte [ebp + eax - 0x44]
xor byte [ebp + eax - 0x24], cl
inc eax
cmp eax, edi
jl 0x40e47a
push edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add esi, 0x30
dec dword [ebp - 0x68]
jne 0x40e45d
jmp 0x40e4f5
mov dword [ebp - 0x68], 0xf
add esi, 0x2d0
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x64]
push eax
call sub.MSVCR100.dll_memcpy
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.0040e25f
add esp, 0x14
xor eax, eax
mov cl, byte [ebp + eax - 0x44]
xor byte [ebp + eax - 0x24], cl
inc eax
cmp eax, edi
jl 0x40e4cc
push edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
dec dword [ebp - 0x68]
sub esi, 0x30
cmp dword [ebp - 0x68], ebx
jge 0x40e4af
push 0x40
lea esi, [ebp - 0x44]
call fcn.0040e10d
mov eax, esi
push eax
push eax
push 0x40
pop edi
mov ecx, 0x428f30
call fcn.0040e1ac
push 8
push ebx
push dword [ebp - 0x6c]
call sub.MSVCR100.dll_memset
add esp, 0x18
xor esi, esi
or edi, 0xffffffff
mov dl, byte [ebp + esi - 0x44]
mov ecx, edi
and ecx, 7
mov eax, esi
sar eax, 3
add eax, dword [ebp - 0x6c]
shl dl, cl
or byte [eax], dl
inc esi
dec edi
cmp edi, 0xffffffbf
jg 0x40e523
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421350
leave
ret
Function at 0x40f2c8
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 4], eax
je 0x40f2d5
inc eax
pop esi
ret
lea ecx, [esi + 8]
push ecx
push eax
push esi
push 0x40f2b1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
jne 0x40f2f1
xor eax, eax
pop esi
ret
push 0xffffffffffffffff
push dword [esi + 0x10]
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
ret

Function at 0x41092a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x4109c1
cmp word [eax], si
je 0x4109c1
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x4109c1
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp dword [ebp - 4], esi
jne 0x4109ba
cmp ebx, 0x500000
ja 0x4109ba
push ebx
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
pop ecx
cmp edi, esi
jne 0x410990
push dword [ebp + 8]
jmp 0x4109bb
push esi
push dword [ebp + 0xc]
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4109ad
push edi
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x4109c3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41163e
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
lea ecx, [esi + 0x3c]
mov dword [esi], eax
call fcn.00401d11
push dword [ebp + 0x10]
lea ecx, [esi + 0x40]
call fcn.00401d11
push dword [ebp + 8]
lea ecx, [esi + 4]
call fcn.00401d11
xor edi, edi
push edi
push edi
push edi
push edi
push str.QQ_Bug_Report_Tool
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push dword [ebp + 0x1c]
lea ecx, [esi + 0x14]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
call fcn.00404b7c
push dword [ebp + 0x20]
lea ecx, [esi + 0x34]
call fcn.00401d11
push dword [ebp + 0x24]
lea ecx, [esi + 0x38]
call fcn.00401d11
push 0x10
push dword [ebp + 0x18]
add esi, 0x44
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebp
ret 0x20
Function at 0x411988
Capabilities:
Get file version info

Disassembly:
push 0x4c
mov eax, 0x4234f0
call fcn.004214b1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
xor ebx, ebx
push 0x436718
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.004040ca
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 2
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x4119dd
mov dword [ebp - 0x4c], 1
push 0x430b64
lea eax, [ebp - 0x4c]
push eax
call sub.MSVCR100.dll__CxxThrowException
push edi
call fcn.0042129f
mov esi, eax
pop ecx
mov dword [ebp - 0x38], esi
cmp esi, ebx
jne 0x4119fe
mov dword [ebp - 0x44], 1
push 0x430b64
lea eax, [ebp - 0x44]
jmp 0x4119d7
push esi
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x411a1e
mov dword [ebp - 0x50], 1
push 0x430b64
lea eax, [ebp - 0x50]
jmp 0x4119d7
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x42579c
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x411a46
mov dword [ebp - 0x48], 1
push 0x430b64
lea eax, [ebp - 0x48]
jmp 0x4119d7
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov ecx, edx
mov eax, esi
shr eax, 0x10
shr ecx, 0x10
movzx edi, dx
movzx edx, si
cmp eax, ebx
jne 0x411a84
cmp edx, ebx
jne 0x411a84
cmp ecx, ebx
jne 0x411a6f
cmp edi, ebx
je 0x411a99
push edi
push ecx
lea eax, [ebp - 0x34]
push 0x4257e4
push eax
call fcn.00401557
add esp, 0x10
jmp 0x411a99
push edx
push eax
push edi
push ecx
lea eax, [ebp - 0x34]
push str._d._d._d._d
push eax
call fcn.00401557
add esp, 0x18
push dword [ebp - 0x38]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], ebx
mov dword [esp], 0x104
call fcn.004013e0
push 0x105
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.00404fb7
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0040506d
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0040439d
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call fcn.00402904
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401171
mov al, 1
jmp 0x411b54
call fcn.0042150d
ret 8
Function at 0x41247f
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0x130
mov eax, 0x423657
call fcn.0042147b
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x436718
mov dword [ebp - 4], ebx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x120], ebx
call fcn.004040ca
push dword [esi]
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x120], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41261c
mov esi, dword [esi]
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x11c], eax
cmp eax, 0xffffffff
je 0x412616
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], ebx
call fcn.0042129f
push dword [ebp - 0x124]
mov esi, eax
push ebx
push esi
call sub.MSVCR100.dll_memset
add esp, 0x10
push ebx
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x124]
push esi
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4125fd
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
push dword [ebp - 0x120]
mov eax, dword [ebp - 0x128]
add eax, esi
push eax
push esi
push ebx
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], edi
call fcn.00411833
lea eax, [ebp - 0x115]
push eax
lea ecx, [ebp - 0x13c]
mov byte [ebp - 0x115], bl
call fcn.004115b6
lea eax, [ebp - 0x115]
push eax
lea ecx, [ebp - 0x13c]
mov byte [ebp - 0x115], bl
call fcn.004115b6
push 3
push dword [ebp - 0x13c]
lea eax, [ebp - 0x110]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call fcn.00404135
push dword [ebp - 0x114]
mov ecx, dword [ebp - 0x12c]
mov byte [ebp - 4], 2
call fcn.00401530
lea eax, [ebp - 0x110]
cmp dword [ebp - 0x114], eax
je 0x4125f2
push dword [ebp - 0x114]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
lea ecx, [ebp - 0x13c]
call fcn.0041586f
cmp esi, ebx
je 0x412608
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41261c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x12c]
call fcn.004214fe
ret 8
Function at 0x41277f
Capabilities:
Enumerate files on windows

Disassembly:
push 0x278
mov eax, 0x4236cc
call fcn.0042147b
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x280], ecx
mov esi, 0x436718
push esi
lea ecx, [ebp - 0x264]
call fcn.004040ca
mov eax, dword [ebx]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x264]
push ecx
push str.Sdkclient.log.xml
push eax
call fcn.004123bd
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x412935
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00401652
push esi
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 1
call fcn.004040ca
mov eax, dword [ebx]
lea ecx, [ebp - 0x268]
push ecx
push dword [ebp - 0x26c]
mov byte [ebp - 4], 2
push eax
call fcn.004123bd
add esp, 0xc
test eax, eax
je 0x4128ee
push esi
lea ecx, [ebp - 0x270]
call fcn.004040ca
push dword [ebp - 0x26c]
lea eax, [ebp - 0x270]
push str._nbelow_is_AndroidServer__s_n
push eax
mov byte [ebp - 4], 3
call fcn.00401557
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.00401fe9
add esp, 0x18
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00401d11
mov ecx, dword [ebp - 0x284]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401171
mov ecx, dword [ebp - 0x280]
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.0041247f
push eax
lea eax, [ebp - 0x278]
push edi
push eax
mov byte [ebp - 4], 5
call fcn.00401fe9
add esp, 0xc
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.00401d11
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x27c]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401171
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4127e8
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.00401171
call fcn.004214fe
ret 8
Function at 0x414c3f
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
push 3
xor edx, edx
lea eax, [edi + 2]
pop ecx
div ecx
mov esi, dword [ebp + 8]
cmp eax, 0x40000000
jae 0x414d4a
mov ecx, dword [ebp + 0x14]
shl eax, 2
cmp dword [ecx], eax
jb 0x414d4a
mov ecx, dword [ebp + 0x10]
cmp edi, 2
jbe 0x414cdd
push ebx
push 3
xor edx, edx
lea eax, [edi - 3]
pop ebx
div ebx
inc eax
movzx edx, byte [esi]
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
movzx edx, byte [esi]
movzx ebx, byte [esi + 1]
and edx, 3
add edx, edx
shr ebx, 4
mov dl, byte [ebx + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
movzx edx, byte [esi + 1]
movzx ebx, byte [esi + 2]
and edx, 0xf
shr ebx, 6
mov dl, byte [ebx + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
movzx edx, byte [esi + 2]
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], dl
add ecx, 4
add esi, 3
sub edi, 3
dec eax
jne 0x414c81
pop ebx
test edi, edi
je 0x414d39
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
and eax, 3
cmp edi, 1
jbe 0x414d24
movzx edx, byte [esi + 1]
add eax, eax
shr edx, 4
mov al, byte [edx + eax*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x414d36
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov word [ecx + 2], 0x3d3d
add ecx, 4
mov edx, dword [ebp + 0x14]
mov eax, ecx
sub eax, dword [ebp + 0x10]
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
jmp 0x414d4d
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
Function at 0x414e8a
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x43674c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
mov dword [ebp - 0x20], eax
call sub.MSVCR100.dll__byteswap_ulong
push dword [esi + 4]
mov edi, eax
call sub.MSVCR100.dll__byteswap_ulong
and dword [ebp - 0x18], 0
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x14]
sub dword [ebp - 0x1c], eax
pop ecx
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl ebx, 2
add eax, ebx
push dword [ebp + eax - 0x14]
call sub.MSVCR100.dll__byteswap_ulong
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
pop ecx
mov dword [ebp + ebx - 0x14], eax
jl 0x414ecb
push 0x10
xor eax, eax
pop ecx
mov edx, esi
shr edx, 5
add edx, dword [ebp - 0x10]
mov ebx, esi
shl ebx, 4
add ebx, dword [ebp - 0x14]
sub eax, 0x61c88647
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add edi, edx
mov edx, edi
shr edx, 5
add edx, dword [ebp - 8]
mov ebx, edi
shl ebx, 4
add ebx, dword [ebp - 0xc]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
add esi, edx
dec ecx
jne 0x414ef2
push edi
call sub.MSVCR100.dll__byteswap_ulong
mov edi, dword [ebp - 0x20]
push esi
mov dword [edi], eax
call sub.MSVCR100.dll__byteswap_ulong
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [edi + 4], eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421350
leave
ret