joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ed30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x12c
lea eax, [esp + 0x2c]
push ebx
push ebp
push esi
push edi
push eax
call fcn.0040eeb0
add esp, 4
lea ecx, [esp + 0x3c]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ee4b
mov edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x154]
mov edi, dword [esp + 0x140]
mov ebx, dword [esp + 0x144]
mov ebp, dword [esp + 0x148]
mov dword [esp + 0x21], edx
mov edx, dword [esp + 0x158]
mov dword [esp + 0x25], eax
mov eax, dword [esp + 0x15c]
mov dword [esp + 0x2d], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x31], eax
push 0
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x31], ecx
mov ecx, dword [esp + 0x168]
push 0x25
push eax
push esi
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 2
mov dword [esp + 0x29], edi
mov dword [esp + 0x2d], ebx
mov dword [esp + 0x31], ebp
mov dword [esp + 0x49], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40ee99
mov ecx, dword [esp + 0x160]
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x158]
push ecx
mov ecx, dword [esp + 0x158]
push edx
mov edx, dword [esp + 0x158]
push eax
mov eax, dword [esp + 0x158]
push ecx
push edx
push eax
push ebp
push ebx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
mov ecx, dword [esp + 0x160]
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x158]
push ecx
mov ecx, dword [esp + 0x158]
push edx
mov edx, dword [esp + 0x158]
push eax
mov eax, dword [esp + 0x158]
push ecx
mov ecx, dword [esp + 0x158]
push edx
mov edx, dword [esp + 0x158]
push eax
mov eax, dword [esp + 0x158]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
Function at 0x40f180
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x114
lea eax, [esp + 0x14]
push ebx
push ebp
push esi
push edi
push eax
call fcn.0040eeb0
add esp, 4
lea ecx, [esp + 0x24]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f221
mov edi, dword [esp + 0x128]
mov ebx, dword [esp + 0x12c]
mov ebp, dword [esp + 0x130]
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push 0xd
push eax
push esi
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 1
mov dword [esp + 0x29], edi
mov dword [esp + 0x2d], ebx
mov dword [esp + 0x31], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40f23f
push ebp
push ebx
push edi
call dword [sym.imp.GDI32.dll_GetPixel]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret

Function at 0x40f250
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10c
lea eax, [esp + 0xc]
push esi
push edi
push eax
call fcn.0040eeb0
add esp, 4
lea ecx, [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f2d5
mov edi, dword [esp + 0x118]
lea edx, [esp + 8]
push 0
push edx
lea eax, [esp + 0x14]
push 5
push eax
push esi
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 3
mov dword [esp + 0x21], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
test eax, eax
jne 0x40f2e3
push edi
call dword [sym.imp.USER32.dll_GetWindowDC]
pop edi
pop esi
add esp, 0x10c
ret
mov ecx, dword [esp + 0x118]
push ecx
call dword [sym.imp.USER32.dll_GetWindowDC]
pop edi
pop esi
add esp, 0x10c
ret
Function at 0x4182b0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x437c18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
lea esi, [ecx + 0x1bc]
push esi
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_1
push str..bak
push str..txt
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call sub.MFC42u.DLL_CString::Replace
mov eax, dword [esp + 4]
mov esi, dword [esi]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41cc80
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x437ed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov esi, ecx
push 0x43e170
push 0x200
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x41cd2d
push edi
push 4
lea eax, [esp + 0x14]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x1c]
add esp, 0x10
cmp eax, 0x4d444d44
jne 0x41cd23
push 0
push 0
push 0x43e300
mov ecx, esi
call sub.MFC42u.DLL_CWnd::MessageBoxW
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0x38]
push ebp
push 0x1010
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov ebp, eax
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x14]
test ebp, ebp
rep stosd dword es:[edi], eax
je 0x41cdb6
lea edx, [esp + 0x14]
push edx
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x26]
cmp ax, 0x20
je 0x41cd77
cmp ax, 0x10
jne 0x41cdaf
mov eax, dword [esi + 0x528]
test eax, eax
je 0x41cd92
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x528], 0
mov eax, dword [esi + 0x20]
push 1
push 0
push eax
mov dword [esi + 0x528], ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.0041e130
jmp 0x41ce05
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_3
mov ecx, dword [esp + 0x26]
mov edx, dword [esp + 0x3c]
and ecx, 0xffff
lea eax, [esp + 0xc]
push ecx
push ebp
push edx
push 0x43e2c0
push eax
mov byte [esp + 0x48], 1
call sub.MFC42u.DLL_CString::Format
mov ecx, dword [esp + 0x20]
add esp, 0x14
push 0
push 0
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CWnd::MessageBoxW
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
pop ebp
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x41e430
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0x45e
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov eax, dword [eax + 0x20]
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41e476
mov ecx, dword [esi + 0x520]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e496
mov edx, dword [esi + 0x520]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
mov eax, dword [esi + 0x520]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e496
mov ecx, dword [esi + 0x520]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x422210
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x100
lea eax, [esp]
push ebx
push esi
push edi
push 0xff
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edi, dword [esp + 0x120]
mov byte [eax + 1], 0
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x110]
mov ecx, ebx
and ecx, 3
lea eax, [esp + 0xc]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x114]
push eax
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
pop ebx
add esp, 0x100
ret 0xc

Function at 0x4222a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x100
lea eax, [esp]
push ebx
push esi
push edi
push 0xff
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edi, dword [esp + 0x120]
mov byte [eax + 1], 0
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov edx, dword [esp + 0x114]
and ecx, 3
lea eax, [esp + 0xc]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x11c]
push eax
mov eax, dword [esp + 0x114]
push 0xff
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
add esp, 0x100
ret 0x10
Function at 0x423660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x131c
call fcn.00435e00
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0xb2a]
mov word [esp + 0xb28], bx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1330]
lea edx, [esp + 0x728]
stosw word es:[edi], ax
lea eax, [esp + 0x1334]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
add esp, 0xc
cmp esi, ebx
je 0x42376f
cmp esi, 0x459
je 0x42376f
push ebx
lea eax, [esp + 0x24]
push ebx
push eax
push 0x400
push esi
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [esp + 0x20]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x728]
push ecx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x330]
push eax
push ecx
mov byte [esp + 0x1c], 0x25
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0x3c
mov byte [esp + 0x20], 0xb4
mov byte [esp + 0x21], 0xed
mov byte [esp + 0x22], 0xce
mov byte [esp + 0x23], 0xf3
mov byte [esp + 0x24], 0xd0
mov byte [esp + 0x25], 0xc5
mov byte [esp + 0x26], 0xcf
mov byte [esp + 0x27], 0xa2
mov byte [esp + 0x28], 0x20
mov byte [esp + 0x29], 0x3d
mov byte [esp + 0x2a], 0x20
mov byte [esp + 0x2b], 0x25
mov byte [esp + 0x2c], 0x73
mov byte [esp + 0x2d], 0x3e
mov byte [esp + 0x2e], bl
call edi
mov edx, dword [esp + 0x30]
add esp, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x42378f
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x728]
push eax
lea ecx, [esp + 0x32c]
push 0x43f2b4
push ecx
call edi
add esp, 0xc
mov edx, dword [esp + 0x132c]
cmp dword [edx + 0x22b4], ebx
je 0x42388b
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0xb28]
push 0x100
push eax
lea ecx, [esp + 0x330]
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call esi
lea edx, [esp + 0x20]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x18], 0x3c
mov byte [esp + 0x19], 0xb4
mov byte [esp + 0x1a], 0xed
mov byte [esp + 0x1b], 0xce
mov byte [esp + 0x1c], 0xf3
mov byte [esp + 0x1d], 0x3e
mov byte [esp + 0x1e], 0x20
mov byte [esp + 0x1f], 0xb2
mov byte [esp + 0x20], 0xe5
mov byte [esp + 0x21], 0xbc
mov byte [esp + 0x22], 0xfe
mov byte [esp + 0x23], 0xb0
mov byte [esp + 0x24], 0xe6
mov byte [esp + 0x25], 0xb1
mov byte [esp + 0x26], 0xbe
mov byte [esp + 0x27], 0x3a
mov byte [esp + 0x28], 0x25
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2c], 0x36
mov byte [esp + 0x2d], 0x2e
mov byte [esp + 0x2e], 0x31
mov byte [esp + 0x2f], 0x35
mov byte [esp + 0x30], 0x33
mov byte [esp + 0x31], 0x38
mov byte [esp + 0x32], bl
call edi
add esp, 0xc
lea edx, [esp + 0x128]
lea eax, [esp + 0x28]
push 0x100
push edx
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
lea ecx, [esp + 0x128]
push 0x10010
lea edx, [esp + 0xb2c]
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
add esp, 0x131c
ret
Function at 0x4238a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x64]
push ebx
push ebp
push esi
lea eax, [esp + 0x2c]
push edi
push eax
xor ebp, ebp
push 0x18
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], 0x28
lea edx, [eax + eax*2]
mov dword [esp + 0x50], ecx
mov word [esp + 0x54], 1
mov word [esp + 0x56], 0x18
lea eax, [edx*8 + 0x1f]
mov dword [esp + 0x58], ebp
cdq
and edx, 0x1f
mov dword [esp + 0x5c], ebp
add eax, edx
mov dword [esp + 0x60], ebp
mov ebx, eax
mov dword [esp + 0x64], ebp
sar ebx, 5
imul ebx, ecx
shl ebx, 2
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x68], ebp
lea eax, [ebx + 0x28]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0xa
lea esi, [esp + 0x48]
mov edi, eax
push 0xf
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edi, eax
cmp edi, ebp
je 0x423971
push ebp
call fcn.0042cc70
add esp, 4
mov esi, eax
push ebp
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectPalette]
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x423979
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x74]
push ebp
push eax
add eax, 0x28
push eax
push ecx
push ebp
push edx
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
cmp edi, ebp
je 0x4239b2
push 1
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectPalette]
push esi
call dword [sym.imp.GDI32.dll_RealizePalette]
push esi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x78]
push ebp
push 0x8000080
push 2
push ebp
push ebp
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4239ef
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x10]
push ebp
push ecx
lea edx, [esp + 0x28]
push 0xe
add ebx, 0x36
push edx
push esi
mov word [esp + 0x34], 0x4d42
mov dword [esp + 0x36], ebx
mov word [esp + 0x3a], bp
mov word [esp + 0x3c], bp
mov dword [esp + 0x3e], 0x36
call edi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push ebp
push eax
push ebx
push ecx
push esi
call edi
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x60
ret
Function at 0x428ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
or ecx, 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
push edi
mov edi, ebx
repne scasb al, byte es:[edi]
mov ebp, dword [esp + 0x28]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
lea esi, [ecx + 0x2090]
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x428dd1
lea edx, [esp + 0x10]
mov al, 0x74
push edx
push ebx
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x68
mov byte [esp + 0x1e], 0x6d
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x21], al
mov byte [esp + 0x22], 0x3a
mov byte [esp + 0x23], 0x5c
mov byte [esp + 0x24], 0
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x428d70
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
add edi, ebx
jmp 0x428dac
cmp byte [ebx + 1], 0x3a
je 0x428dd1
push 2
push 0x43f304
push ebx
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x428dd1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x42a0c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
push esi
call fcn.00428aa0
push esi
mov dword [esp + 0x14], eax
call fcn.0042a060
mov dword [esp + 0x18], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
mov dword [esp + 0x20], ecx
call fcn.0042a090
mov esi, dword [esp + 0x2c]
add esp, 0xc
mov dword [esp + 0x18], eax
xor eax, eax
lea ecx, [esp + 0xc]
mov dl, byte [ecx]
mov bl, byte [eax + esi]
xor bl, dl
add ecx, 4
mov byte [eax + esi], bl
inc eax
cmp eax, 4
jl 0x42a105
pop edi
pop esi
mov eax, 4
pop ebx
add esp, 0x10
ret

Function at 0x42a170
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push esi
push eax
push ecx
mov byte [esp + 0xc], 0x72
mov byte [esp + 0xd], 0x62
mov byte [esp + 0xe], 0
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x42a19d
pop esi
pop ecx
ret
push esi
push 4
lea edx, [esp + 0x14]
push 1
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [esp + 0x20]
add esp, 0x14
xor eax, eax
cmp ecx, 0x4d444d44
sete al
pop esi
pop ecx
ret
Function at 0x42a200
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
push esi
call fcn.0042a170
add esp, 4
cmp eax, 1
je 0x42a28b
mov ebx, dword [esp + 0x34]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x42a28b
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xa
ja 0x42a28b
mov byte [esp + 0x12], al
lea eax, [esp + 0x10]
push eax
push esi
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x19], 0x62
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x42a28b
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push edi
call ebp
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push edi
mov esi, eax
call ebp
add esp, 0x1c
test esi, esi
jne 0x42a295
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov ecx, esi
and ecx, 0x80000003
jns 0x42a2a4
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edx, esi
sub edx, ecx
add edx, 8
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
push edi
mov ebp, eax
push esi
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
push ebx
push esi
push ebp
call fcn.0042a3b0
mov dword [esp + 0x58], eax
mov al, 0x4f
mov byte [esp + 0x41], al
mov byte [esp + 0x42], al
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x40], 0x52
mov byte [esp + 0x43], 0x33
mov byte [esp + 0x44], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov eax, ecx
mov esi, edi
mov edi, edx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c]
push ecx
call fcn.0042a0c0
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0x40]
push edx
push eax
mov byte [esp + 0x48], 0x77
mov byte [esp + 0x49], 0x62
mov byte [esp + 0x4a], 0
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x34
test esi, esi
jne 0x42a357
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push 4
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0x4d444d44
call edi
push esi
push 4
lea edx, [esp + 0x3c]
push 1
push edx
call edi
mov eax, dword [esp + 0x54]
push esi
push eax
push 1
push ebp
call edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x38
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x42a430
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call fcn.0042a170
add esp, 4
test eax, eax
je 0x42a545
mov edx, dword [esp + 0x20]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x42a545
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xa
ja 0x42a545
mov byte [esp + 0x12], al
lea eax, [esp + 0x10]
push eax
push esi
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x19], 0x62
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x42a545
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov ebp, eax
call edi
push ebp
call dword [sym.imp.MSVCRT.dll_malloc]
push esi
mov edi, eax
push ebp
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov ebx, dword [sym.imp.MSVCRT.dll_fclose]
push esi
call ebx
mov ecx, dword [esp + 0x54]
push ecx
push ebp
push edi
call fcn.00429ea0
mov esi, eax
add esp, 0x40
test esi, esi
je 0x42a53b
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x1c], 0x77
mov byte [esp + 0x1d], 0x62
mov byte [esp + 0x1e], 0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x42a53b
push ebp
push esi
lea ecx, [edi + 8]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret