joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409720
Capabilities:
Create http request
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.00439bd0
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x46a631], 0
mov eax, 0x10
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x1028], eax
mov eax, 0x13
push esi
mov esi, ecx
mov dword [ebp - 0x1024], 0xd2
mov dword [ebp - 0x1020], 0xe
mov dword [ebp - 0x101c], 0x81
mov dword [ebp - 0x1018], 0x23
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x1010], 0x53
mov dword [ebp - 0x100c], 8
mov dword [ebp - 0x1008], eax
je 0x4097b3
push esi
push str.stat
push 0
push 1
call fcn.0040e290
add esp, 0x10
push 0
push 0
push 0x400
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea esi, [eax - 1]
xor ecx, ecx
test esi, esi
jle 0x409806
lea esp, [esp]
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea edx, [edx + edx*4]
add edx, edx
mov eax, ecx
sub eax, edx
mov dl, byte [ebp + eax*4 - 0x102c]
xor byte [ebp + ecx - 0x404], dl
inc ecx
cmp ecx, esi
jl 0x4097e0
lea eax, [ebp - 0x1030]
push eax
push esi
lea eax, [ebp - 0x804]
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x1030], 0x400
call fcn.004091b0
push str.http:__st.shendu.com_sdsj.html
push 0x45ef00
lea ecx, [ebp - 0x1004]
push 0x400
push ecx
call fcn.00409380
mov edx, dword [ebp - 0x1030]
add esp, 0x18
xor eax, eax
test edx, edx
jle 0x409874
lea ecx, [ebp - 0xfc6]
lea esp, [esp]
movsx si, byte [ebp + eax - 0x804]
mov word [ecx], si
inc eax
add ecx, 2
cmp eax, edx
jl 0x409860
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov word [ebp + edx*2 - 0xfc6], ax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x4098d0
push 0
push SysReAllocString
push 0
push 0
lea ecx, [ebp - 0x1004]
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
jne 0x4098c2
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push eax
call edi
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00438fc8
mov esp, ebp
pop ebp
ret

Function at 0x409970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40998b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4099c2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4099be
jmp 0x4099b0
cmp esi, eax
jae 0x4099c2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4099b0
cmp esi, eax
jb 0x4099c9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45406b
mov eax, dword fs:[0]
push eax
sub esp, 0x618
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1ff
lea eax, [ebp - 0x20f]
push ebx
push eax
mov dword [ebp - 0x618], ecx
mov byte [ebp - 0x210], bl
call fcn.004391a0
mov eax, dword [edi + 4]
add esp, 0xc
cmp eax, ebx
je 0x40a2b9
push eax
push 4
lea ecx, [ebp - 0x614]
push 1
push ecx
call fcn.0043be76
mov edx, dword [edi + 4]
push edx
mov esi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40a2b9
cmp esi, ebx
jne 0x40a2b9
xor eax, eax
jmp 0x40a3df
mov dword [ebp - 0x624], ebx
cmp dword [ebp - 0x614], ebx
jle 0x40a3d3
jmp 0x40a2d2
xor ebx, ebx
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40a300
push eax
push 4
lea eax, [ebp - 0x620]
push 1
push eax
call fcn.0043be76
mov ecx, dword [edi + 4]
push ecx
mov esi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40a300
cmp esi, ebx
je 0x40a2b2
push 0x400
lea edx, [ebp - 0x610]
push ebx
push edx
call fcn.004391a0
mov eax, dword [edi + 4]
add esp, 0xc
cmp eax, ebx
je 0x40a34c
push eax
mov eax, dword [ebp - 0x620]
push eax
lea ecx, [ebp - 0x210]
push 1
push ecx
call fcn.0043be76
mov edx, dword [edi + 4]
push edx
mov esi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40a34c
cmp esi, ebx
je 0x40a2b2
lea eax, [ebp - 0x610]
push eax
mov eax, dword [ebp - 0x620]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040e030
add esp, 8
lea edx, [ebp - 0x610]
push edx
lea ecx, [ebp - 0x61c]
call fcn.00409c00
mov esi, dword [ebp - 0x618]
mov dword [ebp - 4], ebx
add esi, 0xc
lea ebx, [ebp - 0x61c]
call fcn.0040b110
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x61c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a3ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x624]
inc eax
mov dword [ebp - 0x624], eax
cmp eax, dword [ebp - 0x614]
jl 0x40a2d0
mov ecx, dword [ebp - 0x618]
push edi
call fcn.0040b790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret 4
Function at 0x40a400
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x1ff
lea eax, [ebp - 0x203]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x214], esi
mov byte [ebp - 0x204], 0
call fcn.004391a0
mov eax, dword [ebx + 4]
mov ecx, dword [esi + 0x10]
add esp, 0xc
mov dword [ebp - 0x208], ecx
test eax, eax
je 0x40a48a
push eax
push 4
lea edx, [ebp - 0x208]
push 1
push edx
call fcn.0043d36b
mov edi, eax
mov eax, dword [ebx + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40a48a
test edi, edi
jne 0x40a48a
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x208], eax
jg 0x40a4c6
push ebx
mov ecx, esi
call fcn.0040b8a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438fc8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x20c]
test eax, eax
js 0x40a5c0
cmp eax, dword [esi + 0x10]
jge 0x40a5c0
mov ecx, dword [esi + 0xc]
mov edi, dword [ecx + eax*4]
push 0
push 0x45f178
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0x45f178
mov esi, eax
push esi
lea edx, [ebp - 0x204]
push edx
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
test esi, esi
jle 0x40a52d
lea esp, [esp]
xor byte [ebp + eax - 0x204], 0xc
inc eax
cmp eax, esi
jl 0x40a520
mov eax, dword [ebx + 4]
mov dword [ebp - 0x210], esi
test eax, eax
je 0x40a59c
push eax
push 4
lea eax, [ebp - 0x210]
push 1
push eax
call fcn.0043d36b
mov ecx, dword [ebx + 4]
push ecx
mov esi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40a565
test esi, esi
je 0x40a475
mov eax, dword [ebx + 4]
test eax, eax
je 0x40a59c
mov edx, dword [ebp - 0x210]
push eax
push edx
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.0043d36b
mov ecx, dword [ebx + 4]
push ecx
mov esi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40a59c
test esi, esi
je 0x40a475
mov eax, dword [ebp - 0x20c]
mov esi, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x20c], eax
cmp eax, dword [ebp - 0x208]
jl 0x40a4c0
jmp 0x40a49a
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x40b790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
call fcn.0040a1e0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x40b7d4
push eax
push 4
lea edi, [esi + 4]
push 1
push edi
call fcn.0043be76
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40b7d4
cmp dword [ebp - 4], 0xffffffff
jne 0x40b7df
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
test eax, eax
jg 0x40b7f3
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437584
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x40b7d4
mov ecx, dword [edi]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push eax
call fcn.004391a0
xor ebx, ebx
add esp, 0xc
mov esi, 1
cmp dword [edi], ebx
jle 0x40b88d
push 0x34
call fcn.00439a65
mov edi, eax
add esp, 4
test edi, edi
je 0x40b877
push 0x34
push 0
push edi
call fcn.004391a0
mov esi, dword [ebp + 8]
add esp, 0xc
mov ecx, edi
call fcn.0040d090
mov esi, eax
test esi, esi
je 0x40b884
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov dword [edx + ebx*4], edi
inc ebx
cmp ebx, dword [eax + 4]
jl 0x40b830
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
call fcn.00438e41
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b8a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov ebx, ecx
push edi
mov dword [ebp - 8], ebx
test eax, eax
je 0x40b91a
push eax
push 4
lea edi, [ebx + 4]
push 1
push edi
call fcn.0043d36b
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40b91a
cmp dword [ebp - 4], 0xffffffff
je 0x40b91a
mov ecx, dword [edi]
test ecx, ecx
jle 0x40b91a
xor esi, esi
mov eax, 1
test ecx, ecx
jle 0x40b91c
jmp 0x40b8f5
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + esi*4]
test eax, eax
je 0x40b91a
mov ebx, dword [ebp + 8]
push eax
call fcn.0040d200
test eax, eax
je 0x40b91c
inc esi
cmp esi, dword [edi]
jl 0x40b8f2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40be80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
call fcn.0040a1e0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x40bec4
push eax
push 4
lea edi, [esi + 4]
push 1
push edi
call fcn.0043be76
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40bec4
cmp dword [ebp - 4], 0xffffffff
jne 0x40becf
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
test eax, eax
jg 0x40bee3
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437584
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x40bec4
mov ecx, dword [edi]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push eax
call fcn.004391a0
xor ebx, ebx
add esp, 0xc
mov esi, 1
cmp dword [edi], ebx
jle 0x40bf83
push 0x10a
call fcn.00439a65
mov edi, eax
add esp, 4
test edi, edi
je 0x40bf6d
push 0x10a
push 0
push edi
call fcn.004391a0
mov esi, dword [ebp + 8]
add esp, 0xc
mov ecx, edi
call fcn.0040d3b0
mov esi, eax
test esi, esi
je 0x40bf7a
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov dword [edx + ebx*4], edi
inc ebx
cmp ebx, dword [eax + 4]
jl 0x40bf20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
call fcn.00438e41
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bf90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov ebx, ecx
push edi
mov dword [ebp - 8], ebx
test eax, eax
je 0x40c00a
push eax
push 4
lea edi, [ebx + 4]
push 1
push edi
call fcn.0043d36b
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40c00a
cmp dword [ebp - 4], 0xffffffff
je 0x40c00a
mov ecx, dword [edi]
test ecx, ecx
jle 0x40c00a
xor esi, esi
mov eax, 1
test ecx, ecx
jle 0x40c00c
jmp 0x40bfe5
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + esi*4]
test eax, eax
je 0x40c00a
mov ebx, dword [ebp + 8]
push eax
call fcn.0040d4c0
test eax, eax
je 0x40c00c
inc esi
cmp esi, dword [edi]
jl 0x40bfe2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ced0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
call fcn.0040a1e0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x40cf14
push eax
push 4
lea edi, [esi + 4]
push 1
push edi
call fcn.0043be76
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40cf14
cmp dword [ebp - 4], 0xffffffff
jne 0x40cf1f
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
test eax, eax
jg 0x40cf33
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437584
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x40cf14
mov ecx, dword [edi]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push eax
call fcn.004391a0
xor esi, esi
add esp, 0xc
mov dword [ebp - 4], 1
cmp dword [edi], esi
jle 0x40cfdd
push 0xdbe
call fcn.00439a65
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40cfc1
push 0xdbe
push 0
push ebx
call fcn.004391a0
mov edi, dword [ebp + 8]
add esp, 0xc
mov ecx, ebx
call fcn.0040d6c0
mov dword [ebp - 4], eax
test eax, eax
je 0x40cfd4
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov dword [edx + esi*4], ebx
inc esi
cmp esi, dword [eax + 4]
jl 0x40cf72
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
call fcn.00438e41
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov ebx, ecx
push edi
mov dword [ebp - 8], ebx
test eax, eax
je 0x40d07a
push eax
push 4
lea edi, [ebx + 4]
push 1
push edi
call fcn.0043d36b
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d07a
cmp dword [ebp - 4], 0xffffffff
je 0x40d07a
mov ecx, dword [edi]
test ecx, ecx
jle 0x40d07a
xor esi, esi
mov eax, 1
test ecx, ecx
jle 0x40d07c
jmp 0x40d055
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + esi*4]
test eax, eax
je 0x40d07a
mov ebx, dword [ebp + 8]
push eax
call fcn.0040d860
test eax, eax
je 0x40d07c
inc esi
cmp esi, dword [edi]
jl 0x40d052
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
push 0x1ff
lea ecx, [ebp - 0x203]
lea eax, [ebx + 0xa]
push 0
push ecx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], eax
mov byte [ebp - 0x204], 0
call fcn.004391a0
push 0x34
push 0
push ebx
call fcn.004391a0
add esp, 0x18
mov dword [ebp - 0x208], 0
jmp 0x40d0f0
mov eax, dword [esi + 4]
test eax, eax
je 0x40d1e1
push eax
push 4
lea edx, [ebp - 0x20c]
push 1
push edx
call fcn.0043be76
mov edi, eax
mov eax, dword [esi + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d1e1
cmp edi, 0xffffffff
je 0x40d1e1
mov ecx, dword [ebp - 0x20c]
test ecx, ecx
jle 0x40d18a
mov eax, dword [esi + 4]
test eax, eax
je 0x40d1e1
push eax
push ecx
lea ecx, [ebp - 0x204]
push 1
push ecx
call fcn.0043be76
mov edx, dword [esi + 4]
push edx
mov edi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d1e1
cmp edi, 0xffffffff
je 0x40d1e1
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp + eax*4 - 0x214]
mov eax, dword [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.0040e030
add esp, 8
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp eax, 2
jb 0x40d0f0
mov eax, dword [esi + 4]
test eax, eax
je 0x40d1e1
push eax
push 0x20
push 1
add ebx, 0x14
push ebx
call fcn.0043be76
mov edi, eax
mov eax, dword [esi + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d1e1
cmp edi, 0xffffffff
je 0x40d1e1
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00438fc8
mov esp, ebp
pop ebp
ret
Function at 0x40d200
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], eax
add eax, 0xa
push 0x1ff
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.004391a0
add esp, 0xc
push esi
mov dword [ebp - 0x208], 0
push edi
jmp 0x40d260
mov ecx, dword [ebp - 0x208]
mov edi, dword [ebp + ecx*4 - 0x218]
push 0
push 0x45f178
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0x45f178
mov esi, eax
push esi
lea edx, [ebp - 0x204]
push edx
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
test esi, esi
jle 0x40d2bd
lea esp, [esp]
xor byte [ebp + eax - 0x204], 0xc
inc eax
cmp eax, esi
jl 0x40d2b0
mov eax, dword [ebx + 4]
mov dword [ebp - 0x20c], esi
test eax, eax
je 0x40d399
push eax
push 4
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.0043d36b
mov ecx, dword [ebx + 4]
push ecx
mov esi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d399
cmp esi, 0xffffffff
je 0x40d399
mov ecx, dword [ebp - 0x20c]
test ecx, ecx
jle 0x40d33a
mov eax, dword [ebx + 4]
test eax, eax
je 0x40d399
push eax
push ecx
lea edx, [ebp - 0x204]
push 1
push edx
call fcn.0043d36b
mov esi, eax
mov eax, dword [ebx + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d399
cmp esi, 0xffffffff
je 0x40d399
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp eax, 2
jb 0x40d260
mov eax, dword [ebx + 4]
test eax, eax
je 0x40d399
mov ecx, dword [ebp - 0x210]
push eax
push 0x20
add ecx, 0x14
push 1
push ecx
call fcn.0043d36b
mov edx, dword [ebx + 4]
push edx
mov esi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d399
cmp esi, 0xffffffff
je 0x40d399
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00438fc8
mov esp, ebp
pop ebp
ret 4
Function at 0x40d3b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
push 0x1ff
lea ecx, [ebp - 0x203]
lea eax, [edi + 0xa]
push 0
push ecx
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x20c], eax
mov byte [ebp - 0x204], 0
call fcn.004391a0
push 0x10a
push 0
push edi
call fcn.004391a0
add esp, 0x18
xor ebx, ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x40d4a9
push eax
push 4
lea edx, [ebp - 0x208]
push 1
push edx
call fcn.0043be76
mov edi, eax
mov eax, dword [esi + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d4a9
cmp edi, 0xffffffff
je 0x40d4a9
mov ecx, dword [ebp - 0x208]
test ecx, ecx
jle 0x40d48a
mov eax, dword [esi + 4]
test eax, eax
je 0x40d4a9
push eax
push ecx
lea ecx, [ebp - 0x204]
push 1
push ecx
call fcn.0043be76
mov edx, dword [esi + 4]
push edx
mov edi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d4a9
cmp edi, 0xffffffff
je 0x40d4a9
mov eax, dword [ebp + ebx*4 - 0x210]
push eax
mov eax, dword [ebp - 0x208]
lea ecx, [ebp - 0x204]
push ecx
call fcn.0040e030
add esp, 8
inc ebx
cmp ebx, 2
jb 0x40d402
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00438fc8
mov esp, ebp
pop ebp
ret
Function at 0x40d4c0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x466eb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x214], eax
add eax, 0xa
push 0x1ff
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.004391a0
add esp, 0xc
push esi
mov dword [ebp - 0x208], 0
push edi
mov edi, edi
mov ecx, dword [ebp - 0x208]
mov edi, dword [ebp + ecx*4 - 0x214]
push 0
push 0x45f178
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0x45f178
mov esi, eax
push esi
lea edx, [ebp - 0x204]
push edx
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
test esi, esi
jle 0x40d56d
lea esp, [esp]
xor byte [ebp + eax - 0x204], 0xc
inc eax
cmp eax, esi
jl 0x40d560
mov eax, dword [ebx + 4]
mov dword [ebp - 0x20c], esi
test eax, eax
je 0x40d60b
push eax
push 4
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.0043d36b
mov ecx, dword [ebx + 4]
push ecx
mov esi, eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d60b
cmp esi, 0xffffffff
je 0x40d60b
mov ecx, dword [ebp - 0x20c]
test ecx, ecx
jle 0x40d5de
mov eax, dword [ebx + 4]
test eax, eax
je 0x40d60b
push eax
push ecx
lea edx, [ebp - 0x204]
push 1
push edx
call fcn.0043d36b
mov esi, eax
mov eax, dword [ebx + 4]
push eax
call fcn.0043bfc7
add esp, 0x14
test eax, eax
jne 0x40d60b
cmp esi, 0xffffffff
je 0x40d60b
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp eax, 2
jb 0x40d510
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fc8
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00438fc8
mov esp, ebp
pop ebp
ret 4