joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b690
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x45460c]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov dword [ebp - 4], 0x7b
je 0x42b791
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 8], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0040ebf0
mov eax, esp
push esi
mov dword [ebp - 0xc], eax
push eax
mov eax, dword [ebp + 8]
dec esi
push esi
push eax
push ebx
call fcn.0042f940
add esp, 0x14
test eax, eax
je 0x42b77c
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x42b728
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0040ebf0
mov ecx, dword [ebp + 0xc]
mov eax, esp
push esi
dec esi
push eax
push esi
push ecx
push ebx
mov dword [ebp - 8], eax
call fcn.0042f940
add esp, 0x14
test eax, eax
je 0x42b77c
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x42b761
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0040ebf0
mov edx, dword [ebp + 0x10]
mov ebx, esp
push esi
dec esi
push ebx
push esi
push edx
push 0
call fcn.0042f940
add esp, 0x14
test eax, eax
je 0x42b77c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push ebx
push eax
push ecx
call sub.MPR.dll_WNetAddConnectionW
mov dword [ebp - 4], eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x7b
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call sub.MPR.dll_WNetAddConnectionA
lea esp, [ebp - 0x18]
mov dword [ebp - 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42be70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x45460c]
push ebx
push esi
push edi
test eax, eax
je 0x42beeb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
cmp eax, 0x400
ja 0x42bea6
add eax, 3
and al, 0xfc
call fcn.0040ebf0
mov esi, esp
xor ebx, ebx
jmp 0x42beba
push 0xa
push eax
call fcn.00427f20
mov esi, eax
add esp, 8
xor ebx, ebx
test esi, esi
setne bl
mov ecx, dword [ebp + 8]
push edi
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push eax
push esi
call fcn.0042f8f0
add esp, 0xc
mov edi, eax
test ebx, ebx
je 0x42bf0e
push esi
call fcn.00427f70
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea esi, [eax + 1]
push 6
push esi
call fcn.00427f20
add esp, 8
mov edi, eax
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esp, [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42cf90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push esi
push edi
xor edi, edi
push eax
push ecx
mov dword [esp + 0x10], edi
call fcn.0042e570
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x42cfbb
xor eax, eax
pop edi
pop esi
add esp, 0x18
ret
mov eax, dword [esi + 0x10]
push ebp
cmp eax, edi
push ebx
lea edx, [eax + 1]
mov dword [esi + 0x10], edx
je 0x42cfd4
mov eax, 0x455f60
jmp 0x42d07c
mov al, byte [esi + 0xc]
test al, al
je 0x42cfe5
mov eax, 0x456100
jmp 0x42d07c
test byte [esi + 0xf], 2
je 0x42d059
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 4]
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push edi
push ebp
push ecx
call ebx
lea edx, [esp + 0x38]
push edx
push eax
push esi
call fcn.0042e5f0
add esp, 0xc
test eax, eax
jne 0x42d00b
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x42d04e
mov edx, dword [esi + 4]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push edx
call fcn.0042e680
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x42d073
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edi
push edx
mov edx, dword [esi + 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42d091
mov eax, 1
mov edx, dword [esp + 0x2c]
lea ecx, [esi + 0xfc]
push ecx
push eax
push edx
call fcn.0042e5a0
add esp, 0xc
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x18]
push ecx
push eax
push eax
call fcn.004310e0
mov eax, dword [esi + 0x10]
add esp, 0xc
dec eax
pop ebx
pop ebp
mov dword [esi + 0x10], eax
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x18
ret

Function at 0x42e720
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov al, byte [esi + 0xc]
test al, al
jne 0x42e75a
mov eax, dword [esi + 4]
lea edi, [esi + 0x2c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x28], eax
jne 0x42e75a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42e75a
mov dword [edi], 0xffffffff
mov dword [esi + 0x28], 0xffffffff
pop edi
mov eax, 1
pop esi
ret
Function at 0x42e7e0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [edi + 0xe]
cmp cl, 4
jae 0x42e8f2
mov eax, ecx
and eax, 0xff
mov edx, eax
shl edx, 3
sub edx, eax
mov eax, dword [esp + 0x18]
test eax, eax
lea esi, [edi + edx*4 + 0x3c]
je 0x42e840
test cl, cl
je 0x42e8f2
mov eax, dword [esi - 0x10]
lea ecx, [esi - 0x18]
push eax
lea edx, [esi + 4]
push ecx
push edx
call fcn.004310e0
mov eax, dword [esi - 0x10]
add esp, 0xc
cmp eax, 0x10000
jae 0x42e838
add eax, eax
jmp 0x42e83d
mov eax, 0x10000
mov dword [esi + 0xc], eax
lea eax, [edi + 0x28]
lea ebx, [esi + 4]
push eax
push ebx
call fcn.00431070
add esp, 8
test eax, eax
jge 0x42e8f2
mov ecx, dword [esi + 0x14]
mov edx, dword [ebx]
mov dword [ecx + 8], edx
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [esi + 0x14]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x42e88d
mov al, byte [edi + 0xe]
inc al
mov byte [edi + 0xe], al
mov dword [esi], 3
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ebx, [esi + 0x18]
mov dword [ebx], 0
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
push ecx
mov ecx, dword [edi + 8]
push ebx
push edx
push eax
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
push eax
push edi
call fcn.0042e5f0
add esp, 0xc
test eax, eax
jne 0x42e89c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42e8e4
xor ecx, ecx
cmp eax, 0x26
setne cl
add ecx, 2
mov dword [esi], ecx
mov al, byte [edi + 0xe]
inc al
mov byte [edi + 0xe], al
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi], 1
mov al, byte [edi + 0xe]
inc al
mov byte [edi + 0xe], al
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x42e9a0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0
push 0x80
push 3
push 0
push 3
add eax, 0xfc
push 0x40000000
push eax
call fcn.0042a840
mov ebx, eax
add esp, 0x1c
cmp ebx, 0xffffffff
je 0x42ea29
push esi
lea ecx, [esp + 0xc]
push ebp
push ecx
push 0
push ebx
push 0x42ea30
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x42ea24
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
call fcn.00425dc0
mov edx, dword [0x43fe44]
add esp, 8
neg edx
sbb edx, edx
and edx, 0x15
dec edx
push edx
push esi
call edi
cmp eax, 0x102
je 0x42e9fb
push esi
call ebp
pop edi
push ebx
call ebp
pop ebp
pop esi
pop ebx
ret
Function at 0x42f0e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x4556e0
xor esi, esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebp, dword [esp + 0x24]
mov eax, dword [0x455748]
push ebx
push ebp
push eax
call fcn.00429bc0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x42f174
mov al, byte [ebp]
cmp al, 0x41
jb 0x42f11b
cmp al, 0x5a
jbe 0x42f127
cmp al, 0x61
jb 0x42f13b
cmp al, 0x7a
ja 0x42f13b
cmp al, 0x5a
ja 0x42f131
and eax, 0xff
sub eax, 0x41
jmp 0x42f139
and eax, 0xff
sub eax, 0x61
mov ebx, eax
test edi, edi
je 0x42f174
mov al, byte [ebp]
mov esi, dword [edi + 4]
cmp al, 0x41
jb 0x42f14d
cmp al, 0x5a
jbe 0x42f155
cmp al, 0x61
jb 0x42f160
cmp al, 0x7a
ja 0x42f160
mov eax, dword [ebx*4 + 0x455678]
test eax, eax
jne 0x42f170
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x14]
cmp eax, 0x3e8
jae 0x42f174
xor eax, eax
jmp 0x42f179
mov eax, 1
test eax, eax
je 0x42f23d
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
push ebp
mov dword [esp + 0x3c], 0
call fcn.0042b150
add esp, 0x18
test eax, eax
jne 0x42f1c4
push 0x4556e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test edi, edi
jne 0x42f1fb
push 0xa
push 0x18
call fcn.00427f20
add esp, 8
mov esi, eax
push edi
push esi
push ebp
call fcn.00421290
add esp, 4
push eax
mov eax, dword [0x455748]
push eax
call fcn.00429ad0
add esp, 0x10
test eax, eax
jne 0x42f212
call fcn.00427f10
jmp 0x42f212
mov ecx, dword [esi]
push ecx
call fcn.00427f70
mov edx, dword [esi + 0x10]
add esp, 4
push edx
call fcn.00427f70
add esp, 4
mov eax, dword [esp + 0x24]
mov dword [esi], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], ecx
mov edx, dword [esp + 0x14]
mov dword [esi + 8], edx
mov eax, dword [esp + 0x18]
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x14], eax
mov edi, dword [esp + 0x28]
test edi, edi
je 0x42f252
mov edx, dword [esi]
push edx
call fcn.00421290
add esp, 4
mov dword [edi], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x38]
mov dword [ecx], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esi + 8]
mov dword [eax], edx
mov edx, dword [esp + 0x34]
mov ecx, dword [esi + 0xc]
test edi, edi
mov dword [edx], ecx
je 0x42f283
mov eax, dword [esi + 0x10]
push eax
call fcn.00421290
add esp, 4
mov dword [edi], eax
push 0x4556e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x435f50
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x45bd60]
sub esp, 0x41c
cmp eax, ecx
push ebx
push ebp
push esi
push edi
jae 0x4360fd
mov ecx, eax
mov esi, eax
sar ecx, 5
and esi, 0x1f
mov edx, dword [ecx*4 + 0x45bc60]
lea edi, [ecx*4 + 0x45bc60]
shl esi, 3
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], esi
mov cl, byte [esi + edx + 4]
test cl, 1
je 0x4360fd
mov ebx, dword [esp + 0x438]
xor ebp, ebp
cmp ebx, ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x435fbe
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
test cl, 0x20
je 0x435fcf
push 2
push ebp
push eax
call fcn.00435e90
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x43612e
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x436079
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x43602a
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x436017
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x435ffa
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43611f
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x436075
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x435ff6
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4360ee
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4360c2
cmp eax, 5
jne 0x4360ab
mov dword [0x441a30], eax
mov dword [0x441a2c], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.00437050
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x4360e2
cmp byte [ebp], 0x1a
jne 0x4360e2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov dword [0x441a2c], 0x1c
jmp 0x436107
sub eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov dword [0x441a2c], 9
pop edi
pop esi
pop ebp
mov dword [0x441a30], 0
or eax, 0xffffffff
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x436075
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43615f
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x436079
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x436079
Function at 0x436af0
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x436cae
push 0x3d
push edi
call fcn.00437780
mov esi, eax
add esp, 8
test esi, esi
je 0x436cae
cmp edi, esi
je 0x436cae
mov dl, byte [esi + 1]
mov ecx, dword [0x441a58]
xor eax, eax
test dl, dl
sete al
mov ebp, eax
mov eax, dword [0x441a54]
cmp eax, ecx
jne 0x436b47
push eax
call fcn.00436d80
add esp, 4
mov dword [0x441a54], eax
test eax, eax
jne 0x436bc2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x436b6e
mov eax, dword [0x441a5c]
test eax, eax
je 0x436b6e
call fcn.004358f0
test eax, eax
je 0x436bbd
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
je 0x436b7a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 4
call fcn.004025a0
add esp, 4
mov dword [0x441a54], eax
test eax, eax
je 0x436cae
mov dword [eax], 0
mov eax, dword [0x441a5c]
test eax, eax
jne 0x436bbd
push 4
call fcn.004025a0
add esp, 4
mov dword [0x441a5c], eax
test eax, eax
je 0x436cae
mov dword [eax], 0
mov eax, dword [0x441a54]
mov ebx, eax
mov eax, esi
sub eax, edi
push eax
push edi
mov dword [esp + 0x18], eax
call fcn.00436d00
mov esi, eax
add esp, 8
test esi, esi
jl 0x436cbf
cmp dword [ebx], 0
je 0x436cbf
test ebp, ebp
je 0x436cb7
mov ecx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push ecx
call fcn.00402550
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x436c19
mov eax, edi
mov edx, dword [eax + 4]
add eax, 4
mov dword [edi], edx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x436c08
lea eax, [esi*4]
push eax
push ebx
call fcn.004375e0
add esp, 8
test eax, eax
je 0x436c33
mov dword [0x441a54], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x436ca6
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.004025a0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x436ca6
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
neg ebp
rep movsb byte es:[edi], byte [esi]
sbb ebp, ebp
mov byte [ebx + eax], 0
lea eax, [ebx + eax + 1]
not ebp
and ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00402550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
invalid
Function at 0x4374a0
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x455d38]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
test eax, eax
jne 0x4374e8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4374cc
mov eax, 1
jmp 0x4374e3
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x4375c8
mov eax, 2
mov dword [0x455d38], eax
cmp eax, 2
jne 0x437508
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 1
jne 0x4375da
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x437523
mov ecx, dword [0x441dd0]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jne 0x437542
pop edi
pop esi
pop ebp
pop ebx
ret
lea edx, [edi + edi]
push edx
call fcn.004025a0
mov esi, eax
add esp, 4
test esi, esi
jne 0x437559
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4375bf
mov eax, dword [esp + 0x20]
push 0
test eax, eax
push 0
jne 0x4375a0
mov eax, dword [esp + 0x2c]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x4375bf
push esi
call fcn.00402550
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push 0xffffffffffffffff
push esi
push 0x220
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x4375cf
push esi
call fcn.00402550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00402550
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x405610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x40563d
test cl, 7
je 0x40563d
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4315a0]
dec esi
inc ecx
jmp 0x40561e
cmp esi, 8
jb 0x4056e0
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x4319a0]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4315a0]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x431da0]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4325a0]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x4329a0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x432da0]
movzx edx, dl
xor edi, dword [edx*4 + 0x4321a0]
movzx eax, al
xor edi, dword [eax*4 + 0x4331a0]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x40564f
pop ebx
jmp 0x4056e0
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4315a0]
dec esi
inc ecx
test esi, esi
ja 0x4056cc
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4059a1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x40
pop ebx
cmp esi, ebx
jbe 0x4059eb
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410695
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410997
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410a10
lea eax, [ebp - 0x80]
push 0x20
mov dword [ebp + 8], eax
pop esi
xor ecx, ecx
push edi
test esi, esi
jbe 0x405a0b
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x4059fa
cmp esi, ebx
jae 0x405a23
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x36
push eax
call fcn.0041a800
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
call fcn.00410695
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00410997
push dword [ebp + 0x14]
lea eax, [ebp - 0xf0]
push dword [ebp + 0x10]
push eax
call fcn.00410997
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00410a10
lea eax, [ebp - 0x160]
push eax
call fcn.00410695
xor ecx, ecx
test esi, esi
jbe 0x405a8d
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405a7c
pop edi
cmp esi, ebx
jae 0x405aa6
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.0041a800
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.00410997
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.00410997
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call fcn.00410a10
pop esi
pop ebx
leave
ret 0x14
Function at 0x405ade
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xbc
push esi
mov esi, dword [ebp + 0x6c]
push edi
push 0x40
pop eax
cmp esi, eax
jae 0x405af7
mov eax, esi
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x44]
push eax
call fcn.0041c270
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
mov byte [ebp + esi - 0x44], 0
mov byte [ebp + esi - 0x43], 0
mov byte [ebp + esi - 0x42], 0
mov byte [ebp + esi - 0x41], 1
add esi, 4
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.004059a1
push 0x20
pop esi
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp]
push eax
call fcn.0041c270
mov eax, dword [ebp + 0x7c]
add esp, 0xc
dec eax
mov dword [ebp + 0x4c], eax
push 0x10
pop eax
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x48], eax
xor edi, edi
mov eax, dword [ebp + edi + 0x4c]
test eax, eax
jbe 0x405bae
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.004059a1
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0041c270
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x20]
xor byte [ebp + eax], cl
inc eax
cmp eax, esi
jb 0x405b9c
dec dword [ebp + 0x6c]
jne 0x405b75
push esi
lea eax, [ebp]
push eax
push dword [ebp + edi + 0x40]
call fcn.0041c270
add edi, 4
add esp, 0xc
cmp edi, 0xc
jb 0x405b6a
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040cf8a
push esi
lea eax, [ebp]
push eax
call fcn.0040cf8a
push esi
lea eax, [ebp + 0x20]
push eax
call fcn.0040cf8a
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.0040cf8a
pop edi
pop esi
add ebp, 0x58
leave
ret 0x20