joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410a85
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x415ed0
call fcn.00410e60
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCR120.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x4177f0
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x41091f
cmp eax, edx
jne 0x410908
xor esi, esi
inc esi
mov edi, esi
jmp 0x410922
xor esi, esi
inc esi
cmp dword [0x4177f4], esi
jne 0x410934
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x41096f
cmp dword [0x4177f4], 0
jne 0x410969
mov dword [0x4177f4], esi
push 0x41324c
push 0x41323c
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41096f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x410a7f
mov dword [0x41739c], esi
cmp dword [0x4177f4], esi
jne 0x410992
push 0x413238
push 0x41321c
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x4177f4], 2
test edi, edi
jne 0x41099f
xor eax, eax
mov ecx, 0x4177f0
xchg dword [ecx], eax
cmp dword [0x4177f8], 0
je 0x4109c3
push 0x4177f8
call main
pop ecx
test eax, eax
je 0x4109c3
push 0
push 2
push 0
call dword [0x4177f8]
mov eax, dword [sym.imp.MSVCR120.dll__wcmdln]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x20]
movzx eax, word [ecx]
cmp ax, si
ja 0x410a1c
test ax, ax
je 0x4109e4
test edx, edx
jne 0x410a1c
movzx eax, word [ecx]
test ax, ax
je 0x4109f9
cmp ax, si
ja 0x4109f9
add ecx, 2
mov dword [ebp - 0x1c], ecx
jmp 0x4109e4
push ebx
push ecx
push 0
push 0x400000
call main
mov dword [0x4173a0], eax
cmp dword [0x4173a4], 0
jne 0x410a64
push eax
call dword [sym.imp.MSVCR120.dll_exit]
cmp eax, 0x22
jne 0x410a2d
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x20], edx
add ecx, 2
mov dword [ebp - 0x1c], ecx
jmp 0x4109d3
cmp dword [0x41739c], 0
jne 0x410a78
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x4173a0]
mov dword [ebp - 4], 0xfffffffe
call fcn.00410ea5
ret
call main
jmp 0x4108d8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x406440
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x47], 0
je 0x406462
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 0x46
jb 0x406450
mov byte [esi + 0x47], 0
mov eax, esi
pop esi
ret

Function at 0x406470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47973d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x493400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 7], 0
je 0x4064c2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x25]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x4064b0
mov byte [esi + 7], 0
push ecx
lea eax, [esi + 6]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410720
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4064e2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.004137e0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40655b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406551
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406551
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478074
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47973d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x493400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 9], 0
je 0x4065c2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x25]
inc edx
xor byte [ecx], al
cmp edx, 8
jb 0x4065b0
mov byte [esi + 9], 0
push ecx
lea eax, [esi + 8]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410720
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4065e2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.004137e0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40665b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406651
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406651
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478074
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47973d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x493400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0xa], 0
je 0x4066c2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x25]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x4066b0
mov byte [esi + 0xa], 0
push ecx
lea eax, [esi + 9]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410720
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4066e2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.004137e0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40675b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406751
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406751
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478074
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406770
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x32], 0
je 0x406792
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 0x31
jb 0x406780
mov byte [esi + 0x32], 0
mov eax, esi
pop esi
ret
Function at 0x406930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47973d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x493400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x31], 0
je 0x406982
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x25]
inc edx
xor byte [ecx], al
cmp edx, 0x30
jb 0x406970
mov byte [esi + 0x31], 0
push ecx
lea eax, [esi + 0x30]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410720
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4069a2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.004137e0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x406a1b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406a11
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406a11
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478074
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406a30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x406a52
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x406a40
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret
Function at 0x406a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov esi, edx
cmp dword [edi + 0x10], 0x10
jne 0x406adc
cmp byte [esi + 0x10], 0
je 0x406a95
xor edx, edx
mov al, dl
lea ecx, [esi + edx]
sub al, 0x25
inc edx
xor byte [ecx], al
cmp edx, 0xf
jb 0x406a82
mov byte [esi + 0x10], 0
push ecx
lea eax, [esi + 0xf]
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.00410720
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov esi, dword [ebp - 0x20]
cmp ebx, 0xf
mov edx, dword [edi + 0x10]
cmova eax, esi
mov dword [ebp - 8], 3
cmp dword [edi + 0x14], 0xf
jbe 0x406ac4
mov edi, dword [edi]
push dword [ebp - 0x10]
mov ecx, edi
push eax
call fcn.004183b0
add esp, 8
test al, al
je 0x406ae2
mov byte [ebp - 1], 1
jmp 0x406ae6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x20]
mov byte [ebp - 1], 0
test byte [ebp - 8], 1
je 0x406b1e
cmp ebx, 0xf
jbe 0x406b1e
lea ecx, [ebx + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x406b14
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406b14
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.00478074
add esp, 8
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406b30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x44], 0
je 0x406b52
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 0x43
jb 0x406b40
mov byte [esi + 0x44], 0
mov eax, esi
pop esi
ret

Function at 0x406b60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x136], 0
je 0x406b87
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 0x135
jb 0x406b70
mov byte [esi + 0x136], 0
mov eax, esi
pop esi
ret

Function at 0x406b90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x406bb2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x406ba0
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret
Function at 0x406fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47973d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x493400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0xc], 0
je 0x407032
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x25]
inc edx
xor byte [ecx], al
cmp edx, 0xb
jb 0x407020
mov byte [esi + 0xc], 0
push ecx
lea eax, [esi + 0xb]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410720
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x407052
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.004137e0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x4070cb
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4070c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4070c1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478074
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408570
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479a35
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x493400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, bind
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 0x2d
jb 0x408729
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
push ecx
cmova eax, dword [ebp + 8]
push eax
push 0x2d
push str.start_cmd__C__color_b__title_Error__echo
push ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.00412b70
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebp - 0x30]
sub eax, ecx
push 0x11
push str.__timeout__t_5_
cmp eax, 0x11
jb 0x40860e
cmp edx, 0xf
lea esi, [ebp - 0x40]
lea eax, [ecx + 0x11]
cmova esi, dword [ebp - 0x40]
add esi, ecx
mov dword [ebp - 0x30], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x11], 0
lea eax, [ebp - 0x40]
jmp 0x40861b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
push 0x11
call fcn.00411130
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 0xf
jbe 0x408697
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40868d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086cf
push ecx
push edx
call fcn.00478074
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x4086df
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4086d5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4086d5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478074
add esp, 8
xor ecx, ecx
int 0x29
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x408719
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40870f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40870f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478074
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00401700
int3
Function at 0x408a70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b27
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x493400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
push str.ALLUSERSPROFILE
mov dword [ebp - 0x38], 0
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edx, eax
add esp, 4
test edx, edx
je 0x408af7
mov ecx, edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408ae0
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00411290
jmp 0x408c30
mov dword [ebp - 4], 1
xorps xmm0, xmm0
push ecx
xor eax, eax
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
push 0x104
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 0x38], 4
call fcn.0040d2e0
nop
cmp dword [ebp - 0x1c], 7
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
cmova eax, dword [ebp - 0x30]
push eax
push ecx
mov dword [ebp - 0x14], ecx
call fcn.004201f2
mov ecx, dword [ebp - 0x20]
mov esi, eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x40], ecx
cmp esi, ecx
ja 0x408b6d
cmp dword [ebp - 0x1c], 7
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], esi
cmova eax, dword [ebp - 0x30]
xor ecx, ecx
mov word [eax + esi*2], cx
jmp 0x408bc2
mov edi, dword [ebp - 0x1c]
mov edx, esi
mov eax, edi
sub edx, ecx
sub eax, ecx
cmp edx, eax
ja 0x408bb1
cmp edi, 7
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x30]
cmova eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
lea edi, [eax + ecx*2]
test edx, edx
je 0x408ba3
xor eax, eax
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x40]
lea eax, [ecx + edx]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x408bbf
push ecx
push edx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
push edx
call fcn.00411830
mov edx, dword [ebp - 0x34]
cmp esi, dword [ebp - 0x14]
jae 0x408b30
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x493470
mov dword [ebp - 0x38], 2
test edx, edx
jne 0x408c4d
mov esi, dword [ebp - 0x3c]
push ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.00410500
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x408c30
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x408c26
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x408c26
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478074
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477d30
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x18]
call fcn.00404550
int3
Function at 0x40b130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x40b152
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x40b140
mov byte [esi + 5], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push esi
call fcn.00410720
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x40b192
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x40b180
mov byte [esi + 0xb], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xa]
push eax
push esi
call fcn.00410720
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x40b382
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x40b370
mov byte [esi + 8], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 7]
push eax
push esi
call fcn.00410720
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x40b3c2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x25]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x40b3b0
mov byte [esi + 0x10], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xf]
push eax
push esi
call fcn.00410720
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40b7a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40b7cc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x40b7f4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40b7fa
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x40b862
jg 0x40b811
test esi, esi
je 0x40b862
test ecx, ecx
jl 0x40b85d
jg 0x40b81b
test eax, eax
je 0x40b85d
cmp edi, ecx
jg 0x40b82f
jl 0x40b825
cmp esi, eax
jae 0x40b82f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x40b865
mov ecx, dword [ebp + 8]
jmp 0x40b86f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x40b889
jg 0x40b86f
test esi, esi
je 0x40b889
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40b889
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc