joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x10], edx
xor esi, esi
mov dword [ebp - 0xc], ebx
test edi, edi
jle 0x401e66
cmp edi, 8
jb 0x401e47
mov eax, edi
and eax, 0x80000007
jns 0x401da7
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, edi
xorps xmm4, xmm4
mov edi, ebx
sub ecx, eax
sub edi, edx
mov eax, edx
mov dword [ebp - 4], edi
xorps xmm3, xmm3
lea edi, [ebx + 4]
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 8]
nop dword [eax]
movd xmm2, dword [ebx + eax]
lea eax, [eax + 8]
movd xmm1, dword [eax - 8]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [eax - 4]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [edx + esi]
add esi, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp esi, ecx
jl 0x401dd0
mov ebx, dword [ebp - 0xc]
por xmm3, xmm4
mov edx, dword [ebp - 0x10]
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
cmp esi, edi
jge 0x401e66
sub ebx, edx
lea ecx, [esi + edx]
sub edi, esi
movzx esi, byte [ecx + ebx]
lea ecx, [ecx + 1]
movzx edx, byte [ecx - 1]
xor esi, edx
or eax, esi
sub edi, 1
jne 0x401e52
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e70
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x46b0a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, 0x1b8
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xa8], eax
mov eax, ecx
push ebx
ror eax, 8
mov ebx, 0x37
rol ecx, 8
and eax, 0xff00ff00
and ecx, 0xff00ff
mov byte [ebp - 0x95], 1
push esi
or eax, ecx
mov dword [ebp - 0x9c], 2
push edi
mov edi, edx
mov dword [ebp - 0xa0], eax
push 1
lea edx, [ebp - 0x95]
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], 0x6a09e667
mov dword [ebp - 0x90], 0xbb67ae85
mov dword [ebp - 0x8c], 0x3c6ef372
mov dword [ebp - 0x88], 0xa54ff53a
mov dword [ebp - 0x84], 0x510e527f
mov dword [ebp - 0x80], 0x9b05688c
mov dword [ebp - 0x7c], 0x1f83d9ab
mov dword [ebp - 0x78], 0x5be0cd19
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call fcn.004019f0
mov esi, eax
add esp, 4
test esi, esi
jne 0x40202b
push 4
lea edx, [ebp - 0xa0]
lea ecx, [ebp - 0x94]
call fcn.004019f0
mov esi, eax
add esp, 4
test esi, esi
jne 0x40202b
cmp byte [ebp + 0xc], 4
je 0x401f96
push 1
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x94]
call fcn.004019f0
mov esi, eax
add esp, 4
test esi, esi
jne 0x40202b
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp + 0x14]
test ecx, ecx
jne 0x401fae
test eax, eax
je 0x401fc5
mov esi, 0xffffff53
jmp 0x40202b
mov edx, ecx
lea ecx, [ebp - 0x94]
push eax
call fcn.004019f0
mov esi, eax
add esp, 4
test esi, esi
jne 0x40202b
mov eax, dword [ebp - 0xa8]
test eax, eax
je 0x401fed
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x401fed
push ecx
mov edx, eax
lea ecx, [ebp - 0x94]
call fcn.004019f0
mov esi, eax
add esp, 4
test esi, esi
jne 0x40202b
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x94]
call fcn.00401b70
mov esi, eax
test esi, esi
jne 0x40202b
cmp ebx, 0x20
jbe 0x40201d
movups xmm0, xmmword [ebp - 0x24]
sub ebx, 0x20
movups xmmword [edi], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [edi + 0x10], xmm0
add edi, 0x20
jmp 0x40202b
push ebx
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.00430320
add esp, 0xc
inc byte [ebp - 0x95]
sub dword [ebp - 0x9c], 1
jne 0x401ed0
mov eax, 0x20
lea ecx, [ebp - 0x24]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x402046
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00419373
mov esp, ebp
pop ebp
ret
Function at 0x402070
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x46b0a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 0xb4], 4
mov dword [ebp - 0xb0], 0
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x30]
mov dword [ebp - 0xc], eax
mov ax, word [esi + 0x34]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 8], ax
movups xmm0, xmmword [esi + 0x10]
mov al, byte [esi + 0x36]
mov byte [ebp - 6], al
movups xmmword [ebp - 0x2c], xmm0
movups xmm0, xmmword [esi + 0x20]
mov esi, 0x80
movups xmmword [ebp - 0x1c], xmm0
push 0x37
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xac], 0x6a09e667
mov dword [ebp - 0xa8], 0xbb67ae85
mov dword [ebp - 0xa4], 0x3c6ef372
mov dword [ebp - 0xa0], 0xa54ff53a
mov dword [ebp - 0x9c], 0x510e527f
mov dword [ebp - 0x98], 0x9b05688c
mov dword [ebp - 0x94], 0x1f83d9ab
mov dword [ebp - 0x90], 0x5be0cd19
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call fcn.004019f0
mov edx, eax
add esp, 4
test edx, edx
jne 0x402233
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0xac]
call fcn.00401b70
mov edx, eax
mov dword [ebp - 0xb8], edx
test edx, edx
jne 0x402233
cmp dword [ebx], 1
mov eax, dword [ebp - 0xd8]
jbe 0x4021b7
cmp eax, dword [ebx + 4]
jne 0x4021b7
cmp byte [ebx + 0x76], 1
je 0x402275
mov edx, dword [ebp - 0xb4]
mov cl, 1
cmp dword [ebp - 0xb0], edx
lea eax, [edx + 1]
cmovne eax, edx
mov edx, dword [ebp - 0xb8]
mov dword [ebp - 0xb4], eax
jmp 0x4021bc
mov dword [ebx + 4], eax
xor cl, cl
mov byte [ebx + 0x76], cl
test edi, edi
je 0x402233
test esi, esi
je 0x402233
cmp esi, 0x20
jb 0x40221a
movups xmm0, xmmword [ebp - 0xd8]
sub esi, 0x20
mov eax, 0x36
movups xmmword [edi], xmm0
movups xmm0, xmmword [ebp - 0xc8]
movups xmmword [edi + 0x10], xmm0
add edi, 0x20
nop dword [eax]
add byte [ebp + eax - 0x3c], 1
jne 0x402233
add byte [ebp + eax - 0x3d], 1
jne 0x402233
add byte [ebp + eax - 0x3e], 1
jne 0x402233
add byte [ebp + eax - 0x3f], 1
jne 0x402233
add byte [ebp + eax - 0x40], 1
jne 0x402233
sub eax, 5
jns 0x4021f0
jmp 0x402233
push esi
lea eax, [ebp - 0xd8]
push eax
push edi
call fcn.00430320
mov edx, dword [ebp - 0xb8]
add esp, 0xc
xor esi, esi
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp eax, dword [ebp - 0xb4]
jl 0x4020d1
mov eax, 0x37
lea ecx, [ebp - 0x3c]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x402254
pop edi
test edx, edx
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419373
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 3
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419373
mov esp, ebp
pop ebp
ret
Function at 0x402560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
xor edx, edx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
lea ebx, [eax - 4]
mov dword [ebp - 0x14], esi
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x4025e9
mov eax, 4
cmp ebx, eax
push edi
cmovbe eax, ebx
xor edi, edi
test eax, eax
jle 0x4025be
add esi, ecx
mov ebx, eax
nop dword [eax + eax]
movzx edx, byte [esi + eax]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
xor edx, ecx
or edi, edx
sub ebx, 1
jne 0x4025a0
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
test edi, edi
jne 0x4025c8
mov edx, 3
mov dword [ebp - 8], edx
jmp 0x4025cb
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add ecx, 4
sub eax, ecx
mov dword [ebp - 4], ecx
cmp eax, 4
mov esi, 4
cmova eax, esi
mov esi, dword [ebp - 0x14]
cmp ecx, ebx
jb 0x402591
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push 0x35
push 0
lea edi, [esi + 4]
mov dword [esi], vtable.estrimp_char__53_.0
push edi
call fcn.00430e20
mov ebx, dword [ebp + 8]
add esp, 0xc
mov dword [esi + 0x3c], 0x611b3bef
xor eax, eax
nop word [eax + eax]
mov edx, dword [esi + 0x3c]
mov ecx, eax
and ecx, 3
sar edx, cl
xor dl, byte [eax + ebx]
mov byte [edi + eax], dl
inc eax
cmp eax, 0x35
jb 0x402a30
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x402a50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi], vtable.estrimp_char__14_.0
lea edi, [eax + 6]
movq qword [esi + 4], xmm0
mov dword [esi + 0xc], 0
mov word [esi + 0x10], 0
mov dword [esi + 0x14], 0x611b3bef
mov edx, dword [esi + 0x14]
lea ecx, [eax - 1]
and ecx, 3
sar edx, cl
mov ecx, eax
xor dl, byte [ebx + eax - 1]
and ecx, 3
mov byte [esi + eax + 3], dl
mov edx, dword [esi + 0x14]
sar edx, cl
xor dl, byte [eax + ebx]
mov byte [eax + esi + 4], dl
add eax, 2
sub edi, 1
jne 0x402a85
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x403380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ad40
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x46b0a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0040cb70
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov word [esi + 0xc], 0
mov ecx, dword [ecx]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x20], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [esi + 0x28], 0
call fcn.00408f20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b848
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x46b0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x34], edi
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x2c], ecx
jb 0x40c474
mov eax, dword [eax]
lea edx, [ebp - 0x2c]
push edx
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40c4af
push 0
mov dword [edi + 0x10], 0
mov ecx, edi
mov dword [edi + 0x14], 0xf
push 0x45da49
mov byte [edi], 0
call fcn.0040e120
jmp 0x40c5a6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
push 0x400
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x34], 1
call fcn.0040dcb0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 0x10
jb 0x40c4f8
mov esi, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40c57f
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x40c57f
mov eax, dword [ebp - 0x18]
dec ecx
cmp ecx, eax
ja 0x40c53f
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x40c54c
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040dcb0
movups xmm0, xmmword [ebp - 0x28]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmmword [edi], xmm0
mov byte [ebp - 0x28], 0
movq xmm0, qword [ebp - 0x18]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
jmp 0x40c59e
push 0
mov dword [edi + 0x10], 0
mov ecx, edi
mov dword [edi + 0x14], 0xf
push 0x45da49
mov byte [edi], 0
call fcn.0040e120
lea ecx, [ebp - 0x28]
call fcn.00409620
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419373
mov esp, ebp
pop ebp
ret

Function at 0x40ca60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40cab9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40cab9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40caaa
cmp esi, edx
jae 0x40cab9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40ca98
cmp esi, edx
jae 0x40cab9
cmp word [esi], 0
je 0x40cab9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40e3b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b949
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x46b0a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x40e3ec
mov ecx, dword [ebx]
mov edi, dword [ebp + 8]
mov ebx, dword [ebx + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test ebx, ebx
je 0x40e57e
nop dword [eax + eax]
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 0x14], al
inc ecx
mov ah, byte [ebp - 0x12]
inc esi
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0xe], ah
mov byte [ebp + 0xf], dl
mov byte [ebp - 0xd], dh
cmp esi, 3
jne 0x40e4b5
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
xor esi, esi
nop dword [eax + eax]
cmp dword [0x46b02c], 0x10
mov ecx, 0x46b018
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x46b018]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00413590
inc esi
cmp esi, 4
jl 0x40e480
mov ecx, dword [ebp - 0x20]
xor esi, esi
mov dl, byte [ebp + 0xf]
mov dh, byte [ebp - 0xd]
test ebx, ebx
jne 0x40e420
mov dword [ebp + 0xc], esi
test esi, esi
je 0x40e57e
mov eax, esi
cmp esi, 3
jge 0x40e4ee
cmp eax, 3
jae 0x40e592
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x40e4d2
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
jmp 0x40e4f1
mov cl, byte [ebp - 0xe]
mov al, dh
xor ebx, ebx
shr al, 2
and dh, 3
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, cl
mov byte [ebp - 0x17], dh
shr al, 6
and cl, 0x3f
add dl, al
mov byte [ebp - 0x15], cl
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x40e55c
mov esi, eax
nop dword [eax]
cmp dword [0x46b02c], 0x10
mov ecx, 0x46b018
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x46b018]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00413590
inc ebx
cmp ebx, esi
jl 0x40e530
mov esi, dword [ebp + 0xc]
cmp esi, 3
jge 0x40e57e
mov ebx, 3
sub ebx, esi
nop dword [eax + eax]
push 0x3d
mov ecx, edi
call fcn.00413590
sub ebx, 1
jne 0x40e570
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00419029
int3
Function at 0x411c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bca8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x46b0a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00418c22
mov edi, eax
add esp, 4
test edi, edi
je 0x411cad
push 1
mov dword [ebp - 4], 0
call fcn.00417487
add esp, 4
mov dword [edi + 4], eax
jmp 0x411caf
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00407fb0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov dword [ebp - 4], 3
test edi, edi
je 0x411d11
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x411d11
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x411d34
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x411d57
cmp byte [ebp + 0xc], 0
je 0x411d43
push esi
call fcn.00417752
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x411d63
mov esi, str.ios_base::badbit_set
jmp 0x411d73
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00412440
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00408d60
push 0x467ca0
lea eax, [ebp - 0x30]
push eax
call fcn.0042fe4f
int3
Function at 0x41a93f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x429242
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x429251
pop dword [ebp - 0x44]
mov eax, 0xf41454b2
sub eax, 0xf3d1c261
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x253b032d
sub dword [ebp - 0x54], 0xd6e8bde2
mov dword [ebp - 0x50], 0x772af8d0
sub dword [ebp - 0x50], 0x44f7ac8b
mov dword [ebp - 0x4c], 0x4a595329
add dword [ebp - 0x4c], 0x1f2f105
mov dword [ebp - 0x48], 0xf5f4b307
sub dword [ebp - 0x48], 0xf5f4b307
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe91c8401
sub eax, 0xe8d8d1ed
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x69bcb26a
add dword [ebp - 0x54], 0xab5b6ec
mov dword [ebp - 0x50], 0xf873dba9
sub dword [ebp - 0x50], 0xb7077a34
mov dword [ebp - 0x4c], 0x9ccf7d1f
sub dword [ebp - 0x4c], 0x396010b3
mov dword [ebp - 0x48], 0xa03f9c88
add dword [ebp - 0x48], 0x5fc06378
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xbc652a1d
add eax, 0x43de8853
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x43aec
push 0
call eax
mov ecx, 0xea99aeb9
add ecx, 0x156696fe
mov edx, eax
mov esi, 0x703f0bc6
sub esi, 0x6ff8bdc6
add esi, dword [ebp - 0x44]
mov ebx, 0x2c2d68d1
xor dword [ebp - 0x20], esi
mov edi, dword [esi]
add dword [ebp - 0x28], 0x1f804496
add edi, ebx
mov dword [ebp - 0x38], 0x9c0ab449
mov dword [edx], edi
xor dword [ebp - 0x10], edi
add edx, 0xfbfe512a
add edx, 0x401aeda
add esi, 0x87c36539
sub esi, 0x87c36535
loop 0x42936d
add eax, 0x850bcafd
add eax, 0x7af53eb2
mov ebx, eax
add eax, 0x3cbce816
sub eax, 0x3cbce811
mov ecx, 0x3d0dbef
add ecx, 0xfc6f2411
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x403740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40448f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x407290
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004037dc
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x403b3e
Capabilities:
Encode data using xor

Disassembly:
pushal
mov ebx, 0xc4a5439c
add edx, ebx
mov eax, eax
mov bh, ah
lea ebx, [0xa00846a0]
imul edi, esi, 0x942f83fe
mov eax, edi
lea ecx, [0xa04da12b]
movsx eax, cx
mov eax, edx
sub ebp, esi
mov bh, 0x5e
mov ch, 0x9a
mov edx, edx
xchg ah, dh
xchg esi, eax
test edx, 0xa8348ed7
xchg esi, esi
mov edi, 0xe9796d9e
imul edx, esi
call 0x403b87
sbb bh, ch
imul ebp, eax, 0xab1a7645
test edi, 0xa8bcc9e3
and al, cl
lea edx, [0x1fa4af9b]
xchg esi, eax
mov eax, edx
mov al, 0x97
mov al, al
mov ah, ch
test cl, 0xc
mov al, 0x99
push 0
pop eax
add eax, edx
push eax
pop esi
or al, 0xb1
mov ecx, 0
adc al, 0xc8
sbb eax, 0x870e197d
movzx eax, bl
mov ecx, esi
adc ah, al
mov edx, ecx
xchg esi, eax
mov ch, dl
sbb ah, cl
push edx
inc ecx
add esi, edx
pop ebp
xchg ecx, eax
xor al, 0x39
inc al
movsx esi, ch
push ebp
mov ecx, 0x9ee321d4
pop ebx
mov edx, 0x401bbd00
add edx, ecx
lea ecx, [0x44a82763]
mov esi, ebx
imul ecx, ecx, 0x621fcf9
xor edi, ebx
dec ecx
xor ecx, ecx
xchg eax, ebp
inc edx
imul eax, edi
mov edx, edx
mov dl, 0x43
mov dl, 0x8f
inc ah
imul esi, edi
mov edi, esi
mov al, dl
mov ebp, 0xfff01802
mov dl, 0x55
add ebp, 0x56fa
movsx edi, ch
mov bl, dh
add ecx, ebp
movsx ebx, ch
movsx esi, ah
add ecx, 0xf9105
xor ebp, edi
mov bh, 0xef
lea edx, [0xb65c895b]
mov bh, 0x6d
imul esi, ebx
movsx ebx, di
cmp ecx, 0xd6f
jb 0x403c08
pop edx
mov ebp, 0xa98232a3
dec ebp
xchg eax, ebp
xchg ch, bh
mov eax, 0xe118a36f
test ch, 0x9c
xchg bl, ch
or al, 0x83
xchg cl, al
test bh, dh
lea ebx, [0x6d276c36]
imul eax, eax, 0x75e43f2b
test bl, ah
sub eax, 0xb5c731b8
add edx, 0x6605
imul edi, eax, 0x7c2fa6d1
cmpsb byte [esi], byte es:[edi]
das
jl 0x403c2d
sbb eax, 0x98a9df72
dec ah
sub edx, 0xe8
xchg ebx, ecx
movsx ecx, bl
mov ebp, 0xa988ab64
test dl, 0x2b
test ebp, 0x268aa4dd
lea edi, [0x1667c9b8]
cmp esi, ebx
je 0x403cd3
inc ebp
lea edi, [0x56aeae5c]
lea ebx, [0x542af576]
test ebp, eax
movsx ecx, bh
xor edi, 0x42f07d82
lea ebp, [0xeeba]
mov ebx, 0xd2895426
sub esi, eax
movzx ebx, dx
sub ebp, 0x551f
and edi, ebx
dec edi
inc ebx
sub eax, ebp
adc ch, dh
mov cl, ch
mov edi, ebx
cmp ebp, ebx
add eax, 0x1e4da330
test ebx, ecx
sub cl, dh
push ebx
adc ecx, 0x1dbc5398
mov ebx, ebp
push edx
sub ecx, esi
ret