joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfffd71bc
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
add esp, 0xfffffec0
mov ecx, 0x10
lea edi, [esp + ecx*4]
mov eax, dword [esi + ecx*4 - 4]
bswap eax
mov dword [esp + ecx*4 - 4], eax
loop 0xfffd71d2
mov eax, dword [esp + 0x154]
mov ebx, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov ebp, dword [eax + 0x10]
or ecx, 0x14
mov eax, edx
push esi
not eax
and esi, edx
and eax, edi
or eax, esi
add eax, ebp
mov ebp, edi
pop edi
ror edx, 2
mov esi, edx
mov edx, ebx
rol ebx, 5
add ebx, eax
pop eax
add ebx, 0x5a827999
add ebx, eax
xor eax, dword [esp + 4]
xor eax, dword [esp + 0x1c]
xor eax, dword [esp + 0x30]
rol eax, 1
mov dword [esp + 0x3c], eax
loop 0xfffd71f6
or ecx, 0x14
mov eax, edx
xor eax, esi
xor eax, edi
add eax, ebp
mov ebp, edi
mov edi, esi
ror edx, 2
mov esi, edx
mov edx, ebx
rol ebx, 5
add ebx, eax
pop eax
add ebx, 0x6ed9eba1
add ebx, eax
xor eax, dword [esp + 4]
xor eax, dword [esp + 0x1c]
xor eax, dword [esp + 0x30]
rol eax, 1
mov dword [esp + 0x3c], eax
loop 0xfffd7232
or ecx, 0x14
mov eax, esi
push esi
or eax, edi
and esi, edi
and eax, edx
or eax, esi
add eax, ebp
mov ebp, edi
pop edi
ror edx, 2
mov esi, edx
mov edx, ebx
rol ebx, 5
add ebx, eax
pop eax
add ebx, 0x8f1bbcdc
add ebx, eax
xor eax, dword [esp + 4]
xor eax, dword [esp + 0x1c]
xor eax, dword [esp + 0x30]
rol eax, 1
mov dword [esp + 0x3c], eax
loop 0xfffd726a
mov eax, dword [esp]
xor eax, dword [esp + 8]
xor eax, dword [esp + 0x20]
xor eax, dword [esp + 0x34]
rol eax, 1
mov dword [esp + 0x40], eax
or ecx, 3
mov eax, dword [esp + ecx*4]
xor eax, dword [esp + ecx*4 + 8]
xor eax, dword [esp + ecx*4 + 0x20]
xor eax, dword [esp + ecx*4 + 0x34]
rol eax, 1
mov dword [esp + ecx*4 + 0x40], eax
loop 0xfffd72bb
or ecx, 0x14
mov eax, edx
xor eax, esi
xor eax, edi
add eax, ebp
mov ebp, edi
mov edi, esi
ror edx, 2
mov esi, edx
mov edx, ebx
rol ebx, 5
add ebx, eax
pop eax
add ebx, 0xca62c1d6
add ebx, eax
loop 0xfffd72d5
mov eax, dword [esp + 0x14]
add dword [eax], ebx
add dword [eax + 4], edx
add dword [eax + 8], esi
add dword [eax + 0xc], edi
add dword [eax + 0x10], ebp
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10004290
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sbb edx, ecx
xchg ebx, eax
in al, dx
cmp al, 0x1d
mov ebx, 0xb5edd5a0
invalid
pop ebx
test dword [esi + 0x47], edx
invalid
pop eax
inc eax
mov edx, 0x214a7035
inc ecx
rol al, 0x3a
mov eax, dword [0x18c87e55]
mov byte ss:[ebx - 5], ah
aad 0xe4
and al, 0x81
cli
mov dword [0x99e0733b], eax
cwde
jns 0x100042b2
je 0x10004257
movsb byte es:[edi], byte [esi]
adc dword [eax], eax
cld
xor dword [edi + 0x2e69c39], edi
adc byte [ecx], 0xff
bound esp, qword [eax - 0x4d253f7e]
xor al, dh
inc ebx
test byte es:[ebx + 0x72fc2400], 0x76
add bh, bl
mov ecx, edi
sub byte [eax - 0x6d795eb4], dh
jg 0x10004284
std
imul edi, esi, 0xfffffff0
loopne 0x1000433f
leave
dec esi
invalid
sub bh, byte [ebx + 0xf]
xchg ecx, eax
dec ecx
test bh, ch
pop dword [esi + 0x1d]
pop ds
cmc
clc
push eax
sysret
Function at 0x406b80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc7f3
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push 0x104
push 0
mov dword [ebp - 0x120], esi
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x118], 0
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_tmpnam_s]
push 0xffffffffffffffff
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.Qt5CoreKso.dll_public:_static_class_kso_qt::QString___cdecl_kso_qt::QString::fromLocal8Bit_char_const___int_]
add esp, 0x20
cmp dword [ebp + 0xc], 1
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x118], 1
jne 0x406c1e
push str..ini
jmp 0x406c23
push 0x4f017c
call dword [sym.imp.Qt5CoreKso.dll_public:_class_kso_qt::QString____thiscall_kso_qt::QString::append_char_const__]
lea eax, [ebp - 0x11c]
push esi
push eax
call dword [sym.imp.Qt5CoreKso.dll_public:_static_class_kso_qt::QString___cdecl_kso_qt::QDir::toNativeSeparators_class_kso_qt::QString_const__]
add esp, 8
mov ecx, esi
push eax
call dword [sym.imp.Qt5CoreKso.dll_public:_class_kso_qt::QString____thiscall_kso_qt::QString::operator_class_kso_qt::QString__]
lea ecx, [ebp - 0x11c]
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QString::destructor_void_]
push esi
call dword [sym.imp.Qt5CoreKso.dll_public:_static_bool___cdecl_kso_qt::QFile::exists_class_kso_qt::QString_const__]
add esp, 4
test al, al
je 0x406c78
push 0
mov ecx, esi
call dword [sym.imp.Qt5CoreKso.dll_public:_unsigned_short_int_const____thiscall_kso_qt::QString::utf16_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.Qt5CoreKso.dll_public:_static_bool___cdecl_kso_qt::QFile::remove_class_kso_qt::QString_const__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret 8

Function at 0x407480
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
call dword [sym.imp.Qt5CoreKso.dll_public:_unsigned_short_int_const____thiscall_kso_qt::QString::utf16_void_const]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x4074b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4074b0
mov bl, 1
jmp 0x4074b2
xor bl, bl
test esi, esi
je 0x4074bd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x4074d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
call dword [sym.imp.Qt5CoreKso.dll_public:_unsigned_short_int_const____thiscall_kso_qt::QString::utf16_void_const]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x407500
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407500
mov bl, 1
jmp 0x407502
xor bl, bl
test esi, esi
je 0x40750d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret 4
Function at 0x40b520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd4d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x53d9f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0040aa60
test al, al
jne 0x40b5ac
mov eax, dword [ebx + 8]
test eax, eax
je 0x40b562
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
call fcn.004bedfd
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x40b592
push ecx
lea eax, [ebx + 0xc]
mov ecx, esp
push eax
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QString::constructor_class_kso_qt::QString_const__]
mov ecx, esi
call fcn.00405000
jmp 0x40b594
xor eax, eax
push 0
push eax
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.Qt5CoreKso.dll_public:_static_class_kso_qt::QThreadPool____cdecl_kso_qt::QThreadPool::globalInstance_void_]
mov ecx, eax
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QThreadPool::start_class_kso_qt::QRunnable___int_]
mov eax, dword [ebx + 8]
test eax, eax
je 0x40b5c1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 8], 0
mov ecx, dword [ebx + 0x30]
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
mov dword [ebp - 0x14], esi
push 0xa
push str.updateinfo
mov dword [ebp - 4], 1
call dword [sym.imp.Qt5CoreKso.dll_private:_static_struct_kso_qt::QTypedArrayData_unsigned_short_int_____cdecl_kso_qt::QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QSettings::beginGroup_class_kso_qt::QString_const__]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QString::destructor_void_]
push 0xc
push str.UpdateResult
call dword [sym.imp.Qt5CoreKso.dll_private:_static_struct_kso_qt::QTypedArrayData_unsigned_short_int_____cdecl_kso_qt::QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QSettings::remove_class_kso_qt::QString_const__]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QString::destructor_void_]
mov ecx, ebx
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QObject::deleteLater_void_]
test esi, esi
je 0x40b649
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411df0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ddc62
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24c], 0
mov eax, dword [esi]
test eax, eax
jne 0x411fc0
push 0x208
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x24c], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x411e9d
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411e90
jmp 0x411eeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x411f02
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x411f02
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411ee0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.004033b0
push str._version.dll
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00404b80
mov edx, dword [ebp - 0x21c]
add esp, 0xc
cmp edx, 8
jb 0x411f5f
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411f55
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411f55
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 0x234]
mov dword [esi], eax
cmp edx, 8
jb 0x411fbe
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411fb4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411fb4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov eax, dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret
Function at 0x413130
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x541030]
inc eax
mov dword [0x541030], eax
cmp eax, 0x64
jl 0x413191
push esi
lea esi, [ecx + 0x18]
mov dword [0x541030], 0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x413168
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x413190
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jbe 0x413190
cmp dword [esi + 0x14], 8
jb 0x413189
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret 4
Function at 0x413c10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dddf8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
test edi, edi
jne 0x413c68
push str.Invalid_args.
push str.kupdate::KCommandLine::ParseCommandLine
push 0x7a
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcmiscKCommandLine.cpp
push edi
call fcn.00412750
add esp, 0x14
mov eax, 0x80070057
jmp 0x413d97
push edi
push str.Command_line:__s.
push str.kupdate::KCommandLine::ParseCommandLine
push 0x7e
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcmiscKCommandLine.cpp
push 7
call fcn.00412750
mov esi, dword [ebx]
add esp, 0x18
mov ecx, ebx
push dword [esi + 4]
push ebx
call fcn.004136f0
mov ecx, edi
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [ebx + 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413ca5
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebx + 8]
call fcn.004033b0
mov ecx, edi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413cd7
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.004033b0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push 0x20
push eax
call fcn.00450f80
add esp, 8
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push dword [ebp - 0x2c]
mov esi, eax
push str.argc_d.
push str.kupdate::KCommandLine::_DoParseCmdLine
push 0x70
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcmiscKCommandLine.cpp
push 7
call fcn.00412750
add esp, 0x18
mov ecx, ebx
push dword [ebp + 0xc]
push esi
push dword [ebp - 0x2c]
call fcn.00413dc0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x413d95
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x413d8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x413d8b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret 8
Function at 0x416010
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x416044
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0xc], 0
jne 0x416036
cmp eax, 2
je 0x416044
cmp eax, 3
je 0x416044
test eax, eax
jle 0x416046
movzx eax, ax
or eax, 0x80070000
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x416050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416069
test al, 0x10
je 0x416069
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4168a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4168b9
test al, 0x10
jne 0x4168b9
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x4168c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xa000
mov esi, ecx
mov dword [ebp - 0x20], eax
call fcn.004bee3b
add esp, 4
mov edi, eax
cmp dword [esi + 0x14], 8
jb 0x4168f5
mov esi, dword [esi]
push esi
push 0x5000
push edi
push 0x4f0da4
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, edi
mov dword [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416924
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x1c]
call fcn.004033b0
push edi
call fcn.004bee44
mov edi, dword [ebp - 8]
lea ebx, [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
add esp, 4
cmp edi, 8
cmovae ebx, edx
cmp dword [ebp - 0xc], 1
jne 0x4169b5
mov ecx, 0x4f1b84
mov esi, 1
sub ebx, ecx
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x4169b5
add ecx, 2
sub esi, 1
jne 0x416967
mov esi, 1
cmp edi, 8
jb 0x416a43
lea edi, [edi*2 + 2]
mov eax, edx
cmp edi, 0x1000
jb 0x416a39
mov edx, dword [edx - 4]
add edi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x416a39
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
cmp edi, 8
lea eax, [ebp - 0x1c]
push 0x4f1b88
cmovae eax, edx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov edi, dword [ebp - 8]
add esp, 8
mov edx, dword [ebp - 0x1c]
test eax, eax
je 0x416978
cmp edi, 8
lea ebx, [ebp - 0x1c]
cmovae ebx, edx
cmp dword [ebp - 0xc], 1
jne 0x416a08
mov ecx, 0x4f1b94
mov esi, 1
sub ebx, ecx
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x416a08
add ecx, 2
sub esi, 1
jne 0x4169f2
jmp 0x41697d
cmp edi, 8
lea eax, [ebp - 0x1c]
push 0x4f1b98
cmovae eax, edx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov edi, dword [ebp - 8]
add esp, 8
mov edx, dword [ebp - 0x1c]
test eax, eax
jne 0x416a31
xor esi, esi
jmp 0x41697d
mov esi, dword [ebp + 0x10]
jmp 0x41697d
push edi
push edx
call fcn.004bee2d
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bee49
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41a640
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x41a657
cmp esi, 0x20
jne 0x41a82b
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x41a82a
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x41a6c2
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x41a695
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x41a7aa
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x41a740
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x4f1ee8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + 0x4f1f08]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x4f1f08]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + 0x4f1f08]
xor esi, eax
movzx ebx, byte [ebx + 0x4f1f08]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x41a78d
cmp esi, 6
jbe 0x41a78d
cmp edx, 4
jne 0x41a78d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x4f1f08]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x4f1f08]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x4f1f08]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + 0x4f1f08]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x41a6e0
xor esi, esi
sub ecx, 1
js 0x41a829
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x41a819
cmp ecx, 4
jb 0x41a819
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x4f1f08]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4f3508]
movzx eax, byte [eax + 0x4f1f08]
xor edx, dword [eax*4 + 0x4f3908]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x4f1f08]
xor edx, dword [eax*4 + 0x4f3108]
movzx eax, bl
movzx eax, byte [eax + 0x4f1f08]
xor edx, dword [eax*4 + 0x4f3d08]
mov eax, dword [ebp + 8]
jmp 0x41a81b
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x41a7b7
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41acf0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x41aec8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x41aec8
test bl, 3
jne 0x41aec8
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x41ad3a
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x41aec8
cmp byte [eax], 0x3d
je 0x41ad27
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x41aebd
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x41ad62
sub al, 0x41
jmp 0x41ad91
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x41ad6e
sub al, 0x47
jmp 0x41ad91
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x41ad7a
add al, 4
jmp 0x41ad91
cmp al, 0x2b
jne 0x41ad82
mov al, 0x3e
jmp 0x41ad91
cmp al, 0x2f
jne 0x41ad8a
mov al, 0x3f
jmp 0x41ad91
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x41ada1
sub dl, 0x41
jmp 0x41add5
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x41adae
sub dl, 0x47
jmp 0x41add5
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x41adbb
add dl, 4
jmp 0x41add5
cmp dl, 0x2b
jne 0x41adc4
mov dl, 0x3e
jmp 0x41add5
cmp dl, 0x2f
jne 0x41adcd
mov dl, 0x3f
jmp 0x41add5
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x41ade4
sub bl, 0x41
jmp 0x41ae18
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x41adf1
sub bl, 0x47
jmp 0x41ae18
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x41adfe
add bl, 4
jmp 0x41ae18
cmp bl, 0x2b
jne 0x41ae07
mov bl, 0x3e
jmp 0x41ae18
cmp bl, 0x2f
jne 0x41ae10
mov bl, 0x3f
jmp 0x41ae18
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x41ae2a
sub ah, 0x41
jmp 0x41ae62
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x41ae39
sub ah, 0x47
jmp 0x41ae62
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x41ae48
add ah, 4
jmp 0x41ae62
cmp ah, 0x2b
jne 0x41ae51
mov ah, 0x3e
jmp 0x41ae62
cmp ah, 0x2f
jne 0x41ae5a
mov ah, 0x3f
jmp 0x41ae62
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x41aec8
cmp dl, 0xff
je 0x41aec8
cmp bl, 0xff
je 0x41aec8
cmp ah, 0xff
je 0x41aec8
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x41ad53
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret