joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a6c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x54e360
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5ac1d0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x84]
mov edi, ecx
mov edx, dword [edi + 4]
lea ecx, [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x18]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x3c]
mov ecx, edi
call eax
mov edx, dword [eax]
mov dword [esp + 0x14], eax
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
mov ebp, eax
xor esi, esi
cmp ebp, esi
jne 0x41a7ad
push 0x37
mov edi, 0xf
push str.HMAC:_can_only_be_used_with_a_block_based_hash_function
lea ecx, [esp + 0x58]
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], esi
mov byte [esp + 0x58], 0
call fcn.00403640
lea ecx, [esp + 0x24]
mov dword [esp + 0x78], esi
call fcn.0051bba6
push 0xffffffffffffffff
mov byte [esp + 0x7c], 1
push esi
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], vtable.KM::Exception.0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], esi
mov byte [esp + 0x40], 0
call fcn.004033c0
push 0x5a0434
lea edx, [esp + 0x28]
mov byte [esp + 0x7c], 0
push edx
mov dword [esp + 0x2c], vtable.KM::InvalidArgument.0
call fcn.0051fdd8
mov eax, dword [edi]
mov edx, dword [eax + 0x3c]
mov ecx, edi
call edx
mov esi, eax
mov eax, dword [edi]
mov edx, dword [eax + 0x3c]
mov ecx, edi
call edx
mov dword [esp + 0x20], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
call edx
mov ecx, dword [esp + 0x20]
add eax, eax
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
mov esi, eax
add esi, dword [esp + 0x1c]
lea eax, [edi + 8]
push eax
call fcn.0040ac10
cmp ebx, ebp
ja 0x41a806
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 0x10]
push ebx
push ecx
push edx
call fcn.0051f970
add esp, 0xc
jmp 0x41a82f
mov eax, dword [edi]
mov edx, dword [eax + 0x3c]
mov ecx, edi
call edx
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
mov edx, dword [edx + 0x2c]
push ebx
push ecx
mov ecx, dword [edi + 0x10]
push ecx
mov ecx, eax
call edx
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
mov ebx, eax
mov ecx, dword [edi + 0x10]
mov eax, ebp
sub eax, ebx
push eax
add ecx, ebx
push 0
push ecx
call fcn.0051f6f0
add esp, 0xc
xor esi, esi
test ebp, ebp
je 0x41a885
lea ebx, [ebx]
mov edx, dword [edi]
mov eax, dword [edx + 0x3c]
mov ebx, dword [edi + 0x10]
mov ecx, edi
call eax
mov ecx, dword [edi + 0x10]
mov edx, dword [eax]
mov dword [esp + 0x14], ecx
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
mov cl, byte [ebx + esi]
add eax, dword [esp + 0x14]
xor cl, 0x5c
mov byte [eax + esi], cl
mov eax, dword [edi + 0x10]
xor byte [eax + esi], 0x36
inc esi
cmp esi, ebp
jb 0x41a850
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0051b5fb
add esp, 0x68
ret 0xc
Function at 0x41ae60
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov ecx, dword [eax + 0x8c]
push edi
add ecx, 8
mov edi, 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx - 8]
add ecx, 0x10
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x57d040]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x57d240]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x57d440]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x57d640]
mov eax, dword [ecx - 0x14]
xor edx, ebx
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x57d140]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x57d340]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x57d540]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x57d740]
xor edx, ebx
mov eax, edx
ror eax, 4
xor eax, dword [ecx - 0x10]
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x57d040]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x57d240]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x57d440]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x57d640]
mov eax, dword [ecx - 0xc]
xor esi, ebx
xor eax, edx
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x57d140]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x57d340]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x57d540]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x57d740]
xor esi, ebx
dec edi
jne 0x41ae82
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
mov edx, dword [esp + 0x1c]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x41c789
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41c7d1
call fcn.0042b6ad
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41c7d1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41c814
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41c7fd
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41c7fd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x41c811
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41e644
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0042b6ad
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41e67d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0041e281
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x41e6db
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x41e6ff
cmp dword [edi + 0x74], 0
jne 0x41e6ff
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0042b6ad
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041e69c
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42a21c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42a263
call fcn.0042b6ad
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42a263
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42a27f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00429d1c
mov esi, eax
test edi, edi
je 0x42a27d
test ebx, ebx
je 0x42a27d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42aa60
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5454ba
call fcn.0051f0f8
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x42aa85
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42aad7
call fcn.00420344
push eax
lea ecx, [ebp - 0x10]
call fcn.004013a0
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0051fd0b
push eax
call fcn.004043d0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401420
mov eax, esi
call fcn.0051f1d0
ret 8
Function at 0x42ba8c
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0042b730
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42bad6
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041f2d6
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041d944
jmp 0x42bae1
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0042e4d0
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42bae7
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0042a328
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x42bb24
call fcn.0042b730
mov dword [esi + 0xc], 1
jmp 0x42bb29
call fcn.0042b730
cmp dword [esi], 0
je 0x42bb72
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x42bb4a
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041f2d6
jmp 0x42bb5c
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00401580
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041d944
jmp 0x42bb96
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x42bb96
push dword [esi]
push dword [ebp + 8]
call fcn.0042e4d0
pop esi
pop ebp
ret 0xc

Function at 0x42c5c2
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x42c5ed
call fcn.0042b6ad
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x42c610
push eax
push dword [esi + 4]
call fcn.0042c548
push esi
push eax
mov ecx, 0x5b0ed8
call fcn.0042c1ea
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x475278
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004f673a
call fcn.0042b0de
cmp dword [eax + 0x14], 0
jne 0x475295
mov ecx, esi
pop esi
jmp fcn.00474ddb
pop esi
ret

Function at 0x4787e4
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004b4227
call fcn.0042b0de
cmp dword [eax + 0x14], 0
jne 0x478801
mov ecx, esi
pop esi
jmp fcn.004781b7
pop esi
ret

Function at 0x4888a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4888c3
call fcn.0042b6ad
mov esi, dword [eax + 0xc]
push dword [0x5b2cd8]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4888e1
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4888d9
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x48890e
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4888db
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004887d7
mov esi, eax
jmp 0x488900

Function at 0x502156
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x50216e
mov edi, dword [esi + 0xc]
jmp 0x5021ae
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x502187
call fcn.00420a22
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x50219c
call fcn.00420a22
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x5021ae
call fcn.00420a22
call fcn.0042b6ad
cmp dword [eax + 0x3c], 0
je 0x5021c3
push edi
mov ecx, ebx
call fcn.00500f80
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00502070
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x5021e1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x5021ed
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x51b5fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ac1d0]
jne 0x51b605
repz ret
jmp fcn.00524be6
Function at 0x531688
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ac1d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0052460e
and dword [ebp - 0x14], 0
cmp dword [0x5b56a8], 0
mov dword [ebp - 0x18], eax
jne 0x53173b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5317e3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x57a3e8
push ebx
call edi
test eax, eax
je 0x5317e3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x57a3d8
push ebx
mov dword [0x5b56a8], eax
call edi
push eax
call esi
push 0x57a3c4
push ebx
mov dword [0x5b56ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5b56b0], eax
call edi
push eax
call esi
mov dword [0x5b56b8], eax
test eax, eax
je 0x53173b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5b56b4], eax
mov eax, dword [0x5b56b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x531794
cmp dword [0x5b56b8], ecx
je 0x531794
push eax
call esi
push dword [0x5b56b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x531794
test ebx, ebx
je 0x531794
call edi
test eax, eax
je 0x53178b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x53178b
test byte [ebp - 8], 1
jne 0x531794
or dword [ebp + 0x10], 0x200000
jmp 0x5317c7
mov eax, dword [0x5b56ac]
cmp eax, dword [ebp - 0x18]
je 0x5317c7
push eax
call esi
test eax, eax
je 0x5317c7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5317c7
mov eax, dword [0x5b56b0]
cmp eax, dword [ebp - 0x18]
je 0x5317c7
push eax
call esi
test eax, eax
je 0x5317c7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5b56a8]
call esi
test eax, eax
je 0x5317e3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5317e5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b5fb
leave
ret
Function at 0x403be0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.0043c620
mov eax, dword [0x468740]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x46c9fc
call fcn.0043bacd
add esp, 4
test eax, eax
jne 0x403d13
cmp dword [0x46ca28], 0x7fffffff
je 0x403d1a
cmp dword [0x46c9d8], eax
je 0x403cf3
push 0x2000
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.0043d4b0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x2004]
push 0xfff
push eax
call fcn.00401240
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00443f62
mov ecx, eax
add esp, 0x1c
or eax, 0xffffffff
mov edx, 0x1000
test ecx, ecx
cmovs ecx, eax
test ecx, ecx
js 0x403c98
cmp ecx, 0xfff
ja 0x403c98
jne 0x403c92
xor eax, eax
mov word [ebp - 6], ax
mov eax, 1
jmp 0x403ca7
mov eax, edx
sub eax, ecx
jmp 0x403ca7
xor eax, eax
mov word [ebp - 6], ax
mov word [ebp - 0x2004], ax
mov eax, edx
add eax, eax
shr eax, 1
sub edx, eax
mov eax, 0xa
add edx, edx
mov word [ebp + edx - 0x2004], ax
add edx, 2
cmp edx, 0x2000
jae 0x403d0e
xor eax, eax
push eax
mov word [ebp + edx - 0x2004], ax
mov dword [ebp - 0x2008], eax
lea eax, [ebp - 0x2008]
push eax
push edx
lea eax, [ebp - 0x2004]
push eax
push dword [0x46c9d8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x46c9fc
call fcn.0043bade
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.0043be00
mov esp, ebp
pop ebp
ret
call fcn.0043bf91
push 5
call fcn.0043b032
push 6
mov dword [0x46ca28], 0x7ffffffe
call fcn.0043b032
int3
Function at 0x40c560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov al, byte [ecx]
test al, al
je 0x40c588
cmp al, 0x5c
je 0x40c57b
cmp al, 0x2f
jne 0x40c57e
lea edx, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40c573
mov al, byte [edx]
mov esi, 0x7fed7fed
push edi
mov edi, 0xeeeeeeee
test al, al
je 0x40c5c1
movzx eax, al
lea edx, [edx + 1]
add esi, edi
movzx ecx, byte [eax + 0x466188]
mov eax, edi
shl eax, 5
add eax, ecx
add eax, edi
xor esi, dword [ecx*4 + 0x46a058]
lea edi, [esi + 3]
add edi, eax
mov al, byte [edx]
test al, al
jne 0x40c597
test dword [ebp + 0x18], 0x20000
pop edi
je 0x40c5d5
lea eax, [esi + ebx]
xor eax, dword [ebp + 0x14]
pop esi
pop ebx
pop ebp
ret
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x40c5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0xeeeeeeee
push edi
shr esi, 2
xor edi, edi
test esi, esi
je 0x40c635
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
nop dword [eax]
movzx ecx, al
add edx, dword [ecx*4 + 0x46a458]
lea ecx, [edx + eax]
xor dword [ebx + edi*4], ecx
mov ecx, eax
not ecx
shr eax, 0xb
shl ecx, 0x15
add ecx, 0x11111111
or eax, ecx
mov ecx, edx
shl ecx, 5
add edx, 3
add ecx, dword [ebx + edi*4]
inc edi
add edx, ecx
cmp edi, esi
jb 0x40c600
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x40c750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
shr edi, 2
mov esi, 0xeeeeeeee
mov dword [ebp + 0xc], edi
test edi, edi
je 0x40c7af
mov eax, dword [ebp + 0x10]
nop dword [eax]
mov edi, dword [ebp + 8]
movzx ecx, al
add esi, dword [ecx*4 + 0x46a458]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + ebx*4]
lea ecx, [esi + eax]
xor ecx, edx
mov dword [edi + ebx*4], ecx
mov ecx, eax
not ecx
shr eax, 0xb
shl ecx, 0x15
inc ebx
add ecx, 0x11111111
or eax, ecx
mov ecx, esi
shl ecx, 5
add esi, 3
add ecx, edx
add esi, ecx
cmp ebx, dword [ebp + 0xc]
jb 0x40c770
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40d510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 4]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
mov edx, dword [edi]
test dword [eax + 0x20], 0x10000
mov dword [ebp - 4], edx
je 0x40d5b3
mov eax, dword [ebp - 4]
mov edx, dword [esi + 0x24]
shr eax, 2
dec edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, dword [esi + 0x38]
mov dword [ebp - 8], edi
mov edi, 0xeeeeeeee
jbe 0x40d5ae
xor ebx, ebx
mov esi, dword [ebp - 8]
movzx eax, dl
add edi, dword [eax*4 + 0x46a458]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ebx*4]
lea eax, [edi + edx]
xor eax, ecx
mov dword [esi + ebx*4], eax
mov eax, edx
not eax
shr edx, 0xb
shl eax, 0x15
inc ebx
add eax, 0x11111111
or edx, eax
mov eax, edi
shl eax, 5
add edi, 3
add eax, ecx
add edi, eax
cmp ebx, dword [ebp - 0xc]
jb 0x40d562
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edi, dword [esi + 0x38]
jmp 0x40d5b0
mov edi, eax
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x40d5c5
add ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
adc ebx, 0
mov dword [ebp - 0x18], ebx
push edx
push edi
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax]
call fcn.0040b330
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
jne 0x40d5e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x411830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
dec edx
add edx, eax
cmp eax, edx
jae 0x411855
movzx ecx, byte [edx]
xor byte [eax], cl
movzx ecx, byte [eax]
xor byte [edx], cl
movzx ecx, byte [edx]
dec edx
xor byte [eax], cl
inc eax
cmp eax, edx
jb 0x411840
pop ebp
ret
Function at 0x413bd0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x413bf2
push 0xeb
push str.e:eurekawow_stormlib_9.22_srclibtomcrypt_srchashesmd5.c
push str.md___NULL
call fcn.00423ac0
add esp, 0xc
mov dword [esi + 8], 0x67452301
xor eax, eax
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0
mov dword [esi], 0
mov dword [esi + 4], 0
pop esi
pop ebp
ret