joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d3c6
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x46d411
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0046d7a0
test al, al
jne 0x46d40b
sub edx, 2
cmp edx, edi
jne 0x46d3f1
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x46d433
lea eax, [edi + 2]
cmp edx, eax
je 0x46d433
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0046d08d
add esp, 0x10
jmp 0x46d52d
push esi
lea ecx, [ebp - 0x255]
call fcn.0046d7a0
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46d476
push dword [ebp - 0x25c]
jmp 0x46d423
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x46d4b3
cmp word [ebp - 0x226], 0
je 0x46d4d4
cmp word [ebp - 0x226], ax
jne 0x46d4b3
cmp word [ebp - 0x224], 0
je 0x46d4d4
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0046d08d
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x46d520
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x46d48d
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x46d508
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x46d52d
push 0x46cbac
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004790d0
add esp, 0x10
jmp 0x46d4fd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426cbf
leave
ret
Function at 0x46e872
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x46e90f
push ebx
push esi
call fcn.0046e82e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0046b9bd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x46e8bc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x46e90e
push edi
push eax
call fcn.00467fda
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x46e8dc
call fcn.00462ac8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x46e90d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0046b9bd
add esp, 0x20
test eax, eax
jne 0x46e8fb
push edi
call fcn.00462ac8
jmp 0x46e903
push ebx
call fcn.00462ac8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x46e912
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x46e923
pop esi
ret
push ebx
push edi
push esi
call fcn.0046e82e
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00467fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x46e94b
push ebx
push esi
push edi
call fcn.004287f0
add esp, 0xc
push 0
call fcn.00462ac8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x46f22c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046ebbe

Function at 0x47c630
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47c65d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47c65d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4810cb
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x230], 0
push ebx
push esi
push edi
call fcn.004026dd
mov dword [ebp - 0x234], eax
xor ecx, ecx
mov ebx, pe_nt_image_headers32
xor edx, edx
mov byte [ebp + ecx - 0x108], cl
push 0x23
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x50b3a0]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, ebx
jl 0x4810fa
xor esi, esi
xor edi, edi
mov dl, byte [ebp + esi - 0x108]
movzx eax, byte [ebp + esi - 0x208]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x481146
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], al
inc esi
mov byte [ebp + edi - 0x108], dl
cmp esi, ebx
jl 0x481120
xor ebx, ebx
xor esi, esi
and dword [ebp - 0x22c], ebx
inc ebx
and ebx, 0x800000ff
jns 0x48117b
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, byte [ebp + ebx - 0x108]
movzx edx, cl
add esi, edx
mov dword [ebp - 0x23c], ebx
and esi, 0x800000ff
jns 0x48119d
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [ebp + esi - 0x108]
mov byte [ebp + ebx - 0x108], al
mov byte [ebp + esi - 0x108], cl
movzx eax, byte [ebp + ebx - 0x108]
add eax, edx
mov dword [ebp - 0x240], esi
movzx eax, al
mov dword [ebp - 0x238], eax
xor eax, eax
mov dword [ebp - 0x228], eax
push str.Zero
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x224], eax
call fcn.00401dd6
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x234]
call fcn.00402ba0
lea ecx, [ebp - 0x220]
call fcn.00401f02
imul esi
movsx edi, dx
add dx, si
and dx, cx
rol esi, 0x38
add esi, 0x26a
dec ecx
inc eax
ror esi, 0xa8
or di, ax
inc si
rol cx, 0xe2
inc ebx
dec si
rol edx, 0x63
add ecx, 0x103
and cx, 0x127
mul di
mul di
shr eax, 0xf1
add eax, eax
add ebx, 0x2bd
je 0x481276
cmp edx, 0x3d
jae 0x4812b8
imul dx
mul ecx
xor bx, 0xce
rol si, 0xc7
shr di, 0xe1
xor esi, 0x1b4
rol bx, 0x8a
jmp 0x48128c
rcr eax, 0x62
imul edx
imul di
shr ax, 0xdd
mov edx, 0x1e9
inc dx
imul dx
inc eax
rol edi, 0xd1
shr ax, 0x46
mov cx, bx
dec di
add ax, 0x78
mul cx
jb 0x4812b8
test esi, 0x43
jb 0x4812e9
rcl dx, 0xb5
add ebx, 0x3f
add eax, 0x1b7
jmp 0x4812d5
mul cx
ror eax, 0x1f
shr cx, 0xd6
inc bx
inc cx
dec edi
mul eax
imul si
xor bx, 0x1f2
shr ax, 0xb1
shl bx, 0x17
jb 0x4812e9
rol esi, 0x73
mul dx
inc dx
ror dx, 0x50
jmp 0x481302
ror ebx, 0x71
rcl edi, 0x49
shl bx, 0x6e
xor bx, di
mul ebx
imul esi
xor edi, ebx
dec esi
or dx, 0x92
movzx ebx, cx
inc edx
inc eax
rcr eax, 0x29
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp eax, 0xa
jl 0x4811d3
mov eax, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x22c]
mov esi, dword [ebp - 0x240]
mov al, byte [ebp + eax - 0x108]
xor byte [ebx + 0x493af0], al
inc ebx
mov dword [ebp - 0x22c], ebx
cmp ebx, 0x77400
mov ebx, dword [ebp - 0x23c]
jl 0x48116a
lea eax, [ebp - 0x234]
push eax
mov ecx, eax
call fcn.00402405
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426cbf
leave
ret
Function at 0x481636
Capabilities:
Create thread
Terminate process

Disassembly:
push esi
xor esi, esi
push esi
push esi
push esi
push 0x48156b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x85f9a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x34f000]
push edi
or ebp, 0xffffffff
jmp 0x85f9c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x85f9c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85f9b8
mov eax, 1
add ebx, ebx
jne 0x85f9db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x85f9ec
jne 0x85f9fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85f9fc
dec eax
add ebx, ebx
jne 0x85f9f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x85f9d0
xor ecx, ecx
sub eax, 3
jb 0x85fa14
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x85fa86
sar eax, 1
mov ebp, eax
jmp 0x85fa1f
add ebx, ebx
jne 0x85fa1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x85fa2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x85fa50
inc ecx
add ebx, ebx
jne 0x85fa3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x85fa31
jne 0x85fa4d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x85fa31
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x85fa70
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x85fa61
jmp 0x85f9be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x85fa70
add edi, ecx
jmp 0x85f9be
pop esi
mov edi, esi
mov ecx, 0xcccd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x85fa8e
cmp byte [edi], 0x27
jne 0x85fa8e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x85fa93
lea edi, [esi + 0x45b000]
mov eax, dword [edi]
or eax, eax
je 0x85fb0b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x460b20]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x460c60]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x85fac0
mov ecx, edi
jns 0x85faef
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x460c64]
or eax, eax
je 0x85fb05
mov dword [ebx], eax
add ebx, 4
jmp 0x85fadd
call dword [esi + 0x460c68]
popal
jmp 0x5b87b1
Function at 0x401200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447693
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x44e814]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x401280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4476c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4056c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447dbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x10], ebp
call fcn.00428800
lea ecx, [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [ebp], 0x44f830
call fcn.00429f40
xor eax, eax
lea edi, [ebp + 0x2c]
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
xor edx, edx
lea ebx, [ebp + 0x44]
mov eax, ebx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
lea ecx, [ebp + 0x5c]
mov byte [esp + 0x1c], 1
mov dword [eax + 0x14], edx
call fcn.00429f40
mov esi, dword [esp + 0x24]
mov ecx, dword [esi + 0x2c]
mov dword [edi], ecx
mov edx, dword [esi + 0x30]
mov dword [edi + 4], edx
mov eax, dword [esi + 0x34]
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x38]
mov dword [edi + 0xc], ecx
mov edx, dword [esi + 0x3c]
mov dword [edi + 0x10], edx
mov eax, dword [esi + 0x40]
mov dword [edi + 0x14], eax
mov ecx, dword [esi + 0x44]
mov dword [ebx], ecx
mov edx, dword [esi + 0x48]
mov dword [ebx + 4], edx
mov eax, dword [esi + 0x4c]
mov dword [ebx + 8], eax
mov ecx, dword [esi + 0x50]
mov dword [ebx + 0xc], ecx
mov edx, dword [esi + 0x54]
mov dword [ebx + 0x10], edx
mov eax, dword [esi + 0x58]
lea edi, [esi + 8]
test edi, edi
mov byte [esp + 0x1c], 2
mov dword [ebx + 0x14], eax
je 0x405794
lea eax, [edi + 8]
jmp 0x405796
xor eax, eax
push eax
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
add edi, 4
push edi
lea ecx, [ebp + 0xc]
call fcn.00411910
lea edi, [esi + 0x5c]
test edi, edi
je 0x4057b8
lea eax, [edi + 8]
jmp 0x4057ba
xor eax, eax
push eax
lea ecx, [ebp + 0x64]
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
add edi, 4
push edi
lea ecx, [ebp + 0x60]
call fcn.00411910
mov ecx, dword [esi + 0x80]
pop edi
mov dword [ebp + 0x80], ecx
mov ecx, dword [esp + 0x10]
pop esi
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40a4e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push esi
mov esi, dword [esp + 8]
jbe 0x40a5b0
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
inc edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dl, byte [eax]
mov cl, byte [esi]
not cl
xor cl, dl
mov al, cl
shl al, 1
cmp cl, 0x80
mov dl, al
jb 0x40a522
xor dl, 0x1b
cmp cl, 0x80
jb 0x40a522
xor al, 0x1b
xor al, cl
xor al, dl
movzx eax, al
mov ecx, eax
shr ecx, 4
and eax, 0xf
shl ecx, 4
mov cl, byte [ecx + eax + 0x44fc28]
mov al, cl
shr al, 7
shl cl, 1
or al, cl
mov byte [esi], al
mov ecx, edi
mov bl, byte [ecx]
not al
xor al, bl
mov dl, al
shl dl, 1
cmp al, 0x80
mov bl, dl
jb 0x40a562
xor bl, 0x1b
cmp al, 0x80
jb 0x40a562
xor dl, 0x1b
xor dl, al
mov al, dl
xor al, bl
movzx eax, al
mov edx, eax
shr edx, 4
shl edx, 4
and eax, 0xf
mov al, byte [edx + eax + 0x44fc28]
mov dl, al
shr dl, 7
shl al, 1
or dl, al
inc ecx
cmp ebp, 2
mov byte [esi], dl
jbe 0x40a59d
lea eax, [ebp - 2]
mov dl, byte [ecx]
mov bl, byte [esi]
xor bl, dl
inc ecx
dec eax
mov byte [esi], bl
jne 0x40a591
mov eax, dword [esp + 0x14]
inc esi
dec eax
mov dword [esp + 0x14], eax
jne 0x40a501
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
Function at 0x40a840
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
push ebx
xor ebx, ebx
test eax, eax
jbe 0x40a922
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
nop
mov dl, byte [edi]
mov cl, bl
not cl
xor cl, dl
mov al, cl
shl al, 1
cmp cl, 0x80
mov dl, al
jb 0x40a87d
xor dl, 0x1b
cmp cl, 0x80
jb 0x40a87d
xor al, 0x1b
xor al, cl
xor al, dl
movzx eax, al
mov ecx, eax
shr ecx, 4
and eax, 0xf
shl ecx, 4
mov cl, byte [ecx + eax + 0x44fc28]
mov al, cl
shr al, 7
shl cl, 1
or al, cl
mov byte [ebx + esi], al
mov dl, byte [edi + 1]
lea ecx, [edi + 1]
not al
xor al, dl
mov dl, al
shl dl, 1
cmp al, 0x80
mov byte [esp + 0x12], dl
jb 0x40a8bb
xor dl, 0x1b
cmp al, 0x80
mov byte [esp + 0x13], dl
mov dl, byte [esp + 0x12]
jb 0x40a8ca
xor dl, 0x1b
xor dl, al
mov al, dl
xor al, byte [esp + 0x13]
movzx eax, al
mov edx, eax
shr edx, 4
shl edx, 4
and eax, 0xf
mov al, byte [edx + eax + 0x44fc28]
mov dl, al
shr dl, 7
shl al, 1
or dl, al
inc ecx
cmp ebp, 2
mov byte [ebx + esi], dl
jbe 0x40a912
lea edi, [ebp - 2]
lea esp, [esp]
mov al, byte [ecx]
mov dl, byte [ebx + esi]
xor dl, al
inc ecx
dec edi
mov byte [ebx + esi], dl
jne 0x40a900
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jb 0x40a860
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40ab20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x448639
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71U.DLL_CWinThread::GetMainWnd]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_CHtmlView::GetLeft]
push eax
mov ecx, edi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CHtmlView::GetLeft]
push eax
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71U.DLL_CPreviewDC::ComputeDeltas]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_10]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT_2]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40d980
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x448e5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2d0
mov eax, dword [0x468a18]
push ebx
push ebp
push esi
mov dword [esp + 0x2d8], eax
push edi
mov esi, ecx
mov ecx, dword [esi + 0x9c]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x4101
push 0x2b4
lea edx, [esp + 0x30]
push edx
push 0
push 0x44f7f4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea edi, [esi + 0x204]
push eax
mov ecx, edi
call sub.MFC71U.DLL_CGdiObject::Attach
push 0
push 0x40
lea ebx, [esi + 0x7c]
push 0
mov ecx, ebx
call sub.MFC71U.DLL_COleControlSite::ModifyStyle
test edi, edi
je 0x40da00
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x9c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 1
push 0x1003
push eax
call ebp
push eax
call sub.MFC71U.DLL_CHandleMap::FromHandle
push 0xffffffffffffffff
push 0xaa
push 0
lea ecx, [esi + 0xdfc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push 0
mov ecx, ebx
call sub.MFC71U.DLL_CStringList::InsertBefore
push 0xffffffffffffffff
push 0x37
push 2
lea ecx, [esi + 0xe00]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push 1
mov ecx, ebx
call sub.MFC71U.DLL_CStringList::InsertBefore
push 0xffffffffffffffff
push 0x8c
push 0
lea ecx, [esi + 0xe04]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push 2
mov ecx, ebx
call sub.MFC71U.DLL_CStringList::InsertBefore
push 0xffffffffffffffff
push 0x12c
push 0
lea ecx, [esi + 0xe08]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push 3
mov ecx, ebx
call sub.MFC71U.DLL_CStringList::InsertBefore
test ebx, ebx
jne 0x40da9e
xor eax, eax
jmp 0x40daa1
mov eax, dword [ebx + 0x20]
push 0x425
push 0
push 0x1036
push eax
call ebp
mov ecx, dword [esi + 0x9c]
mov edi, dword [0x468c70]
push 0
push 0
push 0x1004
push ecx
call ebp
test edi, edi
mov ebp, eax
je 0x40db31
mov edi, edi
test edi, edi
mov eax, edi
je 0x40db80
mov edi, dword [edi]
add eax, 8
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_10]
push 1
push ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x2f0], 0
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::GetBuffer_1]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_3]
mov ecx, esi
call fcn.0040cb50
lea ecx, [esp + 0x10]
inc ebp
mov dword [esp + 0x2e8], 0xffffffff
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT_2]
test edi, edi
jne 0x40dad0
mov edx, dword [esi + 0x9c]
push 0
push 0
push 0x1004
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebx
mov dword [esi + 0xd78], eax
call fcn.00434750
mov ecx, esi
call fcn.0040ce70
mov ecx, dword [esp + 0x2e0]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2dc]
call fcn.0043cfa9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
jmp 0x43c998
jmp dword [sym.imp.MFC71U.DLL_AfxThrowInternetException]
Function at 0x411e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4495c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71U.DLL_CWinThread::GetMainWnd]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.MFC71U.DLL_CDockContext::Stretch]
add esp, 4
push eax
push edi
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CHtmlView::GetLeft]
push eax
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71U.DLL_CPreviewDC::ComputeDeltas]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_10]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT_2]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret