joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e750
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1008
call fcn.0041ecb0
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1018]
push ebp
push 1
push ebx
push esi
call fcn.0041c4e0
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x41e872
push 2
push ebx
push esi
call fcn.0041c4e0
add esp, 0xc
cmp eax, 0xffffffff
je 0x41e872
mov ecx, dword [esp + 0x1020]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x41e813
lea edi, [esp + 0x18]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.0041ec40
mov dword [esp + 0x1c], eax
add esp, 8
mov eax, 0x1000
cmp ebp, eax
jge 0x41e7ce
mov eax, ebp
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.0041c260
add esp, 0xc
mov edi, eax
cmp edi, 0xffffffff
je 0x41e7ec
sub ebp, edi
test ebp, ebp
jg 0x41e7c3
jmp 0x41e803
call fcn.00414330
cmp dword [eax], 5
jne 0x41e801
call fcn.00414320
mov dword [eax], 0xd
mov ebx, edi
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0041ec40
add esp, 8
jmp 0x41e855
jge 0x41e855
push 0
push ecx
push esi
call fcn.0041c4e0
add esp, 0xc
push esi
call fcn.0041d180
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x41e855
call fcn.00414320
mov dword [eax], 0xd
call fcn.00414330
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.0041c4e0
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1008
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1008
ret
Function at 0x4094c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x4094e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x4094d0
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret

Function at 0x4094f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x409512
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x409500
mov byte [esi + 6], 0
mov eax, esi
pop esi
ret
Function at 0x409f30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x409f52
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x409f40
mov byte [esi + 3], 0
mov eax, esi
pop esi
ret

Function at 0x409f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0x525540]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x21], 0x191a041a
mov dword [ebp - 0x1d], 0x1214130d
mov word [ebp - 0x19], 0x100
nop word [eax + eax]
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x18
jb 0x409fa0
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0x403120b
mov dword [ebp - 0x13], 0xf4405
mov word [ebp - 0xf], 1
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x409fd0
push ebx
push esi
push edi
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x31]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor edi, edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 4], eax
test eax, eax
je 0x40a08b
mov esi, dword [0x53448c]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call ebx
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc0000004
jne 0x40a06c
mov ebx, dword [ebp - 4]
push edi
push 0
push ebx
call eax
add esi, esi
cmp esi, 0x10000000
ja 0x40a081
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call dword [ebp - 8]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc0000004
je 0x40a035
test ebx, ebx
jns 0x40a091
push edi
push 0
push dword [ebp - 4]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov eax, dword [0x53448c]
cmp esi, 0x200000
cmovbe eax, esi
mov dword [0x53448c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a0c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x40a0e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x40a0d0
mov byte [esi + 0xa], 0
mov eax, esi
pop esi
ret

Function at 0x40a0f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x40a112
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x40a100
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
ret
Function at 0x40a230
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x40a252
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x40a240
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret

Function at 0x40a260
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x40a282
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x40a270
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret
Function at 0x40a690
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x40a6b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x40a6a0
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret
Function at 0x40b3a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x40b3c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x40b3b0
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret

Function at 0x40b3d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x40b3f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x40b3e0
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x40b400
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502c46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x1000417
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x40b464
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push edi
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e2540
mov edi, eax
add esp, 8
test edi, edi
je 0x40b4fd
push 2
push 0
push edi
call fcn.004e6316
push edi
call fcn.004e20cb
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.004e6316
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x40b4d1
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b4c8
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x40b4e0
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00467e80
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b4ea
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.004eadbf
push edi
call fcn.004e5dc8
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 0x10
jb 0x40b52e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b524
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b53f
push ecx
push edx
call fcn.004dc6f1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004e1990
int3
Function at 0x40b550
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502c86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.004695a0
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x1000417
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x40b594
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e2540
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40b62a
push edi
push 2
push 0
push ebx
call fcn.004e6316
push ebx
call fcn.004e20cb
push 0
push 0
push ebx
mov edi, eax
call fcn.004e6316
mov ecx, dword [esi]
add esp, 0x1c
mov edx, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
cmp edi, edx
ja 0x40b600
cmp dword [ecx + 0x14], 0x10
jb 0x40b5f8
mov ecx, dword [ecx]
mov dword [eax], edi
mov byte [ecx + edi], 0
jmp 0x40b60c
mov eax, edi
push 0
sub eax, edx
push eax
call fcn.00467e80
mov eax, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x40b616
mov eax, dword [eax]
push ebx
push edi
push 1
push eax
call fcn.004eadbf
push ebx
call fcn.004e5dc8
add esp, 0x14
pop edi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x40b65b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b651
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b66c
push ecx
push edx
call fcn.004dc6f1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004e1990
int3
Function at 0x40b680
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502c86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.004695a0
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x1000417
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x40b6c4
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e2540
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40b764
push esi
push 2
push 0
push ebx
call fcn.004e6316
push ebx
call fcn.004e20cb
push 0
push 0
push ebx
mov esi, eax
call fcn.004e6316
mov ecx, dword [edi]
mov eax, 0x1e8481
mov edx, dword [ecx + 0x10]
add esp, 0x1c
cmp esi, eax
cmova esi, eax
lea eax, [ecx + 0x10]
cmp esi, edx
ja 0x40b73a
cmp dword [ecx + 0x14], 0x10
jb 0x40b732
mov ecx, dword [ecx]
mov dword [eax], esi
mov byte [ecx + esi], 0
jmp 0x40b746
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.00467e80
mov eax, dword [edi]
cmp dword [eax + 0x14], 0x10
jb 0x40b750
mov eax, dword [eax]
push ebx
push esi
push 1
push eax
call fcn.004eadbf
push ebx
call fcn.004e5dc8
add esp, 0x14
pop esi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x40b795
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b78b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b7a6
push ecx
push edx
call fcn.004dc6f1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004e1990
int3

Function at 0x40b7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], 0x1000417
xor ecx, ecx
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x40b7c0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push esi
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e2540
mov esi, eax
add esp, 8
test esi, esi
je 0x40b80b
push 2
push 0
push esi
call fcn.004e6316
push esi
call fcn.004e20cb
push esi
mov edi, eax
call fcn.004e5dc8
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop esi
cmp ecx, 0x10
jb 0x40b83c
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b832
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b843
push ecx
push edx
call fcn.004dc6f1
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.004e1990
int3
Function at 0x40b890
Capabilities:
Check os version
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x1a], 0x2f0b1237
xor ecx, ecx
mov dword [ebp - 0x16], 0x93d1e0c
mov dword [ebp - 0x12], 0x1f061d1f
mov word [ebp - 0xe], 0x1f
mov byte [ebp - 0xc], 1
nop word [eax + eax]
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0xd
jb 0x40b8c0
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0x403122b
mov dword [ebp - 7], 0xf4405
mov word [ebp - 3], 1
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x40b8f0
lea eax, [ebp - 0xb]
mov byte [ebp - 1], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1a]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b925
lea ecx, [ebp - 0xb8]
push ecx
call eax
jmp 0x40b932
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xb4]
cmp eax, 0xb
je 0x40b942
cmp eax, 0xa
jne 0x40b951
cmp dword [ebp - 0xb0], 0
je 0x40b96b
xor al, al
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x40b94b
mov eax, dword [ebp - 0xb0]
cmp eax, 3
je 0x40b96b
cmp eax, 2
sete al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x40ba20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x1000417
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + 0x65]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x40ba30
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e2540
add esp, 8
test eax, eax
je 0x40ba6b
push eax
call fcn.004e5dc8
add esp, 4
mov bl, 1
jmp 0x40ba6d
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x40ba9d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ba93
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40baa4
push ecx
push edx
call fcn.004dc6f1
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004e1990
int3

Function at 0x40bab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x536230
mov esi, ecx
call fcn.004db9f2
add esp, 4
test eax, eax
jne 0x40bb1e
test esi, esi
je 0x40bb07
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bad2
sub ecx, edx
je 0x40bb07
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40bb03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x40bb03
cmp eax, 0x20
je 0x40bb03
cmp eax, 0x45
je 0x40bb03
cmp eax, 0x24
jne 0x40bb07
mov bl, 1
jmp 0x40bb09
xor bl, bl
push 0x536230
call fcn.004dba03
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.004db69b
int3
Function at 0x40bb30
Capabilities:
Create directory

Disassembly:
push esi
push 0x536230
mov esi, ecx
call fcn.004db9f2
add esp, 4
test eax, eax
jne 0x40bb5f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x536230
mov esi, eax
call fcn.004dba03
add esp, 4
mov eax, esi
pop esi
ret
push eax
call fcn.004db69b
int3
Function at 0x40c340
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
push esi
push edi
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], ecx
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], 0x64
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
test eax, eax
jne 0x40c547
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call esi
push 0
mov edi, eax
call esi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40c53d
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40c531
push edi
push esi
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40c527
push eax
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [esp + 0x20]
push edi
push esi
push 0
push 0
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_BitBlt]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0
push dword [esp + 0x28]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
call dword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40c4d1
push eax
call fcn.004eb10c
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
test edi, edi
je 0x40c4d1
push edi
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
xor esi, esi
cmp dword [esp + 8], esi
jbe 0x40c4c8
add edi, 0x30
nop dword [eax]
mov eax, dword [edi]
mov ecx, str.image_png
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c4ad
test dx, dx
je 0x40c4a9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c4ad
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c487
xor eax, eax
jmp 0x40c4b2
sbb eax, eax
or eax, 1
test eax, eax
je 0x40c54f
inc esi
add edi, 0x4c
cmp esi, dword [esp + 8]
jb 0x40c480
mov edi, dword [esp + 0x18]
push edi
call fcn.004ea9b6
add esp, 4
movups xmm0, xmmword [0x50dab8]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x54], 1
push eax
push dword [esp + 0x30]
movups xmmword [esp + 0x60], xmm0
push esi
mov dword [esp + 0x78], 4
mov dword [esp + 0x74], 1
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
push dword [esp + 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esp + 0x14]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
imul eax, esi, 0x4c
push ecx
movups xmm0, xmmword [eax + ecx]
movups xmmword [esp + 0x44], xmm0
jmp 0x40c4c9
Function at 0x40d520
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x40d542
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x40d530
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret
Function at 0x40e930
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x40e952
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x40e940
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x40e960
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x40e982
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x40e970
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret

Function at 0x40e990
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x40e9b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x40e9a0
mov byte [esi + 9], 0
mov eax, esi
pop esi
ret

Function at 0x40e9c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x40e9e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x40e9d0
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret

Function at 0x40e9f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x40ea12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x40ea00
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret

Function at 0x40ea20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x40ea42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x40ea30
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret

Function at 0x40ea50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x40ea72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x40ea60
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret

Function at 0x40ea80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x40eaa2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x40ea90
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret

Function at 0x40eab0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x40ead2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x40eac0
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret

Function at 0x40eae0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x40eb02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x40eaf0
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret
Function at 0x40eb10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x40eb32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x40eb20
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
ret

Function at 0x40eb40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x40eb62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x40eb50
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret
Function at 0x410070
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x410092
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x410080
mov byte [esi + 7], 0
mov eax, esi
pop esi
ret
Function at 0x413b80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x413ba2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x65]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x413b90
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret